| Message ID | 20240206212640.9193-1-jamrial@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/nvdec: don't attempt to free NVDECContext->bitstream on simple decode_slice hwaccels | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
James Almer: > If FFHWAccel->end_frame() isn't called before FFHWAccel->uninit(), an attempt > to free a stale pointer could take place. > > Signed-off-by: James Almer <jamrial@gmail.com> > --- > libavcodec/nvdec.c | 9 +++++++++ > libavcodec/nvdec.h | 1 + > libavcodec/nvdec_mjpeg.c | 2 +- > libavcodec/nvdec_mpeg12.c | 4 ++-- > libavcodec/nvdec_mpeg4.c | 2 +- > libavcodec/nvdec_vc1.c | 4 ++-- > libavcodec/nvdec_vp8.c | 2 +- > libavcodec/nvdec_vp9.c | 2 +- > 8 files changed, 18 insertions(+), 8 deletions(-) > > diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c > index 27be644356..8a7f5c0dac 100644 > --- a/libavcodec/nvdec.c > +++ b/libavcodec/nvdec.c > @@ -274,6 +274,15 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx) > return 0; > } > > +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx) > +{ > + NVDECContext *ctx = avctx->internal->hwaccel_priv_data; > + > + ctx->bitstream = NULL; > + > + return ff_nvdec_decode_uninit(avctx); > +} > + > static void nvdec_free_dummy(struct AVHWFramesContext *ctx) > { > av_buffer_pool_uninit(&ctx->pool); > diff --git a/libavcodec/nvdec.h b/libavcodec/nvdec.h > index 353e95bf42..83bc1de84c 100644 > --- a/libavcodec/nvdec.h > +++ b/libavcodec/nvdec.h > @@ -73,6 +73,7 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx); > int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame); > int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_sep_ref); > int ff_nvdec_end_frame(AVCodecContext *avctx); > +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx); > int ff_nvdec_simple_end_frame(AVCodecContext *avctx); > int ff_nvdec_simple_decode_slice(AVCodecContext *avctx, const uint8_t *buffer, > uint32_t size); > diff --git a/libavcodec/nvdec_mjpeg.c b/libavcodec/nvdec_mjpeg.c > index 850634bf1a..adef21b0f7 100644 > --- a/libavcodec/nvdec_mjpeg.c > +++ b/libavcodec/nvdec_mjpeg.c > @@ -80,6 +80,6 @@ const FFHWAccel ff_mjpeg_nvdec_hwaccel = { > .decode_slice = nvdec_mjpeg_decode_slice, > .frame_params = nvdec_mjpeg_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > diff --git a/libavcodec/nvdec_mpeg12.c b/libavcodec/nvdec_mpeg12.c > index a4603c7ea7..5d100a46ba 100644 > --- a/libavcodec/nvdec_mpeg12.c > +++ b/libavcodec/nvdec_mpeg12.c > @@ -110,7 +110,7 @@ const FFHWAccel ff_mpeg2_nvdec_hwaccel = { > .decode_slice = ff_nvdec_simple_decode_slice, > .frame_params = nvdec_mpeg12_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > #endif > @@ -126,7 +126,7 @@ const FFHWAccel ff_mpeg1_nvdec_hwaccel = { > .decode_slice = ff_nvdec_simple_decode_slice, > .frame_params = nvdec_mpeg12_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > #endif > diff --git a/libavcodec/nvdec_mpeg4.c b/libavcodec/nvdec_mpeg4.c > index 20a0499437..5a50f7d77f 100644 > --- a/libavcodec/nvdec_mpeg4.c > +++ b/libavcodec/nvdec_mpeg4.c > @@ -120,6 +120,6 @@ const FFHWAccel ff_mpeg4_nvdec_hwaccel = { > .decode_slice = nvdec_mpeg4_decode_slice, > .frame_params = nvdec_mpeg4_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > diff --git a/libavcodec/nvdec_vc1.c b/libavcodec/nvdec_vc1.c > index 5096d784df..e9ab16c63d 100644 > --- a/libavcodec/nvdec_vc1.c > +++ b/libavcodec/nvdec_vc1.c > @@ -124,7 +124,7 @@ const FFHWAccel ff_vc1_nvdec_hwaccel = { > .decode_slice = ff_nvdec_simple_decode_slice, > .frame_params = nvdec_vc1_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > > @@ -139,7 +139,7 @@ const FFHWAccel