From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id EEB1245516 for ; Sat, 30 Sep 2023 09:36:27 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 33CCE68CCC2; Sat, 30 Sep 2023 12:36:25 +0300 (EEST) Received: from btbn.de (btbn.de [136.243.74.85]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 330E468CC2B for ; Sat, 30 Sep 2023 12:36:18 +0300 (EEST) Received: from [authenticated] by btbn.de (Postfix) with ESMTPSA id 72A5B29E88D for ; Sat, 30 Sep 2023 11:36:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rothenpieler.org; s=mail; t=1696066577; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kl6si1fgQSYGwo/A9EW60qsdoqsl4OHWM0VmaQEPAOA=; b=GtvIlGSOVsiq/5UUTNdKrJXDUoIu9UMiqa9lsW1YBB/VR4xZG0rGfPQRX+NpwWak6COrXJ fZqzaRenx+5jWwJJ8vT2K9gMAF2zsrCJcPEvIwyx7UMgeWcq5l89tdI/iFpNFv8U6hrZFI lLMtgBGNm2sj1AkDrtCHr8tpUP3p1RH51BSgdKDICPh2o16kQkt6GTKX0ZghI3Y3+Nu4W3 yO5lriBo+6KZ9MtU3NlEyUE4mQyhK8Y4iFm/3WPhZWPU/FMUtc3zqZ8ZQ6kxqoTndaVN3i SpBWQfvDcLugxnikxuewKSS2hv/cFC3l8brh6FgBBxuViYZJQJxOtTFdZhKqOg== Message-ID: <8dd7bc25-7676-4505-a969-41196e7b4d81@rothenpieler.org> Date: Sat, 30 Sep 2023 11:36:14 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: ffmpeg-devel@ffmpeg.org References: Content-Language: en-US From: Timo Rothenpieler In-Reply-To: Subject: Re: [FFmpeg-devel] [PATCH] avdevice/lavfi: Fix double-free on error X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 29.09.2023 19:28, Andreas Rheinhardt wrote: > After the AVFrame has been wrapped into a buffer, > it is owned by the buffer and must not be freed manually > any more. Yet this happens on subsequent errors. > > This bug was introduced in 6ca43a9675d651d7ea47c7ba2fafb1bf831c4d0b. > > Signed-off-by: Andreas Rheinhardt > --- > libavdevice/lavfi.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/libavdevice/lavfi.c b/libavdevice/lavfi.c > index ec7ebdbc90..2bfd0b81c7 100644 > --- a/libavdevice/lavfi.c > +++ b/libavdevice/lavfi.c > @@ -365,7 +365,7 @@ static int lavfi_read_packet(AVFormatContext *avctx, AVPacket *pkt) > LavfiContext *lavfi = avctx->priv_data; > double min_pts = DBL_MAX; > int stream_idx, min_pts_sink_idx = 0; > - AVFrame *frame; > + AVFrame *frame, *frame_to_free; > AVDictionary *frame_metadata; > int ret, i; > AVStream *st; > @@ -378,6 +378,7 @@ static int lavfi_read_packet(AVFormatContext *avctx, AVPacket *pkt) > frame = av_frame_alloc(); > if (!frame) > return AVERROR(ENOMEM); > + frame_to_free = frame; > > /* iterate through all the graph sinks. Select the sink with the > * minimum PTS */ > @@ -423,6 +424,7 @@ static int lavfi_read_packet(AVFormatContext *avctx, AVPacket *pkt) > ret = AVERROR(ENOMEM); > goto fail; > } > + frame_to_free = NULL; > > pkt->data = pkt->buf->data; > pkt->size = pkt->buf->size; > @@ -463,12 +465,11 @@ FF_DISABLE_DEPRECATION_WARNINGS > FF_ENABLE_DEPRECATION_WARNINGS > #endif > > - if (st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO) > - av_frame_free(&frame); > + av_frame_free(&frame_to_free); > > return pkt->size; > fail: > - av_frame_free(&frame); > + av_frame_free(&frame_to_free); > return ret; > > } Looks sensible to me _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".