[FFmpeg-devel] [PATCH] avutil/hwcontext_amf: fix crash on uninit after init failed

* [FFmpeg-devel] [PATCH] avutil/hwcontext_amf: fix crash on uninit after init failed
@ 2025-02-06  4:38 Kacper Michajłow
  2025-02-06 17:36 ` Dmitrii Ovchinnikov
  0 siblings, 1 reply; 2+ messages in thread
From: Kacper Michajłow @ 2025-02-06  4:38 UTC (permalink / raw)
  To: ffmpeg-devel; +Cc: Kacper Michajłow

amf_device_create() calls amf_device_uninit() on errors, but if things
were not initialized it will null deref amf_ctx->factory.

Fixes: https://github.com/mpv-player/mpv/issues/15814

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
---
 libavutil/hwcontext_amf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavutil/hwcontext_amf.c b/libavutil/hwcontext_amf.c
index 8e0ce1927e..5ba2ec5b07 100644
--- a/libavutil/hwcontext_amf.c
+++ b/libavutil/hwcontext_amf.c
@@ -339,7 +339,7 @@ static int amf_transfer_data_from(AVHWFramesContext *ctx, AVFrame *dst,
 static void amf_device_uninit(AVHWDeviceContext *device_ctx)
 {
     AVAMFDeviceContext      *amf_ctx = device_ctx->hwctx;
-    AMF_RESULT          res;
+    AMF_RESULT          res = AMF_NOT_INITIALIZED;
     AMFTrace           *trace;
 
     if (amf_ctx->context) {
@@ -348,7 +348,9 @@ static void amf_device_uninit(AVHWDeviceContext *device_ctx)
         amf_ctx->context = NULL;
     }
 
-    res = amf_ctx->factory->pVtbl->GetTrace(amf_ctx->factory, &trace);
+    if (amf_ctx->factory)
+        res = amf_ctx->factory->pVtbl->GetTrace(amf_ctx->factory, &trace);
+
     if (res == AMF_OK) {
         trace->pVtbl->UnregisterWriter(trace, FFMPEG_AMF_WRITER_ID);
     }
-- 
2.45.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 2+ messages in thread