[vlc-devel] [PATCH] player: fix crash when sending OSD messages to multiple vouts

[Hugo Beauzée-Luyssen]

On Wed, Mar 20, 2019, at 2:59 PM, Pierre Lamot wrote:
>   va_args was reused without being copied
> ---
>  src/input/player.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/src/input/player.c b/src/input/player.c
> index 355c9e5408..22284418e4 100644
> --- a/src/input/player.c
> +++ b/src/input/player.c
> @@ -278,7 +278,12 @@ vouts_osd_Message(vout_thread_t **vouts, size_t 
> count, const char *fmt, ...)
>      va_list args;
>      va_start(args, fmt);
>      for (size_t i = 0; i < count; ++i)
> -        vout_OSDMessageVa(vouts[i], VOUT_SPU_CHANNEL_OSD, fmt, args);
> +    {
> +        va_list acpy;
> +        va_copy(acpy, args);
> +        vout_OSDMessageVa(vouts[i], VOUT_SPU_CHANNEL_OSD, fmt, acpy);
> +        va_end(acpy);
> +    }
>      va_end(args);
>  }
>  
> @@ -307,7 +312,12 @@ vlc_player_vout_OSDMessage(vlc_player_t *player, 
> const char *fmt, ...)
>      va_list args;
>      va_start(args, fmt);
>      for (size_t i = 0; i < count; ++i)
> -        vout_OSDMessageVa(vouts[i], VOUT_SPU_CHANNEL_OSD, fmt, args);
> +    {
> +        va_list acpy;
> +        va_copy(acpy, args);
> +        vout_OSDMessageVa(vouts[i], VOUT_SPU_CHANNEL_OSD, fmt, acpy);
> +        va_end(acpy);
> +    }
>      va_end(args);
>  
>      vlc_player_vout_OSDReleaseAll(player, vouts, count);

As far as I can see, we don't use vout_OSDMessageVa anywhere else than from the player. 
IMO it would be better to remove this function from the public API and compute the string from vlc_player_vout_OSDMessage & vouts_osd_Message, then pass it to vout_OSDMessage, rather than generating the same string multiple time.

-- 
  Hugo Beauzée-Luyssen
  hugo at beauzee.fr