amf_device_create() calls amf_device_uninit() on errors, but if things were not initialized it will null deref amf_ctx->factory. Fixes: https://github.com/mpv-player/mpv/issues/15814
Unified · Split
| @@ -339,7 +339,7 @@ static int amf_transfer_data_from(AVHWFramesContext *ctx, AVFrame *dst, · 338 unmodified lines | ||
| 339 | 339 | static void amf_device_uninit(AVHWDeviceContext *device_ctx) |
| 340 | 340 | { |
| 341 | 341 | AVAMFDeviceContext *amf_ctx = device_ctx->hwctx; |
| 342 | − AMF_RESULT res; | |
| 342 | + AMF_RESULT res = AMF_NOT_INITIALIZED; | |
| 343 | 343 | AMFTrace *trace; |
| 344 | 344 | |
| 345 | 345 | if (amf_ctx->context) { |
| @@ -348,7 +348,9 @@ static void amf_device_uninit(AVHWDeviceContext *device_ctx) · 2 unmodified lines | ||
| 348 | 348 | amf_ctx->context = NULL; |
| 349 | 349 | } |
| 350 | 350 | |
| 351 | − res = amf_ctx->factory->pVtbl->GetTrace(amf_ctx->factory, &trace); | |
| 351 | + if (amf_ctx->factory) | |
| 352 | + res = amf_ctx->factory->pVtbl->GetTrace(amf_ctx->factory, &trace); | |
| 353 | + | |
| 352 | 354 | if (res == AMF_OK) { |
| 353 | 355 | trace->pVtbl->UnregisterWriter(trace, FFMPEG_AMF_WRITER_ID); |
| 354 | 356 | } |