| Message ID | 20200509173541.7667-1-andriy.gelman@gmail.com |
|---|---|
| State | Accepted |
| Commit | a9fecb8ea181d285a3218e27c97e5857925731d8 |
| Delegated to: | andriy |
| Headers | show |
| Series | [FFmpeg-devel,v3] avcodec/v4l2_m2m_dec: Remove redundant packet and fix double free | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On Sat, 09. May 13:35, Andriy Gelman wrote: > From: Andriy Gelman <andriy.gelman@gmail.com> > > v4l2_receive_frame() uses two packets s->buf_pkt and avpkt. If avpkt > cannot be enqueued, the packet is buffered in s->buf_pkt and enqueued in > the next call. Currently the ownership transfer between the two packets > is not properly handled. A double free occurs if > ff_v4l2_context_enqueue_packet() returns EAGAIN and v4l2_try_start > returns EINVAL. > > In fact, having two AVPackets is not needed and everything can be > handled by s->buf_pkt. > > This commit removes the local avpkt from v4l2_receive_frame(), meaning > that the ownership transfer doesn't need to be handled and the double > free is fixed. > > Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> > --- > > Sorry, forgot to squash the commit from v1 so v2 didn't apply. This is correct version. > > Supersedes: > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200505055454.28683-1-andriy.gelman@gmail.com/ > > > libavcodec/v4l2_m2m_dec.c | 37 +++++++++++++++---------------------- > 1 file changed, 15 insertions(+), 22 deletions(-) > > diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c > index 3e17e0fcac..b038efed9c 100644 > --- a/libavcodec/v4l2_m2m_dec.c > +++ b/libavcodec/v4l2_m2m_dec.c > @@ -138,14 +138,10 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > V4L2m2mContext *s = ((V4L2m2mPriv*)avctx->priv_data)->context; > V4L2Context *const capture = &s->capture; > V4L2Context *const output = &s->output; > - AVPacket avpkt = {0}; > int ret; > > - if (s->buf_pkt.size) { > - avpkt = s->buf_pkt; > - memset(&s->buf_pkt, 0, sizeof(AVPacket)); > - } else { > - ret = ff_decode_get_packet(avctx, &avpkt); > + if (!s->buf_pkt.size) { > + ret = ff_decode_get_packet(avctx, &s->buf_pkt); > if (ret < 0 && ret != AVERROR_EOF) > return ret; > } > @@ -153,32 +149,29 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > if (s->draining) > goto dequeue; > > - ret = ff_v4l2_context_enqueue_packet(output, &avpkt); > - if (ret < 0) { > - if (ret != AVERROR(EAGAIN)) > - return ret; > + ret = ff_v4l2_context_enqueue_packet(output, &s->buf_pkt); > + if (ret < 0 && ret != AVERROR(EAGAIN)) > + goto fail; > > - s->buf_pkt = avpkt; > - /* no input buffers available, continue dequeing */ > - } > + /* if EAGAIN don't unref packet and try to enqueue in the next iteration */ > + if (ret != AVERROR(EAGAIN)) > + av_packet_unref(&s->buf_pkt); > > - if (avpkt.size) { > + if (!s->draining) { > ret = v4l2_try_start(avctx); > if (ret) { > - av_packet_unref(&avpkt); > - > /* cant recover */ > - if (ret == AVERROR(ENOMEM)) > - return ret; > - > - return 0; > + if (ret != AVERROR(ENOMEM)) > + ret = 0; > + goto fail; > } > } > > dequeue: > - if (!s->buf_pkt.size) > - av_packet_unref(&avpkt); > return ff_v4l2_context_dequeue_frame(capture, frame, -1); > +fail: > + av_packet_unref(&s->buf_pkt); > + return ret; > } > > static av_cold int v4l2_decode_init(AVCodecContext *avctx) > -- > 2.25.1 > ping
