[FFmpeg-devel] [PATCH] Fix double free and null dereferences in the qsv decoder
Yuli Khodorkovskiy
ykhodo at gmail.com
Fri Jul 29 17:59:38 EEST 2016
On Fri, Jul 29, 2016 at 5:35 AM, Ivan Uskov <ivan.uskov at nablet.com> wrote:
>
> Hello Yuli,
>
> Wednesday, July 27, 2016, 6:21:41 PM, you wrote:
>
> > This patch fixes the h264_qsv decoder issues mentioned
> > in https://ffmpeg.zeranoe.com/forum/viewtopic.php?t=2962.
>
> > The patch may be tested by specifying h264_qsv as the decoder to ffplay
> > for an h264 encoded file.
>
> > ffplay -vcodec h264_qsv foo.mts
>
> > Signed-off-by: Yuli Khodorkovskiy <ykhodo at gmail.com>
> > ---
> > libavcodec/qsvdec.c | 10 ++++++----
> > 1 file changed, 6 insertions(+), 4 deletions(-)
>
> > diff --git a/libavcodec/qsvdec.c b/libavcodec/qsvdec.c
> > index 9125700..b462887 100644
> > --- a/libavcodec/qsvdec.c
> > +++ b/libavcodec/qsvdec.c
> > @@ -408,7 +408,7 @@ static int do_qsv_decode(AVCodecContext *avctx,
> QSVContext *q,
> > return ff_qsv_error(ret);
> > }
> > n_out_frames = av_fifo_size(q->async_fifo) /
> (sizeof(out_frame)+sizeof(sync));
> > -
> > + av_freep(&sync);
> I'm sorry but it is not actual more. There was the roll-back for
> sync allocations on heap at July 24, now there is old good way uses again.
>
Hey Ivan,
I seemed to have missed the revert when I fetched and rebased. Sorry about
that. I just tested and there is still a null dereference in
ff_qsv_decode_reset(). I'll send a new patch shortly.
>
> > if (n_out_frames > q->async_depth || (flush && n_out_frames) ) {
> > AVFrame *src_frame;
> >
> > @@ -555,16 +555,18 @@ void ff_qsv_decode_reset(AVCodecContext *avctx,
> QSVContext *q)
> > }
> >
> > /* Reset output surfaces */
> > - av_fifo_reset(q->async_fifo);
> + if (q->>async_fifo)
> > + av_fifo_reset(q->async_fifo);
> >
> > /* Reset input packets fifo */
> > - while (av_fifo_size(q->pkt_fifo)) {
> + while (q->>pkt_fifo && av_fifo_size(q->pkt_fifo)) {
> > av_fifo_generic_read(q->pkt_fifo, &pkt, sizeof(pkt), NULL);
> > av_packet_unref(&pkt);
> > }
> >
> > /* Reset input bitstream fifo */
> > - av_fifo_reset(q->input_fifo);
> + if (q->>input_fifo)
> > + av_fifo_reset(q->input_fifo);
> > }
> >
> > int ff_qsv_decode_close(QSVContext *q)
>
>
> --
> Best regards,
> Ivan mailto:ivan.uskov at nablet.com
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
More information about the ffmpeg-devel
mailing list