RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

vd_lavc: fix crashes with old hwaccels 

Commit d5702d3b95 messed up the order of destruction of the elements: it
destroyed the avctx before the hwaccel uninit, even though the hwaccel
uninit could access avctx. This could happen with some old hwaccels
only, such as D3D ones before the new libavcodec hwaccel API.

Fix this by making use of the fact that avcodec_flush_buffers() will
uninit the underlying hwaccel. Thus we can be sure avctx is not using
any hwaccel objects anymore, and it's safe to uninit the hwaccel.

Move the hwdec_dev dstruction code with it, because otherwise we would
in theory potentially create some dangling pointers in avctx.
This commit is contained in:
wm4 2017-07-10 14:52:32 +02:00
parent f76f37991f
commit ba921e2617
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
video/decode/vd_lavc.c
View File

@ -664,6 +664,11 @@ static void uninit_avctx(struct dec_video *vd)
av_frame_free(&ctx->pic); av_frame_free(&ctx->pic);
av_buffer_unref(&ctx->cached_hw_frames_ctx); av_buffer_unref(&ctx->cached_hw_frames_ctx);
if (ctx->hwdec && ctx->hwdec->uninit)
ctx->hwdec->uninit(ctx);
ctx->hwdec = NULL;
assert(ctx->hwdec_priv == NULL);
avcodec_free_context(&ctx->avctx); avcodec_free_context(&ctx->avctx);
if (ctx->hwdec_dev && ctx->hwdec && ctx->hwdec->generic_hwaccel && if (ctx->hwdec_dev && ctx->hwdec && ctx->hwdec->generic_hwaccel &&
@ -671,13 +676,6 @@ static void uninit_avctx(struct dec_video *vd)
ctx->hwdec_dev->destroy(ctx->hwdec_dev); ctx->hwdec_dev->destroy(ctx->hwdec_dev);
ctx->hwdec_dev = NULL; ctx->hwdec_dev = NULL;
if (ctx->hwdec && ctx->hwdec->uninit)
ctx->hwdec->uninit(ctx);
ctx->hwdec = NULL;
assert(ctx->hwdec_priv == NULL);
av_freep(&ctx->avctx);
ctx->hwdec_failed = false; ctx->hwdec_failed = false;
ctx->hwdec_fail_count = 0; ctx->hwdec_fail_count = 0;
ctx->max_delay_queue = 0; ctx->max_delay_queue = 0;