RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

ad_spdif: fix segfault due to early deallocation 

The avpkt was created once on decoder init but destroyed each time the
filter was destroyed, this obviously can't work. Move the packet alloc
to the filter init function instead.

fixes: 4574dd5dc6
This commit is contained in:
sfan5 2023-07-27 22:33:28 +02:00
parent bb17d44835
commit 4c3ed843dc
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
audio/decode/ad_spdif.c
View File

@ -149,10 +149,13 @@ done:
MP_WARN(da, "Failed to parse codec profile.\n");
}
static int init_filter(struct mp_filter *da, AVPacket *pkt)
static int init_filter(struct mp_filter *da)
{
struct spdifContext *spdif_ctx = da->priv;
AVPacket *pkt = spdif_ctx->avpkt = av_packet_alloc();
MP_HANDLE_OOM(spdif_ctx->avpkt);
int profile = FF_PROFILE_UNKNOWN;
int c_rate = 0;
determine_codec_params(da, pkt, &profile, &c_rate);
@ -296,12 +299,14 @@ static void process(struct mp_filter *da)
struct mp_aframe *out = NULL;
double pts = mpkt->pts;
if (!spdif_ctx->lavf_ctx) {
if (init_filter(da) < 0)
goto done;
assert(spdif_ctx->avpkt);
}
mp_set_av_packet(spdif_ctx->avpkt, mpkt, NULL);
spdif_ctx->avpkt->pts = spdif_ctx->avpkt->dts = 0;
if (!spdif_ctx->lavf_ctx) {
if (init_filter(da, spdif_ctx->avpkt) < 0)
goto done;
}
spdif_ctx->out_buffer_len = 0;
int ret = av_write_frame(spdif_ctx->lavf_ctx, spdif_ctx->avpkt);
avio_flush(spdif_ctx->lavf_ctx->pb);
@ -425,9 +430,6 @@ static struct mp_decoder *create(struct mp_filter *parent,
return NULL;
}
spdif_ctx->avpkt = av_packet_alloc();
MP_HANDLE_OOM(spdif_ctx->avpkt);
return &spdif_ctx->public;
}