From patchwork Thu Sep 17 00:08:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 22449 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id AB113449222 for ; Thu, 17 Sep 2020 03:08:31 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 728E068BAA4; Thu, 17 Sep 2020 03:08:31 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm1-f68.google.com (mail-wm1-f68.google.com [209.85.128.68]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C666868BA70 for ; Thu, 17 Sep 2020 03:08:24 +0300 (EEST) Received: by mail-wm1-f68.google.com with SMTP id s13so231838wmh.4 for ; Wed, 16 Sep 2020 17:08:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=1SWO4AKP1j23Lpe6XYWNlI5ILGy7Sj9JGglc+mT42tk=; b=cdtj6l6w7WCKBavWlTdbW5NCU5S/mBmDIGaJGn6/HN9FpU5FLZ+DfI12LMZb7oiCp4 aUpeBDTmNqBp1lmbOmB2niM91NpI1bo0YlSE7Ef1JJmXipwcwDnYENkMgn1gaWYuLq6r 1+XZqC1bgKfVI44/a2tisrX+jc1wAtd+fbo1vHGqKHMDMiNPdZlvftNhQwS/ef8apA7y EuJ8AN108atnTYFtVtk8yCiqIf/QaY/fWcwAyl9VdaTyovSvHetKFqXtDV2U8bamPbl9 Jvw3vatooSGe4gwVrCuK1uByyAw7n6LW0HgPbTL0vX/sP2C64lxZwnvkWi4rCU7OkRIN N2rA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=1SWO4AKP1j23Lpe6XYWNlI5ILGy7Sj9JGglc+mT42tk=; b=p0hNM0V1A0iTSBSByBVmSx7WRPBbDjYithwB+0GcZKRYjXzUyI4u7bnURZKS/wz6oj h4zfjJkRlgTGQKCcMG74nDoFPCfYFw1VEVaVvqKqxCHTcPJMtGBfmoh6deYJzBVXbVr5 /FMen6way+6J4cDJlueN4CUjdBSgcSA0J0Od2l7SsI/T8l4/fFFwyRPGhyHfKRH2SOdV C7tGmtcrgAqac1aPRD81wL3XgJi2/AlTsNha+Jo7rl2vxxDo0ZWiHFk1K1iCvG3SKir/ BsPp4wsFUSg0fziSqahm9/usGm6eMTMmorIy8tynOUvtUd49gFJTIljw+3dfJVcMkSc5 NNFw== X-Gm-Message-State: AOAM533VmFniQKvUipVghMR3qhk+FA9UFNWV9FjfyDsVobnuCRH87u5s fIlNAIhKUK48UdBECyKsfhlZkAQRdjY= X-Google-Smtp-Source: ABdhPJy9eJq77l8+i7bJe7NyknXS7HqqZwx8IFM2fbQx+5959NM0uOXDgKmxRia6WWzMgjR/SoyWig== X-Received: by 2002:a1c:e4c5:: with SMTP id b188mr6215415wmh.67.1600301303858; Wed, 16 Sep 2020 17:08:23 -0700 (PDT) Received: from sblaptop.fritz.box (ipbcc1fb0f.dynamic.kabel-deutschland.de. [188.193.251.15]) by smtp.gmail.com with ESMTPSA id m18sm7941327wmg.32.2020.09.16.17.08.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Sep 2020 17:08:22 -0700 (PDT) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Thu, 17 Sep 2020 02:08:15 +0200 Message-Id: <20200917000816.497453-1-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2 1/2] avcodec/av1dec: Fix segfault upon allocation error X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Up until now, the AV1 decoder always checks before calling its wrapper around ff_thread_release_buffer() whether the ThreadFrame was used at all, i.e. it checked whether the first data buffer of the AVFrame contained therein is NULL or not. Yet this presumes that the AVFrame has been successfully allocated, even though this can of course fail; and if it did, one would encounter a segfault. Fix this by removing the checks altogether: ff_thread_release_buffer() can handle both unallocated as well as empty frames (since commit f6774f905fb3cfdc319523ac640be30b14c1bc55). Signed-off-by: Andreas Rheinhardt --- Removing the checks is based upon a suggestion by James Almer. I have not removed the checks from the other callers of av1_frame_unref() as I don't know how probable it is for the frame to be empty at this point. I tested this as well as I can, but I have no hardware with AV1 hardware acceleration. libavcodec/av1dec.