mirror of https://github.com/mpv-player/mpv
vo_drm: fix null dereference and using closed fd
when vo_drm_init() fails inside of preinit(), uninit() will be called as part of cleanup with vo->drm being NULL and thus `drm->fd` would lead to null dereference. and since vo_drm_uninit() closes drm->fd, destroy_framebuffer() ends up using a closed fd. according to the drm-gem manpage [0]: > If you close the DRM file-descriptor, all open dumb-buffers are > automatically destroyed. so remove the destroy_framebuffer() loop entirely, which fixes both the issues. [0]: https://www.systutorials.com/docs/linux/man/7-drm-gem/
This commit is contained in:
parent
e7902eb83d
commit
c3781b2d68
|
@ -382,8 +382,6 @@ static void flip_page(struct vo *vo)
|
||||||
static void uninit(struct vo *vo)
|
static void uninit(struct vo *vo)
|
||||||
{
|
{
|
||||||
struct priv *p = vo->priv;
|
struct priv *p = vo->priv;
|
||||||
struct vo_drm_state *drm = vo->drm;
|
|
||||||
int fd = drm->fd;
|
|
||||||
|
|
||||||
vo_drm_uninit(vo);
|
vo_drm_uninit(vo);
|
||||||
|
|
||||||
|
@ -391,9 +389,6 @@ static void uninit(struct vo *vo)
|
||||||
swapchain_step(vo);
|
swapchain_step(vo);
|
||||||
}
|
}
|
||||||
|
|
||||||
for (int i = 0; i < p->buf_count; ++i)
|
|
||||||
destroy_framebuffer(fd, p->bufs[i]);
|
|
||||||
|
|
||||||
talloc_free(p->last_input);
|
talloc_free(p->last_input);
|
||||||
talloc_free(p->cur_frame);
|
talloc_free(p->cur_frame);
|
||||||
talloc_free(p->cur_frame_cropped);
|
talloc_free(p->cur_frame_cropped);
|
||||||
|
|
Loading…
Reference in New Issue