diff options
author | Aaron Levinson <alevinsn@aracnet.com> | 2017-05-16 05:04:36 -0700 |
---|---|---|
committer | Mark Thompson <sw@jkqxz.net> | 2017-05-16 22:00:48 +0100 |
commit | 19fea7d703b0a7e02860df5fc2e94b826059d64d (patch) | |
tree | 2d4346affde142c091df807e5e371168b2f51cfa /libavformat/movenchint.c | |
parent | c1c50650df6cef69c392ad0d544c30e571e24214 (diff) | |
download | ffmpeg-19fea7d703b0a7e02860df5fc2e94b826059d64d.tar.gz |
avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects
Add dxva2_pool_release_dummy() and use it in call to
av_buffer_create() in dxva2_pool_alloc().
Prior to this change, av_buffer_create() was called with NULL for the
third argument, which indicates that av_buffer_default_free() should
be used to free the buffer's data. Eventually, it gets to
buffer_pool_free() and calls buf->free() on a surface object (which is
av_buffer_default_free()).
This can result in a crash when the debug version of the C-runtime is
used on Windows. While it doesn't appear to result in a crash when
the release version of the C-runtime is used on Windows, it likely
results in memory corruption, since av_free() is being called on
memory that was allocated using
IDirectXVideoAccelerationService::CreateSurface().
Signed-off-by: Aaron Levinson <alevinsn@aracnet.com>
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Reviewed-by: Mark Thompson <sw@jkqxz.net>
(cherry picked from commit 0c1c514643d5e1645160d697fa4c27cd38c7c791)
Diffstat (limited to 'libavformat/movenchint.c')
0 files changed, 0 insertions, 0 deletions