[FFmpeg-devel] [PATCH] avcodec/qsvdec: fix refcount leak in two-stage QSV init (PR #20532)

[hajin-chung via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20532 opened by hajin-chung
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20532
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20532.patch

The QSV decoder uses a two-stage initialization when a stream header is first processed. 
The first stage, inside qsv_decode_header(), creates a temporary hw_frames_ctx to get a session for parsing.
The second stage, back in qsv_process_data(), creates the final hw_frames_ctx with the correct stream parameters.

The temporary hw_frames_ctx was being abandoned without all of its references being released, leading to a leak of the context itself and, in turn, a leak of the hw_device_ctx it referenced. 
This prevented the QSV thread pool from being shut down correctly in long-running applications.

The temporary hw_frames_ctx holds three references, including one from the internal `mids` array.

This fix resolves the leak by explicitly unreferencing all known holders of the temporary context after it has been used for header parsing and before the final context is created.


>From e2517ec684b3478937fb2e3c0651eee5a2ffe5e2 Mon Sep 17 00:00:00 2001
From: hajin-chung <hajinchung1@gmail.com>
Date: Tue, 16 Sep 2025 17:13:01 +0900
Subject: [PATCH] avcodec/qsvdec: fix refcount leak in two-stage QSV init

The temporary hw_frames_ctx created for header parsing was not being
fully released, leading to a leak. Explicitly unreference the temporary
context after use to resolve the leak.

Signed-off-by: hajin-chung <hajinchung1@gmail.com>
---
 libavcodec/qsvdec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/qsvdec.c b/libavcodec/qsvdec.c
index 144cf5b9e9..a85c1785cf 100644
--- a/libavcodec/qsvdec.c
+++ b/libavcodec/qsvdec.c
@@ -202,6 +202,7 @@ static int qsv_init_session(AVCodecContext *avctx, QSVContext *q, mfxSession ses
             MFXClose(q->internal_qs.session);
             q->internal_qs.session = NULL;
         }
+        av_refstruct_unref(&q->frames_ctx.mids);
         av_buffer_unref(&q->frames_ctx.hw_frames_ctx);
 
         q->frames_ctx.hw_frames_ctx = av_buffer_ref(hw_frames_ref);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org