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c index bd8acdaafe..871db76b4d 100644 --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -388,12 +388,10 @@ static av_cold int av1_decode_free(AVCodecContext *avctx) AV1DecContext *s = avctx->priv_data; for (int i = 0; i < FF_ARRAY_ELEMS(s->ref); i++) { - if (s->ref[i].tf.f->buf[0]) - av1_frame_unref(avctx, &s->ref[i]); + av1_frame_unref(avctx, &s->ref[i]); av_frame_free(&s->ref[i].tf.f); } - if (s->cur_frame.tf.f->buf[0]) - av1_frame_unref(avctx, &s->cur_frame); + av1_frame_unref(avctx, &s->cur_frame); av_frame_free(&s->cur_frame.tf.f); av_buffer_unref(&s->seq_ref); From patchwork Thu Sep 17 00:08:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 22450 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id C9CAD449222 for ; Thu, 17 Sep 2020 03:08:47 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B4D0668BAE2; Thu, 17 Sep 2020 03:08:47 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wr1-f65.google.com (mail-wr1-f65.google.com [209.85.221.65]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 2F38968BACE for ; Thu, 17 Sep 2020 03:08:41 +0300 (EEST) Received: by mail-wr1-f65.google.com with SMTP id x14so97003wrl.12 for ; Wed, 16 Sep 2020 17:08:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=+xUCP/g2wMd3Z7yLGLC0sL6BpLm02Yn8X/HIy8F8Rcs=; b=RfTsG7XgtQItHir1aur8UgJwo+TETq8m6qeZW8JXH5bVr6FJTl6Clzd79yyHuOTeJ+ PJkgIbhm8U+bgZK27uLE+P/ZvOLhUXps17ZMBrZszpfUZG+V2EaUDU73AUKW/JwE22Rx 1wGeQ5X9VdAF2In7Jro0QI3w072hIP5YDDRl4qx+WrFvjL0WDGUxr/HIJgfdTA8OOmEY dAdg6ZjIvXS2pff2B54M87dsI6p2TZFlTNc2jx8BMg+Dq91wZ+PQxB0WwNpzk4lG+6vh MOcFcYqqeA+zSgfj0fvAZ9fzt+sDFOSMnrH/FUvGa6+kgf8uLJhs/CzF+IyAc2Zs/ofe P97w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=+xUCP/g2wMd3Z7yLGLC0sL6BpLm02Yn8X/HIy8F8Rcs=; b=fXl6psS2W5hulARK3b67mecyHtiYJXQcQTcDGl7Lky+smpxgFB3A9rprWpAzHMq+dr //gSJkkrvn9Wx214sMrH481WnUlOSem79KcKTYuZi99HTDhH2QT1+A8aO3od51sgMwlQ WG3QWU2HuWD6ZuUPLKpy3IVRx2IB5YMh0vM2d3KoBQq0NrqjkFWo4u0/oz9BBREjZVDX 1NE9DGQtMigXU3Z8oveUGJwT4+HQT31CTo1fSkXDOnt1AsXNfP0FxW52/tZAvOfPbqsO M+cXMoRrQDGm9H8d/obRowAerILNXliWpo8I7yYJDXtdUIS7JAjqv9jzQMG5Citnh0LC LHIA== X-Gm-Message-State: AOAM533DmPudC42mDsXbj9iJGpIVd+ekPgNMN9V8x3wLpxSB9Tw9hMbG PmXsIlHAD2nJzK1Gz81Yksijimy9MPg= X-Google-Smtp-Source: ABdhPJxNlC5DAyj4PB3r/ymZRSF8wPmsyaU5xxr2YVWDGDcKXzjnBVGE/ek06dyGGl/nEpcp6C4dXg== X-Received: by 2002:adf:ab46:: with SMTP id r6mr27194758wrc.360.1600301320243; Wed, 16 Sep 2020 17:08:40 -0700 (PDT) Received: from sblaptop.fritz.box (ipbcc1fb0f.dynamic.kabel-deutschland.de. [188.193.251.15]) by smtp.gmail.com with ESMTPSA id m18sm7941327wmg.32.2020.09.16.17.08.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Sep 2020 17:08:39 -0700 (PDT) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Thu, 17 Sep 2020 02:08:17 +0200 Message-Id: <20200917000816.497453-2-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200917000816.497453-1-andreas.rheinhardt@gmail.com> References: <20200917000816.497453-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2 2/2] avcodec/av1dec: Remove redundant second free X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" The AV1 decoder has the FF_CODEC_CAP_INIT_CLEANUP flag set and yet the decoder's close function is called manually on some error paths. This is unnecessary and has been removed in this commit. Signed-off-by: Andreas Rheinhardt --- Unchanged since last time. libavcodec/av1dec.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c index 871db76b4d..cb46801202 100644 --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -480,7 +480,6 @@ static av_cold int av1_decode_init(AVCodecContext *avctx) for (int i = 0; i < FF_ARRAY_ELEMS(s->ref); i++) { s->ref[i].tf.f = av_frame_alloc(); if (!s->ref[i].tf.f) { - av1_decode_free(avctx); av_log(avctx, AV_LOG_ERROR, "Failed to allocate reference frame buffer %d.\n", i); return AVERROR(ENOMEM); @@ -489,7 +488,6 @@ static av_cold int av1_decode_init(AVCodecContext *avctx) s->cur_frame.tf.f = av_frame_alloc(); if (!s->cur_frame.tf.f) { - av1_decode_free(avctx); av_log(avctx, AV_LOG_ERROR, "Failed to allocate current frame buffer.\n"); return AVERROR(ENOMEM); @@ -504,7 +502,7 @@ static av_cold int av1_decode_init(AVCodecContext *avctx) avctx->extradata_size); if (ret < 0) { av_log(avctx, AV_LOG_WARNING, "Failed to read extradata.\n"); - goto end; + return ret; } seq = ((CodedBitstreamAV1Context *)(s->cbc->priv_data))->sequence_header;