On Sat, 16. May 11:53, Andriy Gelman wrote: > On Sat, 09. May 13:35, Andriy Gelman wrote: > > From: Andriy Gelman <andriy.gelman@gmail.com> > > > > v4l2_receive_frame() uses two packets s->buf_pkt and avpkt. If avpkt > > cannot be enqueued, the packet is buffered in s->buf_pkt and enqueued in > > the next call. Currently the ownership transfer between the two packets > > is not properly handled. A double free occurs if > > ff_v4l2_context_enqueue_packet() returns EAGAIN and v4l2_try_start > > returns EINVAL. > > > > In fact, having two AVPackets is not needed and everything can be > > handled by s->buf_pkt. > > > > This commit removes the local avpkt from v4l2_receive_frame(), meaning > > that the ownership transfer doesn't need to be handled and the double > > free is fixed. > > > > Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> > > --- > > > > Sorry, forgot to squash the commit from v1 so v2 didn't apply. This is correct version. > > > > Supersedes: > > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200505055454.28683-1-andriy.gelman@gmail.com/ > > > > > > libavcodec/v4l2_m2m_dec.c | 37 +++++++++++++++---------------------- > > 1 file changed, 15 insertions(+), 22 deletions(-) > > > > diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c > > index 3e17e0fcac..b038efed9c 100644 > > --- a/libavcodec/v4l2_m2m_dec.c > > +++ b/libavcodec/v4l2_m2m_dec.c > > @@ -138,14 +138,10 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > > V4L2m2mContext *s = ((V4L2m2mPriv*)avctx->priv_data)->context; > > V4L2Context *const capture = &s->capture; > > V4L2Context *const output = &s->output; > > - AVPacket avpkt = {0}; > > int ret; > > > > - if (s->buf_pkt.size) { > > - avpkt = s->buf_pkt; > > - memset(&s->buf_pkt, 0, sizeof(AVPacket)); > > - } else { > > - ret = ff_decode_get_packet(avctx, &avpkt); > > + if (!s->buf_pkt.size) { > > + ret = ff_decode_get_packet(avctx, &s->buf_pkt); > > if (ret < 0 && ret != AVERROR_EOF) > > return ret; > > } > > @@ -153,32 +149,29 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > > if (s->draining) > > goto dequeue; > > > > - ret = ff_v4l2_context_enqueue_packet(output, &avpkt); > > - if (ret < 0) { > > - if (ret != AVERROR(EAGAIN)) > > - return ret; > > + ret = ff_v4l2_context_enqueue_packet(output, &s->buf_pkt); > > + if (ret < 0 && ret != AVERROR(EAGAIN)) > > + goto fail; > > > > - s->buf_pkt = avpkt; > > - /* no input buffers available, continue dequeing */ > > - } > > + /* if EAGAIN don't unref packet and try to enqueue in the next iteration */ > > + if (ret != AVERROR(EAGAIN)) > > + av_packet_unref(&s->buf_pkt); > > > > - if (avpkt.size) { > > + if (!s->draining) { > > ret = v4l2_try_start(avctx); > > if (ret) { > > - av_packet_unref(&avpkt); > > - > > /* cant recover */ > > - if (ret == AVERROR(ENOMEM)) > > - return ret; > > - > > - return 0; > > + if (ret != AVERROR(ENOMEM)) > > + ret = 0; > > + goto fail; > > } > > } > > > > dequeue: > > - if (!s->buf_pkt.size) > > - av_packet_unref(&avpkt); > > return ff_v4l2_context_dequeue_frame(capture, frame, -1); > > +fail: > > + av_packet_unref(&s->buf_pkt); > > + return ret; > > } > > > > static av_cold int v4l2_decode_init(AVCodecContext *avctx) > > -- > > 2.25.1 > > > > ping > ping
On Mon, 25. May 14:59, Andriy Gelman wrote: > On Sat, 16. May 11:53, Andriy Gelman wrote: > > On Sat, 09. May 13:35, Andriy Gelman wrote: > > > From: Andriy Gelman <andriy.gelman@gmail.com> > > > > > > v4l2_receive_frame() uses two packets s->buf_pkt and avpkt. If avpkt > > > cannot be enqueued, the packet is buffered in s->buf_pkt and enqueued in > > > the next call. Currently the ownership transfer between the two packets > > > is not properly handled. A double free occurs if > > > ff_v4l2_context_enqueue_packet() returns EAGAIN and v4l2_try_start > > > returns EINVAL. > > > > > > In fact, having two AVPackets is not needed and everything can be > > > handled by s->buf_pkt. > > > > > > This commit removes the local avpkt from v4l2_receive_frame(), meaning > > > that the ownership transfer doesn't need to be handled and the double > > > free is fixed. > > > > > > Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> > > > --- > > > > > > Sorry, forgot to squash the commit from v1 so v2 didn't apply. This is correct version. > > > > > > Supersedes: > > > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200505055454.28683-1-andriy.gelman@gmail.com/ > > > > > > > > > libavcodec/v4l2_m2m_dec.c | 37 +++++++++++++++---------------------- > > > 1 file changed, 15 insertions(+), 22 deletions(-) > > > > > > diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c > > > index 3e17e0fcac..b038efed9c 100644 > > > --- a/libavcodec/v4l2_m2m_dec.c > > > +++ b/libavcodec/v4l2_m2m_dec.c > > > @@ -138,14 +138,10 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > > > V4L2m2mContext *s = ((V4L2m2mPriv*)avctx->priv_data)->context; > > > V4L2Context *const capture = &s->capture; > > > V4L2Context *const output = &s->output; > > > - AVPacket avpkt = {0}; > > > int ret; > > > > > > - if (s->buf_pkt.size) { > > > - avpkt = s->buf_pkt; > > > - memset(&s->buf_pkt, 0, sizeof(AVPacket)); > > > - } else { > > > - ret = ff_decode_get_packet(avctx, &avpkt); > > > + if (!s->buf_pkt.size) { > > > + ret = ff_decode_get_packet(avctx, &s->buf_pkt); > > > if (ret < 0 && ret != AVERROR_EOF) > > > return ret; > > > } > > > @@ -153,32 +149,29 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > > > if (s->draining) > > > goto dequeue; > > > > > > - ret = ff_v4l2_context_enqueue_packet(output, &avpkt); > > > - if (ret < 0) { > > > - if (ret != AVERROR(EAGAIN)) > > > - return ret; > > > + ret = ff_v4l2_context_enqueue_packet(output, &s->buf_pkt); > > > + if (ret < 0 && ret != AVERROR(EAGAIN)) > > > + goto fail; > > > > > > - s->buf_pkt = avpkt; > > > - /* no input buffers available, continue dequeing */ > > > - } > > > + /* if EAGAIN don't unref packet and try to enqueue in the next iteration */ > > > + if (ret != AVERROR(EAGAIN)) > > > + av_packet_unref(&s->buf_pkt); > > > > > > - if (avpkt.size) { > > > + if (!s->draining) { > > > ret = v4l2_try_start(avctx); > > > if (ret) { > > > - av_packet_unref(&avpkt); > > > - > > > /* cant recover */ > > > - if (ret == AVERROR(ENOMEM)) > > > - return ret; > > > - > > > - return 0; > > > + if (ret != AVERROR(ENOMEM)) > > > + ret = 0; > > > + goto fail; > > > } > > > } > > > > > > dequeue: > > > - if (!s->buf_pkt.size) > > > - av_packet_unref(&avpkt); > > > return ff_v4l2_context_dequeue_frame(capture, frame, -1); > > > +fail: > > > + av_packet_unref(&s->buf_pkt); > > > + return ret; > > > } > > > > > > static av_cold int v4l2_decode_init(AVCodecContext *avctx) > > > -- > > > 2.25.1 > > > > > > > ping > > > > ping > ping
On Wed, 24. Jun 09:26, Andriy Gelman wrote: > On Mon, 25. May 14:59, Andriy Gelman wrote: > > On Sat, 16. May 11:53, Andriy Gelman wrote: > > > On Sat, 09. May 13:35, Andriy Gelman wrote: > > > > From: Andriy Gelman <andriy.gelman@gmail.com> > > > > > > > > v4l2_receive_frame() uses two packets s->buf_pkt and avpkt. If avpkt > > > > cannot be enqueued, the packet is buffered in s->buf_pkt and enqueued in > > > > the next call. Currently the ownership transfer between the two packets > > > > is not properly handled. A double free occurs if > > > > ff_v4l2_context_enqueue_packet() returns EAGAIN and v4l2_try_start > > > > returns EINVAL. > > > > > > > > In fact, having two AVPackets is not needed and everything can be > > > > handled by s->buf_pkt. > > > > > > > > This commit removes the local avpkt from v4l2_receive_frame(), meaning > > > > that the ownership transfer doesn't need to be handled and the double > > > > free is fixed. > > > > > > > > Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> > > > > --- > > > > > > > > Sorry, forgot to squash the commit from v1 so v2 didn't apply. This is correct version. > > > > > > > > Supersedes: > > > > https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200505055454.28683-1-andriy.gelman@gmail.com/ > > > > > > > > > > > > libavcodec/v4l2_m2m_dec.c | 37 +++++++++++++++---------------------- > > > > 1 file changed, 15 insertions(+), 22 deletions(-) > > > > > > > > diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c > > > > index 3e17e0fcac..b038efed9c 100644 > > > > --- a/libavcodec/v4l2_m2m_dec.c > > > > +++ b/libavcodec/v4l2_m2m_dec.c > > > > @@ -138,14 +138,10 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > > > > V4L2m2mContext *s = ((V4L2m2mPriv*)avctx->priv_data)->context; > > > > V4L2Context *const capture = &s->capture; > > > > V4L2Context *const output = &s->output; > > > > - AVPacket avpkt = {0}; > > > > int ret; > > > > > > > > - if (s->buf_pkt.size) { > > > > - avpkt = s->buf_pkt; > > > > - memset(&s->buf_pkt, 0, sizeof(AVPacket)); > > > > - } else { > > > > - ret = ff_decode_get_packet(avctx, &avpkt); > > > > + if (!s->buf_pkt.size) { > > > > + ret = ff_decode_get_packet(avctx, &s->buf_pkt); > > > > if (ret < 0 && ret != AVERROR_EOF) > > > > return ret; > > > > } > > > > @@ -153,32 +149,29 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) > > > > if (s->draining) > > > > goto dequeue; > > > > > > > > - ret = ff_v4l2_context_enqueue_packet(output, &avpkt); > > > > - if (ret < 0) { > > > > - if (ret != AVERROR(EAGAIN)) > > > > - return ret; > > > > + ret = ff_v4l2_context_enqueue_packet(output, &s->buf_pkt); > > > > + if (ret < 0 && ret != AVERROR(EAGAIN)) > > > > + goto fail; > > > > > > > > - s->buf_pkt = avpkt; > > > > - /* no input buffers available, continue dequeing */ > > > > - } > > > > + /* if EAGAIN don't unref packet and try to enqueue in the next iteration */ > > > > + if (ret != AVERROR(EAGAIN)) > > > > + av_packet_unref(&s->buf_pkt); > > > > > > > > - if (avpkt.size) { > > > > + if (!s->draining) { > > > > ret = v4l2_try_start(avctx); > > > > if (ret) { > > > > - av_packet_unref(&avpkt); > > > > - > > > > /* cant recover */ > > > > - if (ret == AVERROR(ENOMEM)) > > > > - return ret; > > > > - > > > > - return 0; > > > > + if (ret != AVERROR(ENOMEM)) > > > > + ret = 0; > > > > + goto fail; > > > > } > > > > } > > > > > > > > dequeue: > > > > - if (!s->buf_pkt.size) > > > > - av_packet_unref(&avpkt); > > > > return ff_v4l2_context_dequeue_frame(capture, frame, -1); > > > > +fail: > > > > + av_packet_unref(&s->buf_pkt); > > > > + return ret; > > > > } > > > > > > > > static av_cold int v4l2_decode_init(AVCodecContext *avctx) > > > > -- > > > > 2.25.1 > > > > > > > > > > ping > > > > > > > ping > > > > ping > The patch has been on the ml for a long time so I'd like to apply it soon. It gets rid of a seg fault in: https://trac.ffmpeg.org/ticket/8774 Any objections?