ff_wmv3_nvdec_hwaccel = { > .decode_slice = ff_nvdec_simple_decode_slice, > .frame_params = nvdec_vc1_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > #endif > diff --git a/libavcodec/nvdec_vp8.c b/libavcodec/nvdec_vp8.c > index ff3b3f259c..bbea6f1577 100644 > --- a/libavcodec/nvdec_vp8.c > +++ b/libavcodec/nvdec_vp8.c > @@ -101,6 +101,6 @@ const FFHWAccel ff_vp8_nvdec_hwaccel = { > .decode_slice = ff_nvdec_simple_decode_slice, > .frame_params = nvdec_vp8_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; > diff --git a/libavcodec/nvdec_vp9.c b/libavcodec/nvdec_vp9.c > index e196391c6d..69b12657b6 100644 > --- a/libavcodec/nvdec_vp9.c > +++ b/libavcodec/nvdec_vp9.c > @@ -180,6 +180,6 @@ const FFHWAccel ff_vp9_nvdec_hwaccel = { > .decode_slice = ff_nvdec_simple_decode_slice, > .frame_params = nvdec_vp9_frame_params, > .init = ff_nvdec_decode_init, > - .uninit = ff_nvdec_decode_uninit, > + .uninit = ff_nvdec_simple_decode_uninit, > .priv_data_size = sizeof(NVDECContext), > }; Using a field for both an ownership pointer and as a pure data pointer is bad and confusing. IMO there should be different pointers for this; or rather: bitstream is always set and used as data pointer and the another pointer for ownership which may alias bitstream. In fact, it looks like this is exactly what bitstream_internal is, it is just not used by H.264 and HEVC in this manner (they use bitstream for allocated stuff). With the approach outlined above, ff_nvdec_simple_end_frame() might become obsolete. - Andreas
On 2/6/2024 7:14 PM, Andreas Rheinhardt wrote: > James Almer: >> If FFHWAccel->end_frame() isn't called before FFHWAccel->uninit(), an attempt >> to free a stale pointer could take place. >> >> Signed-off-by: James Almer <jamrial@gmail.com> >> --- >> libavcodec/nvdec.c | 9 +++++++++ >> libavcodec/nvdec.h | 1 + >> libavcodec/nvdec_mjpeg.c | 2 +- >> libavcodec/nvdec_mpeg12.c | 4 ++-- >> libavcodec/nvdec_mpeg4.c | 2 +- >> libavcodec/nvdec_vc1.c | 4 ++-- >> libavcodec/nvdec_vp8.c | 2 +- >> libavcodec/nvdec_vp9.c | 2 +- >> 8 files changed, 18 insertions(+), 8 deletions(-) >> >> diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c >> index 27be644356..8a7f5c0dac 100644 >> --- a/libavcodec/nvdec.c >> +++ b/libavcodec/nvdec.c >> @@ -274,6 +274,15 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx) >> return 0; >> } >> >> +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx) >> +{ >> + NVDECContext *ctx = avctx->internal->hwaccel_priv_data; >> + >> + ctx->bitstream = NULL; >> + >> + return ff_nvdec_decode_uninit(avctx); >> +} >> + >> static void nvdec_free_dummy(struct AVHWFramesContext *ctx) >> { >> av_buffer_pool_uninit(&ctx->pool); >> diff --git a/libavcodec/nvdec.h b/libavcodec/nvdec.h >> index 353e95bf42..83bc1de84c 100644 >> --- a/libavcodec/nvdec.h >> +++ b/libavcodec/nvdec.h >> @@ -73,6 +73,7 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx); >> int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame); >> int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_sep_ref); >> int ff_nvdec_end_frame(AVCodecContext *avctx); >> +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx); >> int ff_nvdec_simple_end_frame(AVCodecContext *avctx); >> int ff_nvdec_simple_decode_slice(AVCodecContext *avctx, const uint8_t *buffer, >> uint32_t size); >> diff --git a/libavcodec/nvdec_mjpeg.c b/libavcodec/nvdec_mjpeg.c >> index 850634bf1a..adef21b0f7 100644 >> --- a/libavcodec/nvdec_mjpeg.c >> +++ b/libavcodec/nvdec_mjpeg.c >> @@ -80,6 +80,6 @@ const FFHWAccel ff_mjpeg_nvdec_hwaccel = { >> .decode_slice = nvdec_mjpeg_decode_slice, >> .frame_params = nvdec_mjpeg_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> diff --git a/libavcodec/nvdec_mpeg12.c b/libavcodec/nvdec_mpeg12.c >> index a4603c7ea7..5d100a46ba 100644 >> --- a/libavcodec/nvdec_mpeg12.c >> +++ b/libavcodec/nvdec_mpeg12.c >> @@ -110,7 +110,7 @@ const FFHWAccel ff_mpeg2_nvdec_hwaccel = { >> .decode_slice = ff_nvdec_simple_decode_slice, >> .frame_params = nvdec_mpeg12_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> #endif >> @@ -126,7 +126,7 @@ const FFHWAccel ff_mpeg1_nvdec_hwaccel = { >> .decode_slice = ff_nvdec_simple_decode_slice, >> .frame_params = nvdec_mpeg12_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> #endif >> diff --git a/libavcodec/nvdec_mpeg4.c b/libavcodec/nvdec_mpeg4.c >> index 20a0499437..5a50f7d77f 100644 >> --- a/libavcodec/nvdec_mpeg4.c >> +++ b/libavcodec/nvdec_mpeg4.c >> @@ -120,6 +120,6 @@ const FFHWAccel ff_mpeg4_nvdec_hwaccel = { >> .decode_slice = nvdec_mpeg4_decode_slice, >> .frame_params = nvdec_mpeg4_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> diff --git a/libavcodec/nvdec_vc1.c b/libavcodec/nvdec_vc1.c >> index 5096d784df..e9ab16c63d 100644 >> --- a/libavcodec/nvdec_vc1.c >> +++ b/libavcodec/nvdec_vc1.c >> @@ -124,7 +124,7 @@ const FFHWAccel ff_vc1_nvdec_hwaccel = { >> .decode_slice = ff_nvdec_simple_decode_slice, >> .frame_params = nvdec_vc1_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> >> @@ -139,7 +139,7 @@ const FFHWAccel ff_wmv3_nvdec_hwaccel = { >> .decode_slice = ff_nvdec_simple_decode_slice, >> .frame_params = nvdec_vc1_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> #endif >> diff --git a/libavcodec/nvdec_vp8.c b/libavcodec/nvdec_vp8.c >> index ff3b3f259c..bbea6f1577 100644 >> --- a/libavcodec/nvdec_vp8.c >> +++ b/libavcodec/nvdec_vp8.c >> @@ -101,6 +101,6 @@ const FFHWAccel ff_vp8_nvdec_hwaccel = { >> .decode_slice = ff_nvdec_simple_decode_slice, >> .frame_params = nvdec_vp8_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; >> diff --git a/libavcodec/nvdec_vp9.c b/libavcodec/nvdec_vp9.c >> index e196391c6d..69b12657b6 100644 >> --- a/libavcodec/nvdec_vp9.c >> +++ b/libavcodec/nvdec_vp9.c >> @@ -180,6 +180,6 @@ const FFHWAccel ff_vp9_nvdec_hwaccel = { >> .decode_slice = ff_nvdec_simple_decode_slice, >> .frame_params = nvdec_vp9_frame_params, >> .init = ff_nvdec_decode_init, >> - .uninit = ff_nvdec_decode_uninit, >> + .uninit = ff_nvdec_simple_decode_uninit, >> .priv_data_size = sizeof(NVDECContext), >> }; > > Using a field for both an ownership pointer and as a pure data pointer > is bad and confusing. IMO there should be different pointers for this; > or rather: bitstream is always set and used as data pointer and the > another pointer for ownership which may alias bitstream. In fact, it > looks like this is exactly what bitstream_internal is, it is just not > used by H.264 and HEVC in this manner (they use bitstream for allocated > stuff). Yeah, whereas AV1 is doing it right. Sent a new version with this approach. Thanks for the review. > With the approach outlined above, ff_nvdec_simple_end_frame() might > become obsolete. > > - Andreas > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c index 27be644356..8a7f5c0dac 100644 --- a/libavcodec/nvdec.c +++ b/libavcodec/nvdec.c @@ -274,6 +274,15 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx) return 0; } +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx) +{ + NVDECContext *ctx = avctx->internal->hwaccel_priv_data; + + ctx->bitstream = NULL; + + return ff_nvdec_decode_uninit(avctx); +} + static void nvdec_free_dummy(struct AVHWFramesContext *ctx) { av_buffer_pool_uninit(&ctx->pool); diff --git a/libavcodec/nvdec.h b/libavcodec/nvdec.h index 353e95bf42..83bc1de84c 100644 --- a/libavcodec/nvdec.h +++ b/libavcodec/nvdec.h @@ -73,6 +73,7 @@ int ff_nvdec_decode_uninit(AVCodecContext *avctx); int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame); int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_sep_ref); int ff_nvdec_end_frame(AVCodecContext *avctx); +int ff_nvdec_simple_decode_uninit(AVCodecContext *avctx); int ff_nvdec_simple_end_frame(AVCodecContext *avctx); int ff_nvdec_simple_decode_slice(AVCodecContext *avctx, const uint8_t *buffer, uint32_t size); diff --git a/libavcodec/nvdec_mjpeg.c b/libavcodec/nvdec_mjpeg.c index 850634bf1a..adef21b0f7 100644 --- a/libavcodec/nvdec_mjpeg.c +++ b/libavcodec/nvdec_mjpeg.c @@ -80,6 +80,6 @@ const FFHWAccel ff_mjpeg_nvdec_hwaccel = { .decode_slice = nvdec_mjpeg_decode_slice, .frame_params = nvdec_mjpeg_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; diff --git a/libavcodec/nvdec_mpeg12.c b/libavcodec/nvdec_mpeg12.c index a4603c7ea7..5d100a46ba 100644 --- a/libavcodec/nvdec_mpeg12.c +++ b/libavcodec/nvdec_mpeg12.c @@ -110,7 +110,7 @@ const FFHWAccel ff_mpeg2_nvdec_hwaccel = { .decode_slice = ff_nvdec_simple_decode_slice, .frame_params = nvdec_mpeg12_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; #endif @@ -126,7 +126,7 @@ const FFHWAccel ff_mpeg1_nvdec_hwaccel = { .decode_slice = ff_nvdec_simple_decode_slice, .frame_params = nvdec_mpeg12_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; #endif diff --git a/libavcodec/nvdec_mpeg4.c b/libavcodec/nvdec_mpeg4.c index 20a0499437..5a50f7d77f 100644 --- a/libavcodec/nvdec_mpeg4.c +++ b/libavcodec/nvdec_mpeg4.c @@ -120,6 +120,6 @@ const FFHWAccel ff_mpeg4_nvdec_hwaccel = { .decode_slice = nvdec_mpeg4_decode_slice, .frame_params = nvdec_mpeg4_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; diff --git a/libavcodec/nvdec_vc1.c b/libavcodec/nvdec_vc1.c index 5096d784df..e9ab16c63d 100644 --- a/libavcodec/nvdec_vc1.c +++ b/libavcodec/nvdec_vc1.c @@ -124,7 +124,7 @@ const FFHWAccel ff_vc1_nvdec_hwaccel = { .decode_slice = ff_nvdec_simple_decode_slice, .frame_params = nvdec_vc1_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; @@ -139,7 +139,7 @@ const FFHWAccel ff_wmv3_nvdec_hwaccel = { .decode_slice = ff_nvdec_simple_decode_slice, .frame_params = nvdec_vc1_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; #endif diff --git a/libavcodec/nvdec_vp8.c b/libavcodec/nvdec_vp8.c index ff3b3f259c..bbea6f1577 100644 --- a/libavcodec/nvdec_vp8.c +++ b/libavcodec/nvdec_vp8.c @@ -101,6 +101,6 @@ const FFHWAccel ff_vp8_nvdec_hwaccel = { .decode_slice = ff_nvdec_simple_decode_slice, .frame_params = nvdec_vp8_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), }; diff --git a/libavcodec/nvdec_vp9.c b/libavcodec/nvdec_vp9.c index e196391c6d..69b12657b6 100644 --- a/libavcodec/nvdec_vp9.c +++ b/libavcodec/nvdec_vp9.c @@ -180,6 +180,6 @@ const FFHWAccel ff_vp9_nvdec_hwaccel = { .decode_slice = ff_nvdec_simple_decode_slice, .frame_params = nvdec_vp9_frame_params, .init = ff_nvdec_decode_init, - .uninit = ff_nvdec_decode_uninit, + .uninit = ff_nvdec_simple_decode_uninit, .priv_data_size = sizeof(NVDECContext), };
If FFHWAccel->end_frame() isn't called before FFHWAccel->uninit(), an attempt to free a stale pointer could take place. Signed-off-by: James Almer <jamrial@gmail.com> --- libavcodec/nvdec.c | 9 +++++++++ libavcodec/nvdec.h | 1 + libavcodec/nvdec_mjpeg.c | 2 +- libavcodec/nvdec_mpeg12.c | 4 ++-- libavcodec/nvdec_mpeg4.c | 2 +- libavcodec/nvdec_vc1.c | 4 ++-- libavcodec/nvdec_vp8.c | 2 +- libavcodec/nvdec_vp9.c | 2 +- 8 files changed, 18 insertions(+), 8 deletions(-)