[vlc-devel] RFC: vout: spu: /* You cannot delete subpicture outside of SpuSelectSubpictures */

[Thomas Guillem]

I don't see a possible use-after-free either.

The subpicture returned by spu_Render() is a new one with new allocated regions. Output regions fmt and other variables are copied from the original subpictures region. The output region pictures are held from the original one too.

Everything is done with a mutex held. So even if an original subpicture is deleted from an other thread (the decoder one likely), it won't destroy the actual picture data returned by spu_Render() until all regions picture are released.


On Wed, Jun 5, 2019, at 08:31, Thomas Guillem wrote:
> Went through all subpicture_updater_t implementations in modules and 
> src. I don't think there is one that need to called from the same 
> thread than spu_Render(). The implementations  that need 
> synchronization are already using mutexes. Most of implementation don't 
> need any synchronization but just to free sys and a list of regions 
> (that are populated before sending the spu to the vout).
> 
> On Wed, Jun 5, 2019, at 08:04, Thomas Guillem wrote:
> > Hi,
> > 
> > When working on https://trac.videolan.org/vlc/ticket/22273
> > 
> > I encountered this comment: "/* You cannot delete subpicture outside of 
> > SpuSelectSubpictures */ " inside the spu_ClearChannel() function. It 
> > complicates everything.
> > 
> > SpuSelectSubpictures() is called from spu_Render(). Deleting a 
> > subpicture can cause the pf_destroy updater callback to be called. I 
> > assume that, historically or not, such callbacks must have been called 
> > from the same context that spu_Render().
> > Is it still the case ? This is not many comment in this part of the 
> > code.
> > 
> > By the way, subpictures can also be destroyed from spu_Destroy() (when 
> > the vout is destroyed) if the spu_t is cleared but spu_Render() is not 
> > called after.
> > _______________________________________________
> > vlc-devel mailing list
> > To unsubscribe or modify your subscription options:
> > https://mailman.videolan.org/listinfo/vlc-devel
> _______________________________________________
> vlc-devel mailing list
> To unsubscribe or modify your subscription options:
> https://mailman.videolan.org/listinfo/vlc-devel