On 7/12/2020 8:11 PM, Andriy Gelman wrote: > On Wed, 24. Jun 09:26, Andriy Gelman wrote: >> On Mon, 25. May 14:59, Andriy Gelman wrote: >>> On Sat, 16. May 11:53, Andriy Gelman wrote: >>>> On Sat, 09. May 13:35, Andriy Gelman wrote: >>>>> From: Andriy Gelman <andriy.gelman@gmail.com> >>>>> >>>>> v4l2_receive_frame() uses two packets s->buf_pkt and avpkt. If avpkt >>>>> cannot be enqueued, the packet is buffered in s->buf_pkt and enqueued in >>>>> the next call. Currently the ownership transfer between the two packets >>>>> is not properly handled. A double free occurs if >>>>> ff_v4l2_context_enqueue_packet() returns EAGAIN and v4l2_try_start >>>>> returns EINVAL. >>>>> >>>>> In fact, having two AVPackets is not needed and everything can be >>>>> handled by s->buf_pkt. >>>>> >>>>> This commit removes the local avpkt from v4l2_receive_frame(), meaning >>>>> that the ownership transfer doesn't need to be handled and the double >>>>> free is fixed. >>>>> >>>>> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> >>>>> --- >>>>> >>>>> Sorry, forgot to squash the commit from v1 so v2 didn't apply. This is correct version. >>>>> >>>>> Supersedes: >>>>> https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200505055454.28683-1-andriy.gelman@gmail.com/ >>>>> >>>>> >>>>> libavcodec/v4l2_m2m_dec.c | 37 +++++++++++++++---------------------- >>>>> 1 file changed, 15 insertions(+), 22 deletions(-) >>>>> >>>>> diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c >>>>> index 3e17e0fcac..b038efed9c 100644 >>>>> --- a/libavcodec/v4l2_m2m_dec.c >>>>> +++ b/libavcodec/v4l2_m2m_dec.c >>>>> @@ -138,14 +138,10 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) >>>>> V4L2m2mContext *s = ((V4L2m2mPriv*)avctx->priv_data)->context; >>>>> V4L2Context *const capture = &s->capture; >>>>> V4L2Context *const output = &s->output; >>>>> - AVPacket avpkt = {0}; >>>>> int ret; >>>>> >>>>> - if (s->buf_pkt.size) { >>>>> - avpkt = s->buf_pkt; >>>>> - memset(&s->buf_pkt, 0, sizeof(AVPacket)); >>>>> - } else { >>>>> - ret = ff_decode_get_packet(avctx, &avpkt); >>>>> + if (!s->buf_pkt.size) { >>>>> + ret = ff_decode_get_packet(avctx, &s->buf_pkt); >>>>> if (ret < 0 && ret != AVERROR_EOF) >>>>> return ret; >>>>> } >>>>> @@ -153,32 +149,29 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) >>>>> if (s->draining) >>>>> goto dequeue; >>>>> >>>>> - ret = ff_v4l2_context_enqueue_packet(output, &avpkt); >>>>> - if (ret < 0) { >>>>> - if (ret != AVERROR(EAGAIN)) >>>>> - return ret; >>>>> + ret = ff_v4l2_context_enqueue_packet(output, &s->buf_pkt); >>>>> + if (ret < 0 && ret != AVERROR(EAGAIN)) >>>>> + goto fail; >>>>> >>>>> - s->buf_pkt = avpkt; >>>>> - /* no input buffers available, continue dequeing */ >>>>> - } >>>>> + /* if EAGAIN don't unref packet and try to enqueue in the next iteration */ >>>>> + if (ret != AVERROR(EAGAIN)) >>>>> + av_packet_unref(&s->buf_pkt); >>>>> >>>>> - if (avpkt.size) { >>>>> + if (!s->draining) { >>>>> ret = v4l2_try_start(avctx); >>>>> if (ret) { >>>>> - av_packet_unref(&avpkt); >>>>> - >>>>> /* cant