sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/nvdec: attach the hw_frames_ctx before the unmap buffer owns the mapped frame

Browse Source 
This is not a security issue.

Fixes: DPSu3J80jQZN
Fixes: swarm-NULL-deref-in-nvdec_unmap_mapped_frame-when-av_buffer_replace-fails-5c28b7
Regression since: 767f53533a
NULL pointer dereference Replicated through Modified FFmpeg with ASAN (av_buffer_replace() made to fail for one frame)
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-10-13 06:40:15 +02:00
committed by michaelni
parent 5a2f87c190
commit c2bbf2b83d
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
libavcodec/nvdec.c
View File

@@ -922,6 +922,10 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
if (ret < 0)
goto finish;
ret = av_buffer_replace(&frame->hw_frames_ctx, decoder->real_hw_frames_ref);
if (ret < 0)
goto copy_fail;
unmap_data = av_mallocz(sizeof(*unmap_data));
if (!unmap_data) {
ret = AVERROR(ENOMEM);
@@ -936,10 +940,6 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
goto copy_fail;
}
ret = av_buffer_replace(&frame->hw_frames_ctx, decoder->real_hw_frames_ref);
if (ret < 0)
goto copy_fail;
unmap_data->idx = cf->idx;
unmap_data->decoder = av_refstruct_ref(cf->decoder);
@@ -953,12 +953,8 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
goto finish;
copy_fail:
if (!frame->buf[1]) {
CHECK_CU(decoder->cvdl->cuvidUnmapVideoFrame(decoder->decoder, devptr));
av_freep(&unmap_data);
} else {
av_buffer_unref(&frame->buf[1]);
}
CHECK_CU(decoder->cvdl->cuvidUnmapVideoFrame(decoder->decoder, devptr));
av_freep(&unmap_data);
finish:
CHECK_CU(decoder->cudl->cuCtxPopCurrent(&dummy));