amf_device_create() calls amf_device_uninit() on errors, but if things were not initialized it will null deref amf_ctx->factory. Fixes: https://github.com/mpv-player/mpv/issues/15814
Unified · Split
| @@ -339,7 +339,7 @@ static int amf_transfer_data_from(AVHWFramesContext *ctx, AVFrame *dst, · 338 unmodified lines | |||
| 339 | static void amf_device_uninit(AVHWDeviceContext *device_ctx) | 339 | static void amf_device_uninit(AVHWDeviceContext *device_ctx) |
| 340 | { | 340 | { |
| 341 | AVAMFDeviceContext *amf_ctx = device_ctx->hwctx; | 341 | AVAMFDeviceContext *amf_ctx = device_ctx->hwctx; |
| 342 | AMF_RESULT res; | 342 | AMF_RESULT res = AMF_NOT_INITIALIZED; |
| 343 | AMFTrace *trace; | 343 | AMFTrace *trace; |
| 344 | 344 | ||
| 345 | if (amf_ctx->context) { | 345 | if (amf_ctx->context) { |
| @@ -348,7 +348,9 @@ static void amf_device_uninit(AVHWDeviceContext *device_ctx) · 2 unmodified lines | |||
| 348 | amf_ctx->context = NULL; | 348 | amf_ctx->context = NULL; |
| 349 | } | 349 | } |
| 350 | 350 | ||
| 351 | res = amf_ctx->factory->pVtbl->GetTrace(amf_ctx->factory, &trace); | 351 | if (amf_ctx->factory) |
| 352 | res = amf_ctx->factory->pVtbl->GetTrace(amf_ctx->factory, &trace); | ||
| 353 | |||
| 352 | if (res == AMF_OK) { | 354 | if (res == AMF_OK) { |
| 353 | trace->pVtbl->UnregisterWriter(trace, FFMPEG_AMF_WRITER_ID); | 355 | trace->pVtbl->UnregisterWriter(trace, FFMPEG_AMF_WRITER_ID); |
| 354 | } | 356 | } |