avcodec_copy_context() didn't handle hw_frames_ctx references correctly which could cause crashes.
Unified · Split
| @@ -190,6 +190,7 @@ int avcodec_copy_context(AVCodecContext *dest, const AVCodecContext *src) · 189 unmodified lines | ||
| 190 | 190 | dest->inter_matrix = NULL; |
| 191 | 191 | dest->rc_override = NULL; |
| 192 | 192 | dest->subtitle_header = NULL; |
| 193 | + dest->hw_frames_ctx = NULL; | |
| 193 | 194 | #if FF_API_MPV_OPT |
| 194 | 195 | FF_DISABLE_DEPRECATION_WARNINGS |
| 195 | 196 | dest->rc_eq = NULL; |
| @@ -219,13 +220,21 @@ int avcodec_copy_context(AVCodecContext *dest, const AVCodecContext *src) · 23 unmodified lines | ||
| 219 | 220 | dest->subtitle_header_size = src->subtitle_header_size; |
| 220 | 221 | #undef alloc_and_copy_or_fail |
| 221 | 222 | |
| 223 | + if (src->hw_frames_ctx) { | |
| 224 | + dest->hw_frames_ctx = av_buffer_ref(src->hw_frames_ctx); | |
| 225 | + if (!dest->hw_frames_ctx) | |
| 226 | + goto fail; | |
| 227 | + } | |
| 228 | + | |
| 222 | 229 | return 0; |
| 223 | 230 | |
| 224 | 231 | fail: |
| 232 | + av_freep(&dest->subtitle_header); | |
| 225 | 233 | av_freep(&dest->rc_override); |
| 226 | 234 | av_freep(&dest->intra_matrix); |
| 227 | 235 | av_freep(&dest->inter_matrix); |
| 228 | 236 | av_freep(&dest->extradata); |
| 237 | + av_buffer_unref(&dest->hw_frames_ctx); | |
| 229 | 238 | #if FF_API_MPV_OPT |
| 230 | 239 | FF_DISABLE_DEPRECATION_WARNINGS |
| 231 | 240 | av_freep(&dest->rc_eq); |