[vlc-devel] [PATCH] decoder: fix out_pool NULL deref

[Alexandre Janniaux]

Hi,

This seem legitimate to me too. As long as you didn't call
decoder_Clean, you can still expect pictures being required
as the module has not being requested to close.

LGTM,

Regards,
--
Alexandre Janniaux
Videolabs

On Tue, Mar 10, 2020 at 02:02:53PM +0100, Thomas Guillem wrote:
>
>
> On Tue, Mar 10, 2020, at 08:56, Thomas Guillem wrote:
> > Once the format is configured, a decoder module can request new picture_t via
> > decoder_NewPicture() asynchronously. Therefore, the out_pool need to outlive
> > the decoder module.
> >
> > This patch fixes a NULL deref from decoder_NewPicture() when the decoder is
> > being destroyed. Indeed, the module need to be unloaded before the out_pool is
> > destroyed.
> > ---
> >  src/input/decoder.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/input/decoder.c b/src/input/decoder.c
> > index d868c21f23..7dbc2b8f8d 100644
> > --- a/src/input/decoder.c
> > +++ b/src/input/decoder.c
> > @@ -1962,13 +1962,13 @@ static void DeleteDecoder( decoder_t * p_dec )
> >      msg_Dbg( p_dec, "killing decoder fourcc `%4.4s'",
> >               (char*)&p_dec->fmt_in.i_codec );
> >
> > +    decoder_Clean( p_dec );
> >      const enum es_format_category_e i_cat =p_dec->fmt_in.i_cat;
>
> The decoder_Clean() should be done just after fetching the category.
>
> This caused invalid state in the player since the vout was not stopped.
>
>
> >      if ( p_owner->out_pool )
> >      {
> >          picture_pool_Release( p_owner->out_pool );
> >          p_owner->out_pool = NULL;
> >      }
> > -    decoder_Clean( p_dec );
> >
> >      if (p_owner->vctx)
> >          vlc_video_context_Release( p_owner->vctx );
> > --
> > 2.20.1
> >
> > _______________________________________________
> > vlc-devel mailing list
> > To unsubscribe or modify your subscription options:
> > https://mailman.videolan.org/listinfo/vlc-devel
> _______________________________________________
> vlc-devel mailing list
> To unsubscribe or modify your subscription options:
> https://mailman.videolan.org/listinfo/vlc-devel