diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2021-09-01 21:14:41 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2021-09-03 19:23:18 +0200 |
| commit | 2f710734c878b95eaeb9b84b0b5f367ab976c1bd (patch) | |
| tree | 1afc1e28a86641c046e6a8e005a3fabeb4d08b46 /libavformat/internal.h | |
| parent | c0be596fc1647a2d6b731003adf3f64b9df0c5d2 (diff) | |
avformat/mux: Fix double-free when using AVPacket.opaque_ref
Up until now, ff_write_chained() copied the packet (manually, not with
av_packet_move_ref()) from a packet given to it to a stack packet whose
timing and stream_index is then modified before being sent to another
muxer via av_(interleaved_)write_frame(). Afterwards it is intended to
sync the fields of the packet relevant to freeing again; yet this only
encompasses buf, side_data and side_data_elems and not the newly added
opaque_ref. The other fields are not synced so that the returned packet
can have a size > 0 and data != NULL despite its buf being NULL (this
always happens in the interleaved codepath; before commit
fe251f77c80b0512ab8907902e1dbed3f4fe1aad it could also happen in the
noninterleaved one). This leads to double-frees if the interleaved
codepath is used and opaque_ref is set.
This commit therefore changes this by directly reusing the packet
instead of a spare packet. Given that av_write_frame() does not
change the packet given to it, one only needs to restore the timing
information to return it as it was; for the interleaved codepath
it is not possible to do likewise*, because av_interleaved_write_frame()
takes ownership of the packets given to it and returns blank packets.
But precisely because of this users of the interleaved codepath
have no legitimate expectation that their packet will be returned
unchanged. In line with av_interleaved_write_frame() ff_write_chained()
therefore returns blank packets when using the interleaved codepath.
Making the only user of said codepath compatible with this was trivial.
*: Unless one wanted to create a full new reference.
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavformat/internal.h')
| -rw-r--r-- | libavformat/internal.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavformat/internal.h b/libavformat/internal.h index 4fc1154b9d..9d7312c0e2 100644 --- a/libavformat/internal.h +++ b/libavformat/internal.h @@ -506,7 +506,8 @@ void ff_sdp_write_media(char *buff, int size, AVStream *st, int idx, * * @param dst the muxer to write the packet to * @param dst_stream the stream index within dst to write the packet to - * @param pkt the packet to be written + * @param pkt the packet to be written. It will be returned blank when + * av_interleaved_write_frame() is used, unchanged otherwise. * @param src the muxer the packet originally was intended for * @param interleave 0->use av_write_frame, 1->av_interleaved_write_frame * @return the value av_write_frame returned |