[FFmpeg-devel] [PATCH] avcodec/nvdec: don't attempt to free NVDECContext->bitstream on simple decode_slice hwaccels
Andreas Rheinhardt
andreas.rheinhardt at outlook.com
Wed Feb 7 00:14:09 EET 2024
James Almer:
> If FFHWAccel->end_frame() isn't called before FFHWAccel->uninit(), an attempt
> to free a stale pointer could take place.
>
> Signed-off-by: James Almer <jamrial at gmail.com>
> ---
> libavcodec/nvdec.c | 9 +++++++++
> libavcodec/nvdec.h | 1 +
> libavcodec/nvdec_mjpeg.c | 2 +-
> libavcodec/nvdec_mpeg12.c | 4 ++--
> libavcodec/nvdec_mpeg4.c | 2 +-
> libavcodec/nvdec_vc1.c | 4 ++--
> libavcodec/nvdec_vp8.c | 2 +-
> libavcodec/nvdec_vp9.c | 2 +-
> 8 files changed, 18 insertions(+), 8 deletions(-)
>
> diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c
> index 27be644356..8a7f5c0dac 100644
> --- a/libavcodec/nvdec.c
> +++ b/libavcodec/nvdec.c
> @@ -274,6 +274,15 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx)
> return 0;
> }
>
> +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx)
> +{
> + NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
> +
> + ctx->bitstream = NULL;
> +
> + return ff_nvdec_decode_uninit(avctx);
> +}
> +
> static void nvdec_free_dummy(struct AVHWFramesContext *ctx)
> {
> av_buffer_pool_uninit(&ctx->pool);
> diff --git a/libavcodec/nvdec.h b/libavcodec/nvdec.h
> index 353e95bf42..83bc1de84c 100644
> --- a/libavcodec/nvdec.h
> +++ b/libavcodec/nvdec.h
> @@ -73,6 +73,7 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx);
> int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame);
> int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_sep_ref);
> int ff_nvdec_end_frame(AVCodecContext *avctx);
> +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx);
> int ff_nvdec_simple_end_frame(AVCodecContext *avctx);
> int ff_nvdec_simple_decode_slice(AVCodecContext *avctx, const uint8_t *buffer,
> uint32_t size);
> diff --git a/libavcodec/nvdec_mjpeg.c b/libavcodec/nvdec_mjpeg.c
> index 850634bf1a..adef21b0f7 100644
> --- a/libavcodec/nvdec_mjpeg.c
> +++ b/libavcodec/nvdec_mjpeg.c
> @@ -80,6 +80,6 @@ const FFHWAccel ff_mjpeg_nvdec_hwaccel = {
> .decode_slice = nvdec_mjpeg_decode_slice,
> .frame_params = nvdec_mjpeg_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
> diff --git a/libavcodec/nvdec_mpeg12.c b/libavcodec/nvdec_mpeg12.c
> index a4603c7ea7..5d100a46ba 100644
> --- a/libavcodec/nvdec_mpeg12.c
> +++ b/libavcodec/nvdec_mpeg12.c
> @@ -110,7 +110,7 @@ const FFHWAccel ff_mpeg2_nvdec_hwaccel = {
> .decode_slice = ff_nvdec_simple_decode_slice,
> .frame_params = nvdec_mpeg12_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
> #endif
> @@ -126,7 +126,7 @@ const FFHWAccel ff_mpeg1_nvdec_hwaccel = {
> .decode_slice = ff_nvdec_simple_decode_slice,
> .frame_params = nvdec_mpeg12_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
> #endif
> diff --git a/libavcodec/nvdec_mpeg4.c b/libavcodec/nvdec_mpeg4.c
> index 20a0499437..5a50f7d77f 100644
> --- a/libavcodec/nvdec_mpeg4.c
> +++ b/libavcodec/nvdec_mpeg4.c
> @@ -120,6 +120,6 @@ const FFHWAccel ff_mpeg4_nvdec_hwaccel = {
> .decode_slice = nvdec_mpeg4_decode_slice,
> .frame_params = nvdec_mpeg4_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
> diff --git a/libavcodec/nvdec_vc1.c b/libavcodec/nvdec_vc1.c
> index 5096d784df..e9ab16c63d 100644
> --- a/libavcodec/nvdec_vc1.c
> +++ b/libavcodec/nvdec_vc1.c
> @@ -124,7 +124,7 @@ const FFHWAccel ff_vc1_nvdec_hwaccel = {
> .decode_slice = ff_nvdec_simple_decode_slice,
> .frame_params = nvdec_vc1_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
>
> @@ -139,7 +139,7 @@ const FFHWAccel ff_wmv3_nvdec_hwaccel = {
> .decode_slice = ff_nvdec_simple_decode_slice,
> .frame_params = nvdec_vc1_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
> #endif
> diff --git a/libavcodec/nvdec_vp8.c b/libavcodec/nvdec_vp8.c
> index ff3b3f259c..bbea6f1577 100644
> --- a/libavcodec/nvdec_vp8.c
> +++ b/libavcodec/nvdec_vp8.c
> @@ -101,6 +101,6 @@ const FFHWAccel ff_vp8_nvdec_hwaccel = {
> .decode_slice = ff_nvdec_simple_decode_slice,
> .frame_params = nvdec_vp8_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
> diff --git a/libavcodec/nvdec_vp9.c b/libavcodec/nvdec_vp9.c
> index e196391c6d..69b12657b6 100644
> --- a/libavcodec/nvdec_vp9.c
> +++ b/libavcodec/nvdec_vp9.c
> @@ -180,6 +180,6 @@ const FFHWAccel ff_vp9_nvdec_hwaccel = {
> .decode_slice = ff_nvdec_simple_decode_slice,
> .frame_params = nvdec_vp9_frame_params,
> .init = ff_nvdec_decode_init,
> - .uninit = ff_nvdec_decode_uninit,
> + .uninit = ff_nvdec_simple_decode_uninit,
> .priv_data_size = sizeof(NVDECContext),
> };
Using a field for both an ownership pointer and as a pure data pointer
is bad and confusing. IMO there should be different pointers for this;
or rather: bitstream is always set and used as data pointer and the
another pointer for ownership which may alias bitstream. In fact, it
looks like this is exactly what bitstream_internal is, it is just not
used by H.264 and HEVC in this manner (they use bitstream for allocated
stuff).
With the approach outlined above, ff_nvdec_simple_end_frame() might
become obsolete.
- Andreas
More information about the ffmpeg-devel
mailing list