dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-12 22:16:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

hwcontext_vulkan: fix double free when vulkan_map_to_drm fails

Browse Source 
The multiplanar image with storage_bit enabled fails to be exported
to DMA-BUF on the QCOM turnip driver, thus triggering this double-free issue.

```
[Parsed_hwmap_2 @ 0xffff5c002a70] Configure hwmap vulkan -> drm_prime.
[hwmap @ 0xffff5c001180] Filter input: vulkan, 1920x1080 (0).
[AVHWFramesContext @ 0xffff5c004e00] Unable to export the image as a FD!
free(): double free detected in tcache 2
Aborted
```

Additionally, add back an av_unused attribute. Otherwise, the compiler
will complain about unused variables when CUDA is not enabled.

Signed-off-by: nyanmisaka <nst799610810@gmail.com>
This commit is contained in:
nyanmisaka
2026-04-12 20:50:38 +08:00
parent 56b97c03d4
commit ab7b6ef0a2
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavutil/hwcontext_vulkan.c
View File

@@ -4248,7 +4248,7 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc, AVFrame *dst,
.sType = VK_STRUCTURE_TYPE_IMAGE_DRM_FORMAT_MODIFIER_PROPERTIES_EXT,
};
const int nb_sems = nb_images;
int free_drm_desc_on_err = 1;
int sync_fd = -1;
AVDRMFrameDescriptor *drm_desc = av_mallocz(sizeof(*drm_desc));
@@ -4286,6 +4286,9 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc, AVFrame *dst,
if (err < 0)
goto end;
/* It will be freed in ff_hwframe_map_create callback */
free_drm_desc_on_err = 0;
ret = vk->GetImageDrmFormatModifierPropertiesEXT(hwctx->act_dev, f->img[0],
&drm_mod);
if (ret != VK_SUCCESS) {
@@ -4386,7 +4389,8 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc, AVFrame *dst,
end:
for (int i = 0; i < drm_desc->nb_objects; i++)
close(drm_desc->objects[i].fd);
av_free(drm_desc);
if (free_drm_desc_on_err)
av_free(drm_desc);
if (sync_fd >= 0)
close(sync_fd);
return err;
@@ -4868,7 +4872,7 @@ end:
static int vulkan_transfer_data_to(AVHWFramesContext *hwfc, AVFrame *dst,
const AVFrame *src)
{
VulkanDevicePriv *p = hwfc->device_ctx->hwctx;
av_unused VulkanDevicePriv *p = hwfc->device_ctx->hwctx;
switch (src->format) {
#if CONFIG_CUDA