RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects 

Add dxva2_pool_release_dummy() and use it in call to
av_buffer_create() in dxva2_pool_alloc().

Prior to this change, av_buffer_create() was called with NULL for the
third argument, which indicates that av_buffer_default_free() should
be used to free the buffer's data.  Eventually, it gets to
buffer_pool_free() and calls buf->free() on a surface object (which is
av_buffer_default_free()).

This can result in a crash when the debug version of the C-runtime is
used on Windows.  While it doesn't appear to result in a crash when
the release version of the C-runtime is used on Windows, it likely
results in memory corruption, since av_free() is being called on
memory that was allocated using
IDirectXVideoAccelerationService::CreateSurface().

Signed-off-by: Aaron Levinson <alevinsn@aracnet.com>
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Reviewed-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Aaron Levinson 2017-05-16 14:23:27 -07:00 committed by Anton Khirnov
parent 8652a2c248
commit 3d040513a1
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavutil/hwcontext_dxva2.c
View File

@ -119,6 +119,13 @@ static void dxva2_frames_uninit(AVHWFramesContext *ctx)
} }
} }
static void dxva2_pool_release_dummy(void *opaque, uint8_t *data)
{
// important not to free anything here--data is a surface object
// associated with the call to CreateSurface(), and these surfaces are
// released in dxva2_frames_uninit()
}
static AVBufferRef *dxva2_pool_alloc(void *opaque, int size) static AVBufferRef *dxva2_pool_alloc(void *opaque, int size)
{ {
AVHWFramesContext *ctx = (AVHWFramesContext*)opaque; AVHWFramesContext *ctx = (AVHWFramesContext*)opaque;
@ -128,7 +135,7 @@ static AVBufferRef *dxva2_pool_alloc(void *opaque, int size)
if (s->nb_surfaces_used < hwctx->nb_surfaces) { if (s->nb_surfaces_used < hwctx->nb_surfaces) {
s->nb_surfaces_used++; s->nb_surfaces_used++;
return av_buffer_create((uint8_t*)s->surfaces_internal[s->nb_surfaces_used - 1], return av_buffer_create((uint8_t*)s->surfaces_internal[s->nb_surfaces_used - 1],
sizeof(*hwctx->surfaces), NULL, 0, 0); sizeof(*hwctx->surfaces), dxva2_pool_release_dummy, 0, 0);
} }
return NULL; return NULL;