[FFmpeg-devel] [PATCH] Fix double free and null dereferences in the qsv decoder

Yuli Khodorkovskiy ykhodo at gmail.com
Wed Jul 27 18:21:41 EEST 2016


This patch fixes the h264_qsv decoder issues mentioned
in https://ffmpeg.zeranoe.com/forum/viewtopic.php?t=2962.

The patch may be tested by specifying h264_qsv as the decoder to ffplay
for an h264 encoded file.

	ffplay -vcodec h264_qsv foo.mts

Signed-off-by: Yuli Khodorkovskiy <ykhodo at gmail.com>
---
 libavcodec/qsvdec.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/libavcodec/qsvdec.c b/libavcodec/qsvdec.c
index 9125700..b462887 100644
--- a/libavcodec/qsvdec.c
+++ b/libavcodec/qsvdec.c
@@ -408,7 +408,7 @@ static int do_qsv_decode(AVCodecContext *avctx, QSVContext *q,
         return ff_qsv_error(ret);
     }
     n_out_frames = av_fifo_size(q->async_fifo) / (sizeof(out_frame)+sizeof(sync));
-
+    av_freep(&sync);
     if (n_out_frames > q->async_depth || (flush && n_out_frames) ) {
         AVFrame *src_frame;
 
@@ -555,16 +555,18 @@ void ff_qsv_decode_reset(AVCodecContext *avctx, QSVContext *q)
     }
 
     /* Reset output surfaces */
-    av_fifo_reset(q->async_fifo);
+    if (q->async_fifo)
+        av_fifo_reset(q->async_fifo);
 
     /* Reset input packets fifo */
-    while (av_fifo_size(q->pkt_fifo)) {
+    while (q->pkt_fifo && av_fifo_size(q->pkt_fifo)) {
         av_fifo_generic_read(q->pkt_fifo, &pkt, sizeof(pkt), NULL);
         av_packet_unref(&pkt);
     }
 
     /* Reset input bitstream fifo */
-    av_fifo_reset(q->input_fifo);
+    if (q->input_fifo)
+        av_fifo_reset(q->input_fifo);
 }
 
 int ff_qsv_decode_close(QSVContext *q)
-- 
1.8.3.1



More information about the ffmpeg-devel mailing list