mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-02-17 03:35:21 +00:00
Code Issues 1 Projects Releases Wiki Activity

va: Fix null ptr dereference for vadeocder

Browse source 
Making a null check in gst_va_decode_picture_free () indicates pic->buffers or pic->slices
can be null, then in _destroy_buffers () the pointers are dereferenced, which is detected
as dereference after null check by Coverity. Thus, modify the code to do null check in
_detroy_buffers ().

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1143>
This commit is contained in:
Mengkejiergeli Ba 2021-10-13 15:58:29 +08:00 committed by GStreamer Marge Bot
parent d477c9e903
commit 4a6cc431d2
1 changed files with 26 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
subprojects/gst-plugins-bad/sys/va/gstvadecoder.c
View file

@ -753,31 +753,36 @@ _destroy_buffers (GstVaDecodePicture * pic)
dpy = gst_va_display_get_va_dpy (pic->display);
for (i = 0; i < pic->buffers->len; i++) {
buffer = g_array_index (pic->buffers, VABufferID, i);
gst_va_display_lock (pic->display);
status = vaDestroyBuffer (dpy, buffer);
gst_va_display_unlock (pic->display);
if (status != VA_STATUS_SUCCESS) {
ret = FALSE;
GST_WARNING ("Failed to destroy parameter buffer: %s",
vaErrorStr (status));
if (pic->buffers) {
for (i = 0; i < pic->buffers->len; i++) {
buffer = g_array_index (pic->buffers, VABufferID, i);
gst_va_display_lock (pic->display);
status = vaDestroyBuffer (dpy, buffer);
gst_va_display_unlock (pic->display);
if (status != VA_STATUS_SUCCESS) {
ret = FALSE;
GST_WARNING ("Failed to destroy parameter buffer: %s",
vaErrorStr (status));
}
}
pic->buffers = g_array_set_size (pic->buffers, 0);
}
for (i = 0; i < pic->slices->len; i++) {
buffer = g_array_index (pic->slices, VABufferID, i);
gst_va_display_lock (pic->display);
status = vaDestroyBuffer (dpy, buffer);
gst_va_display_unlock (pic->display);
if (status != VA_STATUS_SUCCESS) {
ret = FALSE;
GST_WARNING ("Failed to destroy slice buffer: %s", vaErrorStr (status));
if (pic->slices) {
for (i = 0; i < pic->slices->len; i++) {
buffer = g_array_index (pic->slices, VABufferID, i);
gst_va_display_lock (pic->display);
status = vaDestroyBuffer (dpy, buffer);
gst_va_display_unlock (pic->display);
if (status != VA_STATUS_SUCCESS) {
ret = FALSE;
GST_WARNING ("Failed to destroy slice buffer: %s", vaErrorStr (status));
}
}
}
pic->buffers = g_array_set_size (pic->buffers, 0);
pic->slices = g_array_set_size (pic->slices, 0);
pic->slices = g_array_set_size (pic->slices, 0);
}
return ret;
}
@ -822,10 +827,7 @@ gst_va_decode_picture_free (GstVaDecodePicture * pic)
{
g_return_if_fail (pic);
/* only if add_param_buffer() or add_slice_buffer() failed */
if ((pic->buffers != NULL && pic->buffers->len > 0)
|| (pic->slices != NULL && pic->slices->len > 0))
_destroy_buffers (pic);
_destroy_buffers (pic);
gst_buffer_unref (pic->gstbuffer);
g_clear_pointer (&pic->buffers, g_array_unref);