Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
 help / color / mirror / Atom feed
* [FFmpeg-devel] [PATCH] avcodec/nvdec: don't attempt to free NVDECContext->bitstream on simple decode_slice hwaccels
@ 2024-02-06 21:26 James Almer
  2024-02-06 22:14 ` Andreas Rheinhardt
  0 siblings, 1 reply; 8+ messages in thread
From: James Almer @ 2024-02-06 21:26 UTC (permalink / raw)
  To: ffmpeg-devel

If FFHWAccel->end_frame() isn't called before FFHWAccel->uninit(), an attempt
to free a stale pointer could take place.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/nvdec.c        | 9 +++++++++
 libavcodec/nvdec.h        | 1 +
 libavcodec/nvdec_mjpeg.c  | 2 +-
 libavcodec/nvdec_mpeg12.c | 4 ++--
 libavcodec/nvdec_mpeg4.c  | 2 +-
 libavcodec/nvdec_vc1.c    | 4 ++--
 libavcodec/nvdec_vp8.c    | 2 +-
 libavcodec/nvdec_vp9.c    | 2 +-
 8 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c
index 27be644356..8a7f5c0dac 100644
--- a/libavcodec/nvdec.c
+++ b/libavcodec/nvdec.c
@@ -274,6 +274,15 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx)
     return 0;
 }
 
+int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx)
+{
+    NVDECContext *ctx = avctx->internal->hwaccel_priv_data;
+
+    ctx->bitstream = NULL;
+
+    return ff_nvdec_decode_uninit(avctx);
+}
+
 static void nvdec_free_dummy(struct AVHWFramesContext *ctx)
 {
     av_buffer_pool_uninit(&ctx->pool);
diff --git a/libavcodec/nvdec.h b/libavcodec/nvdec.h
index 353e95bf42..83bc1de84c 100644
--- a/libavcodec/nvdec.h
+++ b/libavcodec/nvdec.h
@@ -73,6 +73,7 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx);
 int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame);
 int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_sep_ref);
 int ff_nvdec_end_frame(AVCodecContext *avctx);
+int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx);
 int ff_nvdec_simple_end_frame(AVCodecContext *avctx);
 int ff_nvdec_simple_decode_slice(AVCodecContext *avctx, const uint8_t *buffer,
                                  uint32_t size);
diff --git a/libavcodec/nvdec_mjpeg.c b/libavcodec/nvdec_mjpeg.c
index 850634bf1a..adef21b0f7 100644
--- a/libavcodec/nvdec_mjpeg.c
+++ b/libavcodec/nvdec_mjpeg.c
@@ -80,6 +80,6 @@ const FFHWAccel ff_mjpeg_nvdec_hwaccel = {
     .decode_slice         = nvdec_mjpeg_decode_slice,
     .frame_params         = nvdec_mjpeg_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
diff --git a/libavcodec/nvdec_mpeg12.c b/libavcodec/nvdec_mpeg12.c
index a4603c7ea7..5d100a46ba 100644
--- a/libavcodec/nvdec_mpeg12.c
+++ b/libavcodec/nvdec_mpeg12.c
@@ -110,7 +110,7 @@ const FFHWAccel ff_mpeg2_nvdec_hwaccel = {
     .decode_slice         = ff_nvdec_simple_decode_slice,
     .frame_params         = nvdec_mpeg12_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
 #endif
@@ -126,7 +126,7 @@ const FFHWAccel ff_mpeg1_nvdec_hwaccel = {
     .decode_slice         = ff_nvdec_simple_decode_slice,
     .frame_params         = nvdec_mpeg12_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
 #endif
diff --git a/libavcodec/nvdec_mpeg4.c b/libavcodec/nvdec_mpeg4.c
index 20a0499437..5a50f7d77f 100644
--- a/libavcodec/nvdec_mpeg4.c
+++ b/libavcodec/nvdec_mpeg4.c
@@ -120,6 +120,6 @@ const FFHWAccel ff_mpeg4_nvdec_hwaccel = {
     .decode_slice         = nvdec_mpeg4_decode_slice,
     .frame_params         = nvdec_mpeg4_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
diff --git a/libavcodec/nvdec_vc1.c b/libavcodec/nvdec_vc1.c
index 5096d784df..e9ab16c63d 100644
--- a/libavcodec/nvdec_vc1.c
+++ b/libavcodec/nvdec_vc1.c
@@ -124,7 +124,7 @@ const FFHWAccel ff_vc1_nvdec_hwaccel = {
     .decode_slice         = ff_nvdec_simple_decode_slice,
     .frame_params         = nvdec_vc1_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
 
@@ -139,7 +139,7 @@ const FFHWAccel ff_wmv3_nvdec_hwaccel = {
     .decode_slice         = ff_nvdec_simple_decode_slice,
     .frame_params         = nvdec_vc1_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
 #endif
diff --git a/libavcodec/nvdec_vp8.c b/libavcodec/nvdec_vp8.c
index ff3b3f259c..bbea6f1577 100644
--- a/libavcodec/nvdec_vp8.c
+++ b/libavcodec/nvdec_vp8.c
@@ -101,6 +101,6 @@ const FFHWAccel ff_vp8_nvdec_hwaccel = {
     .decode_slice         = ff_nvdec_simple_decode_slice,
     .frame_params         = nvdec_vp8_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
diff --git a/libavcodec/nvdec_vp9.c b/libavcodec/nvdec_vp9.c
index e196391c6d..69b12657b6 100644
--- a/libavcodec/nvdec_vp9.c
+++ b/libavcodec/nvdec_vp9.c
@@ -180,6 +180,6 @@ const FFHWAccel ff_vp9_nvdec_hwaccel = {
     .decode_slice         = ff_nvdec_simple_decode_slice,
     .frame_params         = nvdec_vp9_frame_params,
     .init                 = ff_nvdec_decode_init,
-    .uninit               = ff_nvdec_decode_uninit,
+    .uninit               = ff_nvdec_simple_decode_uninit,
     .priv_data_size       = sizeof(NVDECContext),
 };
-- 
2.43.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2024-02-06 23:07 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-06 21:26 [FFmpeg-devel] [PATCH] avcodec/nvdec: don't attempt to free NVDECContext->bitstream on simple decode_slice hwaccels James Almer
2024-02-06 22:14 ` Andreas Rheinhardt
2024-02-06 22:57   ` [FFmpeg-devel] [PATCH] avcodec/nvdec: don't free NVDECContext->bitstream James Almer
2024-02-06 23:00     ` Timo Rothenpieler
2024-02-06 23:02       ` Timo Rothenpieler
2024-02-06 23:05       ` James Almer
2024-02-06 23:06         ` Timo Rothenpieler
2024-02-06 22:58   ` [FFmpeg-devel] [PATCH] avcodec/nvdec: don't attempt to free NVDECContext->bitstream on simple decode_slice hwaccels James Almer

Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
		ffmpegdev@gitmailbox.com
	public-inbox-index ffmpegdev

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git