avcodec: v4l2_m2m: fix races around freeing data on close

[ffmpeg] / libavcodec / cbs.c

diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c
index 3baa31a4ddd64721300776e73a1974eb976e6162..97ab520c22ae58f0b08da2c20b796a69ecb469b9 100644 (file)
--- a/libavcodec/cbs.c
+++ b/libavcodec/cbs.c
@@ -1,18 +1,18 @@
 /*
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
@@ -39,9 +39,10 @@ static const CodedBitstreamType *cbs_type_table[] = {
 #endif
 };
 
-int ff_cbs_init(CodedBitstreamContext *ctx,
+int ff_cbs_init(CodedBitstreamContext **ctx_ptr,
                 enum AVCodecID codec_id, void *log_ctx)
 {
+    CodedBitstreamContext *ctx;
     const CodedBitstreamType *type;
     int i;
 
@@ -55,27 +56,40 @@ int ff_cbs_init(CodedBitstreamContext *ctx,
     if (!type)
         return AVERROR(EINVAL);
 
+    ctx = av_mallocz(sizeof(*ctx));
+    if (!ctx)
+        return AVERROR(ENOMEM);
+
     ctx->log_ctx = log_ctx;
     ctx->codec   = type;
 
     ctx->priv_data = av_mallocz(ctx->codec->priv_data_size);
-    if (!ctx->priv_data)
+    if (!ctx->priv_data) {
+        av_freep(&ctx);
         return AVERROR(ENOMEM);
+    }
 
     ctx->decompose_unit_types = NULL;
 
     ctx->trace_enable = 0;
     ctx->trace_level  = AV_LOG_TRACE;
 
+    *ctx_ptr = ctx;
     return 0;
 }
 
-void ff_cbs_close(CodedBitstreamContext *ctx)
+void ff_cbs_close(CodedBitstreamContext **ctx_ptr)
 {
+    CodedBitstreamContext *ctx = *ctx_ptr;
+
+    if (!ctx)
+        return;
+
     if (ctx->codec && ctx->codec->close)
         ctx->codec->close(ctx);
 
     av_freep(&ctx->priv_data);
+    av_freep(ctx_ptr);
 }
 
 static void cbs_unit_uninit(CodedBitstreamContext *ctx,
@@ -123,10 +137,10 @@ static int cbs_read_fragment_content(CodedBitstreamContext *ctx,
         if (err == AVERROR(ENOSYS)) {
             av_log(ctx->log_ctx, AV_LOG_WARNING,
                    "Decomposition unimplemented for unit %d "
-                   "(type %d).\n", i, frag->units[i].type);
+                   "(type %"PRIu32").\n", i, frag->units[i].type);
         } else if (err < 0) {
             av_log(ctx->log_ctx, AV_LOG_ERROR, "Failed to read unit %d "
-                   "(type %d).\n", i, frag->units[i].type);
+                   "(type %"PRIu32").\n", i, frag->units[i].type);
             return err;
         }
     }
@@ -211,7 +225,7 @@ int ff_cbs_write_fragment_data(CodedBitstreamContext *ctx,
         err = ctx->codec->write_unit(ctx, &frag->units[i]);
         if (err < 0) {
             av_log(ctx->log_ctx, AV_LOG_ERROR, "Failed to write unit %d "
-                   "(type %d).\n", i, frag->units[i].type);
+                   "(type %"PRIu32").\n", i, frag->units[i].type);
             return err;
         }
     }
@@ -304,25 +318,25 @@ void ff_cbs_trace_syntax_element(CodedBitstreamContext *ctx, int position,
            position, name, pad, bits, value);
 }
 
-int ff_cbs_read_unsigned(CodedBitstreamContext *ctx, BitstreamContext *bc,
+int ff_cbs_read_unsigned(CodedBitstreamContext *ctx, GetBitContext *gbc,
                          int width, const char *name, uint32_t *write_to,
                          uint32_t range_min, uint32_t range_max)
 {
     uint32_t value;
     int position;
 
-    av_assert0(width <= 32);
+    av_assert0(width > 0 && width <= 32);
 
-    if (bitstream_bits_left(bc) < width) {
+    if (get_bits_left(gbc) < width) {
         av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid value at "
                "%s: bitstream ended.\n", name);
         return AVERROR_INVALIDDATA;
     }
 
     if (ctx->trace_enable)
-        position = bitstream_tell(bc);
+        position = get_bits_count(gbc);
 
-    value = bitstream_read(bc, width);
+    value = get_bits_long(gbc, width);
 
     if (ctx->trace_enable) {
         char bits[33];
@@ -349,7 +363,7 @@ int ff_cbs_write_unsigned(CodedBitstreamContext *ctx, PutBitContext *pbc,
                           int width, const char *name, uint32_t value,
                           uint32_t range_min, uint32_t range_max)
 {
-    av_assert0(width <= 32);
+    av_assert0(width > 0 && width <= 32);
 
     if (value < range_min || value > range_max) {
         av_log(ctx->log_ctx, AV_LOG_ERROR, "%s out of range: "
@@ -407,7 +421,8 @@ static int cbs_insert_unit(CodedBitstreamContext *ctx,
 
 int ff_cbs_insert_unit_content(CodedBitstreamContext *ctx,
                                CodedBitstreamFragment *frag,
-                               int position, uint32_t type,
+                               int position,
+                               CodedBitstreamUnitType type,
                                void *content)
 {
     int err;
@@ -429,7 +444,8 @@ int ff_cbs_insert_unit_content(CodedBitstreamContext *ctx,
 
 int ff_cbs_insert_unit_data(CodedBitstreamContext *ctx,
                             CodedBitstreamFragment *frag,
-                            int position, uint32_t type,
+                            int position,
+                            CodedBitstreamUnitType type,
                             uint8_t *data, size_t data_size)
 {
     int err;