LAV
/
FFmpeg
1
0
Fork 0
Code

avcodec/nvdec: don't free NVDECContext->bitstream 

Ensure all hwaccels that allocate a buffer use NVDECContext->bitstream_internal
instead. Otherwise, if FFHWAccel->end_frame() isn't called before
FFHWAccel->uninit(), an attempt to free a stale pointer to memory not owned by
the hwaccel could take place.

Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2024-02-06 19:50:33 -03:00
parent bd3e71b21e
commit 7f92014aca
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/nvdec.c
View File

@ -259,8 +259,8 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx)
{
NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
av_freep(&ctx->bitstream);
av_freep(&ctx->bitstream_internal);
ctx->bitstream = NULL;
ctx->bitstream_len = 0;
ctx->bitstream_allocated = 0;

4
libavcodec/nvdec_h264.c
View File

@ -138,11 +138,11 @@ static int nvdec_h264_decode_slice(AVCodecContext *avctx, const uint8_t *buffer,
const H264SliceContext *sl = &h->slice_ctx[0];
void *tmp;
tmp = av_fast_realloc(ctx->bitstream, &ctx->bitstream_allocated,
tmp = av_fast_realloc(ctx->bitstream_internal, &ctx->bitstream_allocated,
ctx->bitstream_len + size + 3);
if (!tmp)
return AVERROR(ENOMEM);
ctx->bitstream = tmp;
ctx->bitstream = ctx->bitstream_internal = tmp;
tmp = av_fast_realloc(ctx->slice_offsets, &ctx->slice_offsets_allocated,
(ctx->nb_slices + 1) * sizeof(*ctx->slice_offsets));

4
libavcodec/nvdec_hevc.c
View File

@ -274,11 +274,11 @@ static int nvdec_hevc_decode_slice(AVCodecContext *avctx, const uint8_t *buffer,
NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
void *tmp;
tmp = av_fast_realloc(ctx->bitstream, &ctx->bitstream_allocated,
tmp = av_fast_realloc(ctx->bitstream_internal, &ctx->bitstream_allocated,
ctx->bitstream_len + size + 3);
if (!tmp)
return AVERROR(ENOMEM);
ctx->bitstream = tmp;
ctx->bitstream = ctx->bitstream_internal = tmp;
tmp = av_fast_realloc(ctx->slice_offsets, &ctx->slice_offsets_allocated,
(ctx->nb_slices + 1) * sizeof(*ctx->slice_offsets));