[FFmpeg-devel] [PATCH 1/4] avcodec/a64multienc: use av_frame_ref instead of copying the frame

[Michael Niedermayer]

On Sun, Feb 22, 2015 at 09:56:52PM +0100, Andreas Cadhalpun wrote:
> Hi,
> 
> using the a64multienc encoder currently results in a crash due to a
> double free.
> This seems to be broken since [1].
> 
> Attached patch fixes this.
> 
> Best regards,
> Andreas
> 
> 1: https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=13e9cc9ce0646ba8e31d837b5e6372ec80fa7a73

>  a64multienc.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> e8ab47bcbf64c450f707b490b3f4f569dbe8af4f  0001-avcodec-a64multienc-use-av_frame_ref-instead-of-copy.patch
> From 78b5bdd67c72fbb316c3050d0809a3012ff04c4a Mon Sep 17 00:00:00 2001
> From: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> Date: Sun, 22 Feb 2015 20:43:30 +0100
> Subject: [PATCH 1/4] avcodec/a64multienc: use av_frame_ref instead of copying
>  the frame
> 
> This fixes freeing the frame buffer twice on cleanup leading to a crash.
> ---
>  libavcodec/a64multienc.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/a64multienc.c b/libavcodec/a64multienc.c
> index 6438c27..dfb4414 100644
> --- a/libavcodec/a64multienc.c
> +++ b/libavcodec/a64multienc.c
> @@ -317,7 +317,9 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
>      } else {
>          /* fill up mc_meta_charset with data until lifetime exceeds */
>          if (c->mc_frame_counter < c->mc_lifetime) {
> -            *p = *pict;
> +            ret = av_frame_ref(p, pict);
> +            if (ret < 0)
> +                return ret;

I suspect this leaves a memleak, ill push it anyway as it allows
regression testing the more complex subsequent fix

Thanks

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

When the tyrant has disposed of foreign enemies by conquest or treaty, and
there is nothing more to fear from them, then he is always stirring up
some war or other, in order that the people may require a leader. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150223/3d9a98ab/attachment.asc>