From: James Almer <jamrial@gmail.com>
To: ffmpeg-devel@ffmpeg.org
Subject: Re: [FFmpeg-devel] [PATCH] avcodec/nvdec: don't attempt to free NVDECContext->bitstream on simple decode_slice hwaccels
Date: Tue, 6 Feb 2024 19:58:49 -0300
Message-ID: <67ef754d-8c85-472a-8ab7-71ccac42894d@gmail.com> (raw)
In-Reply-To: <DU0P250MB0747D8DBDFA3DABF950C3D328F462@DU0P250MB0747.EURP250.PROD.OUTLOOK.COM>
On 2/6/2024 7:14 PM, Andreas Rheinhardt wrote:
> James Almer:
>> If FFHWAccel->end_frame() isn't called before FFHWAccel->uninit(), an attempt
>> to free a stale pointer could take place.
>>
>> Signed-off-by: James Almer <jamrial@gmail.com>
>> ---
>> libavcodec/nvdec.c | 9 +++++++++
>> libavcodec/nvdec.h | 1 +
>> libavcodec/nvdec_mjpeg.c | 2 +-
>> libavcodec/nvdec_mpeg12.c | 4 ++--
>> libavcodec/nvdec_mpeg4.c | 2 +-
>> libavcodec/nvdec_vc1.c | 4 ++--
>> libavcodec/nvdec_vp8.c | 2 +-
>> libavcodec/nvdec_vp9.c | 2 +-
>> 8 files changed, 18 insertions(+), 8 deletions(-)
>>
>> diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c
>> index 27be644356..8a7f5c0dac 100644
>> --- a/libavcodec/nvdec.c
>> +++ b/libavcodec/nvdec.c
>> @@ -274,6 +274,15 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx)
>> return 0;
>> }
>>
>> +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx)
>> +{
>> + NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
>> +
>> + ctx->bitstream = NULL;
>> +
>> + return ff_nvdec_decode_uninit(avctx);
>> +}
>> +
>> static void nvdec_free_dummy(struct AVHWFramesContext *ctx)
>> {
>> av_buffer_pool_uninit(&ctx->pool);
>> diff --git a/libavcodec/nvdec.h b/libavcodec/nvdec.h
>> index 353e95bf42..83bc1de84c 100644
>> --- a/libavcodec/nvdec.h
>> +++ b/libavcodec/nvdec.h
>> @@ -73,6 +73,7 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx);
>> int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame);
>> int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_sep_ref);
>> int ff_nvdec_end_frame(AVCodecContext *avctx);
>> +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx);
>> int ff_nvdec_simple_end_frame(AVCodecContext *avctx);
>> int ff_nvdec_simple_decode_slice(AVCodecContext *avctx, const uint8_t *buffer,
>> uint32_t size);
>> diff --git a/libavcodec/nvdec_mjpeg.c b/libavcodec/nvdec_mjpeg.c
>> index 850634bf1a..adef21b0f7 100644
>> --- a/libavcodec/nvdec_mjpeg.c
>> +++ b/libavcodec/nvdec_mjpeg.c
>> @@ -80,6 +80,6 @@ const FFHWAccel ff_mjpeg_nvdec_hwaccel = {
>> .decode_slice = nvdec_mjpeg_decode_slice,
>> .frame_params = nvdec_mjpeg_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>> diff --git a/libavcodec/nvdec_mpeg12.c b/libavcodec/nvdec_mpeg12.c
>> index a4603c7ea7..5d100a46ba 100644
>> --- a/libavcodec/nvdec_mpeg12.c
>> +++ b/libavcodec/nvdec_mpeg12.c
>> @@ -110,7 +110,7 @@ const FFHWAccel ff_mpeg2_nvdec_hwaccel = {
>> .decode_slice = ff_nvdec_simple_decode_slice,
>> .frame_params = nvdec_mpeg12_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>> #endif
>> @@ -126,7 +126,7 @@ const FFHWAccel ff_mpeg1_nvdec_hwaccel = {
>> .decode_slice = ff_nvdec_simple_decode_slice,
>> .frame_params = nvdec_mpeg12_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>> #endif
>> diff --git a/libavcodec/nvdec_mpeg4.c b/libavcodec/nvdec_mpeg4.c
>> index 20a0499437..5a50f7d77f 100644
>> --- a/libavcodec/nvdec_mpeg4.c
>> +++ b/libavcodec/nvdec_mpeg4.c
>> @@ -120,6 +120,6 @@ const FFHWAccel ff_mpeg4_nvdec_hwaccel = {
>> .decode_slice = nvdec_mpeg4_decode_slice,
>> .frame_params = nvdec_mpeg4_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>> diff --git a/libavcodec/nvdec_vc1.c b/libavcodec/nvdec_vc1.c
>> index 5096d784df..e9ab16c63d 100644
>> --- a/libavcodec/nvdec_vc1.c
>> +++ b/libavcodec/nvdec_vc1.c
>> @@ -124,7 +124,7 @@ const FFHWAccel ff_vc1_nvdec_hwaccel = {
>> .decode_slice = ff_nvdec_simple_decode_slice,
>> .frame_params = nvdec_vc1_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>>
>> @@ -139,7 +139,7 @@ const FFHWAccel ff_wmv3_nvdec_hwaccel = {
>> .decode_slice = ff_nvdec_simple_decode_slice,
>> .frame_params = nvdec_vc1_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>> #endif
>> diff --git a/libavcodec/nvdec_vp8.c b/libavcodec/nvdec_vp8.c
>> index ff3b3f259c..bbea6f1577 100644
>> --- a/libavcodec/nvdec_vp8.c
>> +++ b/libavcodec/nvdec_vp8.c
>> @@ -101,6 +101,6 @@ const FFHWAccel ff_vp8_nvdec_hwaccel = {
>> .decode_slice = ff_nvdec_simple_decode_slice,
>> .frame_params = nvdec_vp8_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>> diff --git a/libavcodec/nvdec_vp9.c b/libavcodec/nvdec_vp9.c
>> index e196391c6d..69b12657b6 100644
>> --- a/libavcodec/nvdec_vp9.c
>> +++ b/libavcodec/nvdec_vp9.c
>> @@ -180,6 +180,6 @@ const FFHWAccel ff_vp9_nvdec_hwaccel = {
>> .decode_slice = ff_nvdec_simple_decode_slice,
>> .frame_params = nvdec_vp9_frame_params,
>> .init = ff_nvdec_decode_init,
>> - .uninit = ff_nvdec_decode_uninit,
>> + .uninit = ff_nvdec_simple_decode_uninit,
>> .priv_data_size = sizeof(NVDECContext),
>> };
>
> Using a field for both an ownership pointer and as a pure data pointer
> is bad and confusing. IMO there should be different pointers for this;
> or rather: bitstream is always set and used as data pointer and the
> another pointer for ownership which may alias bitstream. In fact, it
> looks like this is exactly what bitstream_internal is, it is just not
> used by H.264 and HEVC in this manner (they use bitstream for allocated
> stuff).
Yeah, whereas AV1 is doing it right.
Sent a new version with this approach. Thanks for the review.
> With the approach outlined above, ff_nvdec_simple_end_frame() might
> become obsolete.
>
> - Andreas
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
prev parent reply other threads:[~2024-02-06 22:58 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-06 21:26 James Almer
2024-02-06 22:14 ` Andreas Rheinhardt
2024-02-06 22:57 ` [FFmpeg-devel] [PATCH] avcodec/nvdec: don't free NVDECContext->bitstream James Almer
2024-02-06 23:00 ` Timo Rothenpieler
2024-02-06 23:02 ` Timo Rothenpieler
2024-02-06 23:05 ` James Almer
2024-02-06 23:06 ` Timo Rothenpieler
2024-02-06 22:58 ` James Almer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67ef754d-8c85-472a-8ab7-71ccac42894d@gmail.com \
--to=jamrial@gmail.com \
--cc=ffmpeg-devel@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git