Re: [FFmpeg-devel] [PATCH] Fix double free and null dereferences in the qsv decoder

[Ivan Uskov]

Hello Yuli,

Wednesday, July 27, 2016, 6:21:41 PM, you wrote:

> This patch fixes the h264_qsv decoder issues mentioned
> in https://ffmpeg.zeranoe.com/forum/viewtopic.php?t=2962.

> The patch may be tested by specifying h264_qsv as the decoder to ffplay
> for an h264 encoded file.

> ffplay -vcodec h264_qsv foo.mts

> Signed-off-by: Yuli Khodorkovskiy 
> ---
>  libavcodec/qsvdec.c | 10 ++
>  1 file changed, 6 insertions(+), 4 deletions(-)

> diff --git a/libavcodec/qsvdec.c b/libavcodec/qsvdec.c
> index 9125700..b462887 100644
> --- a/libavcodec/qsvdec.c
> +++ b/libavcodec/qsvdec.c
> @@ -408,7 +408,7 @@ static int do_qsv_decode(AVCodecContext *avctx, 
> QSVContext *q,
>  return ff_qsv_error(ret);
>  }
>  n_out_frames = av_fifo_size(q->async_fifo) / 
> (sizeof(out_frame)+sizeof(sync));
> -
> +av_freep();
I'm sorry but it is not actual more. There was the roll-back for
sync allocations on heap at July 24, now there is old good way uses again.

>  if (n_out_frames > q->async_depth || (flush && n_out_frames) ) {
>  AVFrame *src_frame;
>  
> @@ -555,16 +555,18 @@ void ff_qsv_decode_reset(AVCodecContext *avctx, 
> QSVContext *q)
>  }
>  
>  /* Reset output surfaces */
> -av_fifo_reset(q->async_fifo);
+if (q->>async_fifo)
> +av_fifo_reset(q->async_fifo);
>  
>  /* Reset input packets fifo */
> -while (av_fifo_size(q->pkt_fifo)) {
+while (q->>pkt_fifo && av_fifo_size(q->pkt_fifo)) {
>  av_fifo_generic_read(q->pkt_fifo, , sizeof(pkt), NULL);
>  av_packet_unref();
>  }
>  
>  /* Reset input bitstream fifo */
> -av_fifo_reset(q->input_fifo);
+if (q->>input_fifo)
> +av_fifo_reset(q->input_fifo);
>  }
>  
>  int ff_qsv_decode_close(QSVContext *q)


-- 
Best regards,
 Ivanmailto:ivan.us...@nablet.com

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH] Fix double free and null dereferences in the qsv decoder

[Yuli Khodorkovskiy]

This patch fixes the h264_qsv decoder issues mentioned
in https://ffmpeg.zeranoe.com/forum/viewtopic.php?t=2962.

The patch may be tested by specifying h264_qsv as the decoder to ffplay
for an h264 encoded file.

ffplay -vcodec h264_qsv foo.mts

Signed-off-by: Yuli Khodorkovskiy 
---
 libavcodec/qsvdec.c | 10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/libavcodec/qsvdec.c b/libavcodec/qsvdec.c
index 9125700..b462887 100644
--- a/libavcodec/qsvdec.c
+++ b/libavcodec/qsvdec.c
@@ -408,7 +408,7 @@ static int do_qsv_decode(AVCodecContext *avctx, QSVContext 
*q,
 return ff_qsv_error(ret);
 }
 n_out_frames = av_fifo_size(q->async_fifo) / 
(sizeof(out_frame)+sizeof(sync));
-
+av_freep();
 if (n_out_frames > q->async_depth || (flush && n_out_frames) ) {
 AVFrame *src_frame;
 
@@ -555,16 +555,18 @@ void ff_qsv_decode_reset(AVCodecContext *avctx, 
QSVContext *q)
 }
 
 /* Reset output surfaces */
-av_fifo_reset(q->async_fifo);
+if (q->async_fifo)
+av_fifo_reset(q->async_fifo);
 
 /* Reset input packets fifo */
-while (av_fifo_size(q->pkt_fifo)) {
+while (q->pkt_fifo && av_fifo_size(q->pkt_fifo)) {
 av_fifo_generic_read(q->pkt_fifo, , sizeof(pkt), NULL);
 av_packet_unref();
 }
 
 /* Reset input bitstream fifo */
-av_fifo_reset(q->input_fifo);
+if (q->input_fifo)
+av_fifo_reset(q->input_fifo);
 }
 
 int ff_qsv_decode_close(QSVContext *q)
-- 
1.8.3.1

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel