2015.10.10. 16:14 keltezéssel, Nicolas George írta:
Le nonidi 19 vendémiaire, an CCXXIV, Bodecs Bela a écrit :
using tee pseudo muxer I faced an issue.
<snip>
Sorry for the duplicated work, I already submitted an identical patch:
http://ffmpeg.org/pipermail/ffmpeg-devel/2015-October/180686.html
Regards,
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
I slightly modified the patch, because the earlier solution could result
memory leak in some cases.
If av_copy_packet were used earlier then we should use full freeing.
This is tested in my new patch.
best regards,
Bela Bodecs
>From 2baaf8eed57c578bfe9d693fb6773c4a2e26ea15 Sat, 10 Oct 2015 16:56:23 +0200
From: Bela Bodecs <bode...@vivanet.hu>
Date: Sat, 10 Oct 2015 16:56:01 +0200
Subject: [PATCH] wrong usage of av_free_packet in tee pseudo muxer (ticket #4921)
During applying bit stream filters, when the main packet data buffer is
changed, filter_packet function uses a temporary new packet (new_pkt) to
store that buffer, frees the original packet (*pkt), and replace it with
the new packet. In some cases it uses deep copy by av_copy_packet, but
in some case only struct assigment.
However, in doing so, it forgets about the side data (side_data and
side_data_elems members of AVPacket), which also gets freed by
av_free_packet, but is still referenced by new_pkt. Then, when the new
packet gets freed again in the normal code path in tee muxer, it
attempts to free its side data also which has already been freed.
The solution is simply avoiding freeing the side data when deep copy not
occured by removing that side data reference from the packet.
This issue is very similar to ticket #3773.
diff --git a/libavformat/tee.c b/libavformat/tee.c
index c619eae..3a2f7f2 100644
--- a/libavformat/tee.c
+++ b/libavformat/tee.c
@@ -401,10 +401,14 @@
break;
ret = 1;
}
if (ret > 0) {
+ if (pkt->side_data == new_pkt.side_data) {
+ pkt->side_data = NULL;
+ pkt->side_data_elems = 0;
+ }
av_free_packet(pkt);
new_pkt.buf = av_buffer_create(new_pkt.data, new_pkt.size,
av_buffer_default_free, NULL, 0);
if (!new_pkt.buf)
break;
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
