FaSTTUBe/GST-Tensordecoder-ov_ep
35
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

va: Fix null ptr dereference for vadeocder

Browse Source 
Making a null check in gst_va_decode_picture_free () indicates pic->buffers or pic->slices
can be null, then in _destroy_buffers () the pointers are dereferenced, which is detected
as dereference after null check by Coverity. Thus, modify the code to do null check in
_detroy_buffers ().

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1143>
This commit is contained in:
Mengkejiergeli Ba 2021-10-13 15:58:29 +08:00 committed by GStreamer Marge Bot
parent d477c9e903
commit 4a6cc431d2
1 changed files with 26 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
subprojects/gst-plugins-bad/sys/va/gstvadecoder.c
View File

@ -753,31 +753,36 @@ _destroy_buffers (GstVaDecodePicture * pic)
dpy = gst_va_display_get_va_dpy (pic->display); dpy = gst_va_display_get_va_dpy (pic->display);
for (i = 0; i < pic->buffers->len; i++) { if (pic->buffers) {
buffer = g_array_index (pic->buffers, VABufferID, i); for (i = 0; i < pic->buffers->len; i++) {
gst_va_display_lock (pic->display); buffer = g_array_index (pic->buffers, VABufferID, i);
status = vaDestroyBuffer (dpy, buffer); gst_va_display_lock (pic->display);
gst_va_display_unlock (pic->display); status = vaDestroyBuffer (dpy, buffer);
if (status != VA_STATUS_SUCCESS) { gst_va_display_unlock (pic->display);
ret = FALSE; if (status != VA_STATUS_SUCCESS) {
GST_WARNING ("Failed to destroy parameter buffer: %s", ret = FALSE;
vaErrorStr (status)); GST_WARNING ("Failed to destroy parameter buffer: %s",
vaErrorStr (status));
}
} }
pic->buffers = g_array_set_size (pic->buffers, 0);
} }
for (i = 0; i < pic->slices->len; i++) { if (pic->slices) {
buffer = g_array_index (pic->slices, VABufferID, i); for (i = 0; i < pic->slices->len; i++) {
gst_va_display_lock (pic->display); buffer = g_array_index (pic->slices, VABufferID, i);
status = vaDestroyBuffer (dpy, buffer); gst_va_display_lock (pic->display);
gst_va_display_unlock (pic->display); status = vaDestroyBuffer (dpy, buffer);
if (status != VA_STATUS_SUCCESS) { gst_va_display_unlock (pic->display);
ret = FALSE; if (status != VA_STATUS_SUCCESS) {
GST_WARNING ("Failed to destroy slice buffer: %s", vaErrorStr (status)); ret = FALSE;
GST_WARNING ("Failed to destroy slice buffer: %s", vaErrorStr (status));
}
} }
}
pic->buffers = g_array_set_size (pic->buffers, 0); pic->slices = g_array_set_size (pic->slices, 0);
pic->slices = g_array_set_size (pic->slices, 0); }
return ret; return ret;
} }
@ -822,10 +827,7 @@ gst_va_decode_picture_free (GstVaDecodePicture * pic)
{ {
g_return_if_fail (pic); g_return_if_fail (pic);
/* only if add_param_buffer() or add_slice_buffer() failed */ _destroy_buffers (pic);
if ((pic->buffers != NULL && pic->buffers->len > 0)
|| (pic->slices != NULL && pic->slices->len > 0))
_destroy_buffers (pic);
gst_buffer_unref (pic->gstbuffer); gst_buffer_unref (pic->gstbuffer);
g_clear_pointer (&pic->buffers, g_array_unref); g_clear_pointer (&pic->buffers, g_array_unref);