recover */ >>>>> - if (ret == AVERROR(ENOMEM)) >>>>> - return ret; >>>>> - >>>>> - return 0; >>>>> + if (ret != AVERROR(ENOMEM)) >>>>> + ret = 0; >>>>> + goto fail; >>>>> } >>>>> } >>>>> >>>>> dequeue: >>>>> - if (!s->buf_pkt.size) >>>>> - av_packet_unref(&avpkt); >>>>> return ff_v4l2_context_dequeue_frame(capture, frame, -1); >>>>> +fail: >>>>> + av_packet_unref(&s->buf_pkt); >>>>> + return ret; >>>>> } >>>>> >>>>> static av_cold int v4l2_decode_init(AVCodecContext *avctx) >>>>> -- >>>>> 2.25.1 >>>>> >>>> >>>> ping >>>> >>> >>> ping >>> >> >> ping >> > > The patch has been on the ml for a long time so I'd like to apply it soon. > It gets rid of a seg fault in: > https://trac.ffmpeg.org/ticket/8774 > > Any objections? If you maintain this code and get no reviews, then you can push it after a while. No need to wait two months. I can't test it, but should be ok.
On Mon, 13. Jul 12:55, James Almer wrote: > On 7/12/2020 8:11 PM, Andriy Gelman wrote: > > > > The patch has been on the ml for a long time so I'd like to apply it soon. > > It gets rid of a seg fault in: > > https://trac.ffmpeg.org/ticket/8774 > > > > Any objections? > > If you maintain this code and get no reviews, then you can push it after > a while. No need to wait two months. > > I can't test it, but should be ok. Thanks, will apply.
diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c index 3e17e0fcac..b038efed9c 100644 --- a/libavcodec/v4l2_m2m_dec.c +++ b/libavcodec/v4l2_m2m_dec.c @@ -138,14 +138,10 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) V4L2m2mContext *s = ((V4L2m2mPriv*)avctx->priv_data)->context; V4L2Context *const capture = &s->capture; V4L2Context *const output = &s->output; - AVPacket avpkt = {0}; int ret; - if (s->buf_pkt.size) { - avpkt = s->buf_pkt; - memset(&s->buf_pkt, 0, sizeof(AVPacket)); - } else { - ret = ff_decode_get_packet(avctx, &avpkt); + if (!s->buf_pkt.size) { + ret = ff_decode_get_packet(avctx, &s->buf_pkt); if (ret < 0 && ret != AVERROR_EOF) return ret; } @@ -153,32 +149,29 @@ static int v4l2_receive_frame(AVCodecContext *avctx, AVFrame *frame) if (s->draining) goto dequeue; - ret = ff_v4l2_context_enqueue_packet(output, &avpkt); - if (ret < 0) { - if (ret != AVERROR(EAGAIN)) - return ret; + ret = ff_v4l2_context_enqueue_packet(output, &s->buf_pkt); + if (ret < 0 && ret != AVERROR(EAGAIN)) + goto fail; - s->buf_pkt = avpkt; - /* no input buffers available, continue dequeing */ - } + /* if EAGAIN don't unref packet and try to enqueue in the next iteration */ + if (ret != AVERROR(EAGAIN)) + av_packet_unref(&s->buf_pkt); - if (avpkt.size) { + if (!s->draining) { ret = v4l2_try_start(avctx); if (ret) { - av_packet_unref(&avpkt); - /* cant recover */ - if (ret == AVERROR(ENOMEM)) - return ret; - - return 0; + if (ret != AVERROR(ENOMEM)) + ret = 0; + goto fail; } } dequeue: - if (!s->buf_pkt.size) - av_packet_unref(&avpkt); return ff_v4l2_context_dequeue_frame(capture, frame, -1); +fail: + av_packet_unref(&s->buf_pkt); + return ret; } static av_cold int v4l2_decode_init(AVCodecContext *avctx)