avcodec_copy_context() didn't handle hw_frames_ctx references correctly which could cause crashes.
Unified · Split
| @@ -190,6 +190,7 @@ int avcodec_copy_context(AVCodecContext *dest, const AVCodecContext *src) · 189 unmodified lines | |||
| 190 | dest->inter_matrix = NULL; | 190 | dest->inter_matrix = NULL; |
| 191 | dest->rc_override = NULL; | 191 | dest->rc_override = NULL; |
| 192 | dest->subtitle_header = NULL; | 192 | dest->subtitle_header = NULL; |
| 193 | dest->hw_frames_ctx = NULL; | ||
| 193 | #if FF_API_MPV_OPT | 194 | #if FF_API_MPV_OPT |
| 194 | FF_DISABLE_DEPRECATION_WARNINGS | 195 | FF_DISABLE_DEPRECATION_WARNINGS |
| 195 | dest->rc_eq = NULL; | 196 | dest->rc_eq = NULL; |
| @@ -219,13 +220,21 @@ int avcodec_copy_context(AVCodecContext *dest, const AVCodecContext *src) · 23 unmodified lines | |||
| 219 | dest->subtitle_header_size = src->subtitle_header_size; | 220 | dest->subtitle_header_size = src->subtitle_header_size; |
| 220 | #undef alloc_and_copy_or_fail | 221 | #undef alloc_and_copy_or_fail |
| 221 | 222 | ||
| 223 | if (src->hw_frames_ctx) { | ||
| 224 | dest->hw_frames_ctx = av_buffer_ref(src->hw_frames_ctx); | ||
| 225 | if (!dest->hw_frames_ctx) | ||
| 226 | goto fail; | ||
| 227 | } | ||
| 228 | |||
| 222 | return 0; | 229 | return 0; |
| 223 | 230 | ||
| 224 | fail: | 231 | fail: |
| 232 | av_freep(&dest->subtitle_header); | ||
| 225 | av_freep(&dest->rc_override); | 233 | av_freep(&dest->rc_override); |
| 226 | av_freep(&dest->intra_matrix); | 234 | av_freep(&dest->intra_matrix); |
| 227 | av_freep(&dest->inter_matrix); | 235 | av_freep(&dest->inter_matrix); |
| 228 | av_freep(&dest->extradata); | 236 | av_freep(&dest->extradata); |
| 237 | av_buffer_unref(&dest->hw_frames_ctx); | ||
| 229 | #if FF_API_MPV_OPT | 238 | #if FF_API_MPV_OPT |
| 230 | FF_DISABLE_DEPRECATION_WARNINGS | 239 | FF_DISABLE_DEPRECATION_WARNINGS |
| 231 | av_freep(&dest->rc_eq); | 240 | av_freep(&dest->rc_eq); |