[vlc-devel] [PATCH 01/17] video_output: avoid potential double release of displayed.current

[Steve Lhomme]

On 2020-11-20 17:01, Alexandre Janniaux wrote:
> Hi,
> 
> I'm not sure how it's protecting from double free, it only
> seems to protect against NULL dereference.

Yes, the NULL dereference will occur before the double free.

> Regards,
> --
> Alexandre Janniaux
> Videolabs
> 
> On Fri, Nov 20, 2020 at 03:44:51PM +0100, Steve Lhomme wrote:
>> ThreadDisplayPreparePicture() can call ThreadChangeFilters() which will reset
>> displayed.current so we need to ensure we don't release it again after a call
>> to ThreadDisplayPreparePicture().
>> ---
>>   src/video_output/video_output.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/src/video_output/video_output.c b/src/video_output/video_output.c
>> index 57ee54e6e8b..cea13d44c4a 100644
>> --- a/src/video_output/video_output.c
>> +++ b/src/video_output/video_output.c
>> @@ -1493,7 +1493,8 @@ static int ThreadDisplayPicture(vout_thread_sys_t *vout, vlc_tick_t *deadline)
>>                   ThreadDisplayPreparePicture(vout, false, true, &paused);
>>           }
>>
>> -        picture_Release(sys->displayed.current);
>> +        if (likely(sys->displayed.current != NULL))
>> +            picture_Release(sys->displayed.current);
>>           sys->displayed.current = sys->displayed.next;
>>           sys->displayed.next    = NULL;
>>
>> @@ -1549,7 +1550,8 @@ static int ThreadDisplayPicture(vout_thread_sys_t *vout, vlc_tick_t *deadline)
>>                       dropped_current_frame = true;
>>                       render_now = false;
>>
>> -                    picture_Release(sys->displayed.current);
>> +                    if (likely(sys->displayed.current != NULL))
>> +                        picture_Release(sys->displayed.current);
>>                       sys->displayed.current = sys->displayed.next;
>>                       sys->displayed.next    = NULL;
>>                   }
>> --
>> 2.26.2
>>
>> _______________________________________________
>> vlc-devel mailing list
>> To unsubscribe or modify your subscription options:
>> https://mailman.videolan.org/listinfo/vlc-devel
> _______________________________________________
> vlc-devel mailing list
> To unsubscribe or modify your subscription options:
> https://mailman.videolan.org/listinfo/vlc-devel
>