FaSTTUBe/GST-Tensordecoder-ov_ep
37
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

va: Fix null ptr dereference for vadeocder

Browse Source 
Making a null check in gst_va_decode_picture_free () indicates pic->buffers or pic->slices
can be null, then in _destroy_buffers () the pointers are dereferenced, which is detected
as dereference after null check by Coverity. Thus, modify the code to do null check in
_detroy_buffers ().

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1143>
This commit is contained in:
Mengkejiergeli Ba 2021-10-13 15:58:29 +08:00 committed by GStreamer Marge Bot
parent d477c9e903
commit 4a6cc431d2
1 changed files with 26 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
subprojects/gst-plugins-bad/sys/va/gstvadecoder.c
View File

@ -753,6 +753,7 @@ _destroy_buffers (GstVaDecodePicture * pic)
dpy = gst_va_display_get_va_dpy (pic->display); dpy = gst_va_display_get_va_dpy (pic->display);
if (pic->buffers) {
for (i = 0; i < pic->buffers->len; i++) { for (i = 0; i < pic->buffers->len; i++) {
buffer = g_array_index (pic->buffers, VABufferID, i); buffer = g_array_index (pic->buffers, VABufferID, i);
gst_va_display_lock (pic->display); gst_va_display_lock (pic->display);
@ -765,6 +766,10 @@ _destroy_buffers (GstVaDecodePicture * pic)
} }
} }
pic->buffers = g_array_set_size (pic->buffers, 0);
}
if (pic->slices) {
for (i = 0; i < pic->slices->len; i++) { for (i = 0; i < pic->slices->len; i++) {
buffer = g_array_index (pic->slices, VABufferID, i); buffer = g_array_index (pic->slices, VABufferID, i);
gst_va_display_lock (pic->display); gst_va_display_lock (pic->display);
@ -776,8 +781,8 @@ _destroy_buffers (GstVaDecodePicture * pic)
} }
} }
pic->buffers = g_array_set_size (pic->buffers, 0);
pic->slices = g_array_set_size (pic->slices, 0); pic->slices = g_array_set_size (pic->slices, 0);
}
return ret; return ret;
} }
@ -822,9 +827,6 @@ gst_va_decode_picture_free (GstVaDecodePicture * pic)
{ {
g_return_if_fail (pic); g_return_if_fail (pic);
/* only if add_param_buffer() or add_slice_buffer() failed */
if ((pic->buffers != NULL && pic->buffers->len > 0)
|| (pic->slices != NULL && pic->slices->len > 0))
_destroy_buffers (pic); _destroy_buffers (pic);
gst_buffer_unref (pic->gstbuffer); gst_buffer_unref (pic->gstbuffer);