[vlc-devel] [PATCH] nvdec: fix segfault in nvdec_gl

[Quentin Chateau]

It happens when Close is called from the Open function in an error path

On Apr 6, 2020, 08:56, at 08:56, Steve Lhomme <robux4 at ycbcr.xyz> wrote:
>On 2020-04-03 17:44, quentin.chateau at deepskycorp.com wrote:
>> From: Quentin Chateau <quentin.chateau at deepskycorp.com>
>> 
>> ---
>>   modules/hw/nvdec/nvdec_gl.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>> 
>> diff --git a/modules/hw/nvdec/nvdec_gl.c
>b/modules/hw/nvdec/nvdec_gl.c
>> index 137e730028..18a34d061c 100644
>> --- a/modules/hw/nvdec/nvdec_gl.c
>> +++ b/modules/hw/nvdec/nvdec_gl.c
>> @@ -150,7 +150,8 @@ static void Close(vlc_object_t *obj)
>>   {
>>       struct vlc_gl_interop *interop = (void *)obj;
>>       converter_sys_t *p_sys = interop->priv;
>> -    vlc_decoder_device_Release(p_sys->device);
>> +    if (p_sys)
>> +        vlc_decoder_device_Release(p_sys->device);
>
>This is very suspicious. p_sys is owned by this object and not used by 
>anyone else. It's allocated with vlc_obj_malloc() so doesn't need to be
>
>freed manually and is valid as long the object is valid.
>
>If the pointer is wonrg it's a sign something is not working right 
>elsewhere.
>
>>   }
>>   
>>   static int Open(vlc_object_t *obj)
>> -- 
>> 2.17.1
>> 
>> _______________________________________________
>> vlc-devel mailing list
>> To unsubscribe or modify your subscription options:
>> https://mailman.videolan.org/listinfo/vlc-devel
>> 
>_______________________________________________
>vlc-devel mailing list
>To unsubscribe or modify your subscription options:
>https://mailman.videolan.org/listinfo/vlc-devel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.videolan.org/pipermail/vlc-devel/attachments/20200406/41d1b9f6/attachment.html>