[vlc-commits] vdpau: fix potential double free

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Tue Jun 20 19:24:57 2017 +0300| [b1b6894b36e19b87fc68f9d941592fe9d04562a7] | committer: Rémi Denis-Courmont

vdpau: fix potential double free

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=b1b6894b36e19b87fc68f9d941592fe9d04562a7
---

 modules/codec/avcodec/d3d11va.c | 4 ++--
 modules/codec/avcodec/dxva2.c   | 4 ++--
 modules/codec/avcodec/va.c      | 4 ++--
 modules/codec/avcodec/va.h      | 2 +-
 modules/codec/avcodec/vaapi.c   | 2 +-
 modules/codec/avcodec/video.c   | 4 ++--
 modules/hw/vdpau/avcodec.c      | 4 ++--
 7 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/modules/codec/avcodec/d3d11va.c b/modules/codec/avcodec/d3d11va.c
index e862ca03ad..0557cfba09 100644
--- a/modules/codec/avcodec/d3d11va.c
+++ b/modules/codec/avcodec/d3d11va.c
@@ -58,7 +58,7 @@
 
 static int Open(vlc_va_t *, AVCodecContext *, enum PixelFormat,
                 const es_format_t *, picture_sys_t *p_sys);
-static void Close(vlc_va_t *, void *);
+static void Close(vlc_va_t *, void **);
 
 vlc_module_begin()
     set_description(N_("Direct3D11 Video Acceleration"))
@@ -326,7 +326,7 @@ static int Get(vlc_va_t *va, picture_t *pic, uint8_t **data)
     return VLC_SUCCESS;
 }
 
-static void Close(vlc_va_t *va, void *ctx)
+static void Close(vlc_va_t *va, void **ctx)
 {
     vlc_va_sys_t *sys = va->sys;
 
diff --git a/modules/codec/avcodec/dxva2.c b/modules/codec/avcodec/dxva2.c
index 3e92a638fe..6a18227409 100644
--- a/modules/codec/avcodec/dxva2.c
+++ b/modules/codec/avcodec/dxva2.c
@@ -46,7 +46,7 @@
 
 static int Open(vlc_va_t *, AVCodecContext *, enum PixelFormat,
                 const es_format_t *, picture_sys_t *p_sys);
-static void Close(vlc_va_t *, void *);
+static void Close(vlc_va_t *, void **);
 
 vlc_module_begin()
     set_description(N_("DirectX Video Acceleration (DXVA) 2.0"))
@@ -244,7 +244,7 @@ static int Get(vlc_va_t *va, picture_t *pic, uint8_t **data)
     return VLC_SUCCESS;
 }
 
-static void Close(vlc_va_t *va, void *ctx)
+static void Close(vlc_va_t *va, void **ctx)
 {
     vlc_va_sys_t *sys = va->sys;
 
diff --git a/modules/codec/avcodec/va.c b/modules/codec/avcodec/va.c
index ea43a57536..e552a09bb2 100644
--- a/modules/codec/avcodec/va.c
+++ b/modules/codec/avcodec/va.c
@@ -139,14 +139,14 @@ vlc_va_t *vlc_va_New(vlc_object_t *obj, AVCodecContext *avctx,
     {   /* Mismatch, cannot work, fail */
         msg_Dbg( obj, "chroma mismatch %4.4s expected %4.4s",
                  (const char*)&chroma, (const char*) &expected );
-        vlc_va_Delete(va, avctx);
+        vlc_va_Delete(va, &avctx->hwaccel_context);
 #endif
         va = NULL;
     }
     return va;
 }
 
-void vlc_va_Delete(vlc_va_t *va, void *hwctx)
+void vlc_va_Delete(vlc_va_t *va, void **hwctx)
 {
     vlc_module_unload(va, va->module, vlc_va_Stop, va, hwctx);
     vlc_object_release(va);
diff --git a/modules/codec/avcodec/va.h b/modules/codec/avcodec/va.h
index 6172deec5d..99bc5ba259 100644
--- a/modules/codec/avcodec/va.h
+++ b/modules/codec/avcodec/va.h
@@ -117,6 +117,6 @@ static inline int vlc_va_Extract(vlc_va_t *va, picture_t *pic, uint8_t *data)
  * Destroys a libavcodec hardware acceleration back-end.
  * All allocated surfaces shall have been released beforehand.
  */
-void vlc_va_Delete(vlc_va_t *, void *);
+void vlc_va_Delete(vlc_va_t *, void **);
 
 #endif
diff --git a/modules/codec/avcodec/vaapi.c b/modules/codec/avcodec/vaapi.c
index 75f3a99318..ff270425a9 100644
--- a/modules/codec/avcodec/vaapi.c
+++ b/modules/codec/avcodec/vaapi.c
@@ -253,7 +253,7 @@ static int Get(vlc_va_t *va, picture_t *pic, uint8_t **data)
     return VLC_SUCCESS;
 }
 
-static void Delete(vlc_va_t *va, void *hwctx)
+static void Delete(vlc_va_t *va, void **hwctx)
 {
     vlc_va_sys_t *sys = va->sys;
     vlc_object_t *o = VLC_OBJECT(va);
diff --git a/modules/codec/avcodec/video.c b/modules/codec/avcodec/video.c
index 2cd6521908..5bf2b67e35 100644
--- a/modules/codec/avcodec/video.c
+++ b/modules/codec/avcodec/video.c
@@ -1241,7 +1241,7 @@ void EndVideoDec( vlc_object_t *obj )
     avcodec_free_context( &ctx );
 
     if( p_sys->p_va )
-        vlc_va_Delete( p_sys->p_va, hwaccel_context );
+        vlc_va_Delete( p_sys->p_va, &hwaccel_context );
 
     vlc_sem_destroy( &p_sys->sem_mt );
     free( p_sys );
@@ -1520,7 +1520,7 @@ static enum PixelFormat ffmpeg_GetFormat( AVCodecContext *p_context,
     if (p_sys->p_va != NULL)
     {
         msg_Err(p_dec, "existing hardware acceleration cannot be reused");
-        vlc_va_Delete(p_sys->p_va, p_context->hwaccel_context);
+        vlc_va_Delete(p_sys->p_va, &p_context->hwaccel_context);
         p_sys->p_va = NULL;
     }
 
diff --git a/modules/hw/vdpau/avcodec.c b/modules/hw/vdpau/avcodec.c
index 18b549a436..36eecefe51 100644
--- a/modules/hw/vdpau/avcodec.c
+++ b/modules/hw/vdpau/avcodec.c
@@ -213,14 +213,14 @@ error:
     return VLC_EGENERIC;
 }
 
-static void Close(vlc_va_t *va, void *hwctx)
+static void Close(vlc_va_t *va, void **hwctx)
 {
     vlc_va_sys_t *sys = va->sys;
 
     for (unsigned i = 0; sys->pool[i] != NULL; i++)
         vlc_vdp_video_destroy(sys->pool[i]);
     vdp_release_x11(sys->vdp);
-    av_free(hwctx);
+    av_freep(hwctx);
     free(sys);
 }