openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File mpv_PR6741.patch of Package mpv (Revision 347002b14ab3859f4eb3ef505580f796)

Currently displaying revision 347002b14ab3859f4eb3ef505580f796 , Show latest

From 9db6f76b1d5e6491edf2b78f35772edc1beaac2e Mon Sep 17 00:00:00 2001
From: wnoun <wnoun@outlook.com>
Date: Sun, 26 May 2019 16:58:25 +0800
Subject: [PATCH] render api: fix use-after-free

render api needs to wait for vo to be destroyed before frees the context. The purpose of kill_cb is to wake up render api after vo is destroyed, but uninit did that before kill_cb, so kill_cb tries using the freed memory. Remove kill_cb to fix the issue as uninit is able to do the work.
---
 player/client.c       | 22 +++-------------------
 player/client.h       |  3 +--
 video/out/vo_libmpv.c | 14 ++------------
 3 files changed, 6 insertions(+), 33 deletions(-)

diff --git a/player/client.c b/player/client.c
index 03e0cbfeb6..e369d53ed0 100644
--- a/player/client.c
+++ b/player/client.c
@@ -1813,16 +1813,9 @@ int64_t mpv_get_time_us(mpv_handle *ctx)
 
 #include "video/out/libmpv.h"
 
-struct kill_ctx {
-    struct MPContext *mpctx;
-    void (*fin)(void *ctx);
-    void *fin_ctx;
-};
-
 static void do_kill(void *ptr)
 {
-    struct kill_ctx *k = ptr;
-    struct MPContext *mpctx = k->mpctx;
+    struct MPContext *mpctx = ptr;
 
     struct track *track = mpctx->vo_chain ? mpctx->vo_chain->track : NULL;
     uninit_video_out(mpctx);
@@ -1830,22 +1823,13 @@ static void do_kill(void *ptr)
         mpctx->error_playing = MPV_ERROR_VO_INIT_FAILED;
         error_on_track(mpctx, track);
     }
-
-    k->fin(k->fin_ctx);
 }
 
 // Used by vo_libmpv to (a)synchronously uninitialize video.
-void kill_video_async(struct mp_client_api *client_api, void (*fin)(void *ctx),
-                      void *fin_ctx)
+void kill_video_async(struct mp_client_api *client_api)
 {
     struct MPContext *mpctx = client_api->mpctx;
-    struct kill_ctx *k = talloc_ptrtype(NULL, k);
-    *k = (struct kill_ctx){
-        .mpctx = mpctx,
-        .fin = fin,
-        .fin_ctx = fin_ctx,
-    };
-    mp_dispatch_enqueue_autofree(mpctx->dispatch, do_kill, k);
+    mp_dispatch_enqueue(mpctx->dispatch, do_kill, mpctx);
 }
 
 // Used by vo_libmpv to set the current render context.
diff --git a/player/client.h b/player/client.h
index 7426e94372..e9e8665e70 100644
--- a/player/client.h
+++ b/player/client.h
@@ -49,8 +49,7 @@ bool mp_set_main_render_context(struct mp_client_api *client_api,
                                 struct mpv_render_context *ctx, bool active);
 struct mpv_render_context *
 mp_client_api_acquire_render_context(struct mp_client_api *ca);
-void kill_video_async(struct mp_client_api *client_api, void (*fin)(void *ctx),
-                      void *fin_ctx);
+void kill_video_async(struct mp_client_api *client_api);
 
 bool mp_streamcb_lookup(struct mpv_global *g, const char *protocol,
                         void **out_user_data, mpv_stream_cb_open_ro_fn *out_fn);
diff --git a/video/out/vo_libmpv.c b/video/out/vo_libmpv.c
index 1c2a8acba0..3caa457e17 100644
--- a/video/out/vo_libmpv.c
+++ b/video/out/vo_libmpv.c
@@ -245,16 +245,6 @@ void mp_render_context_set_control_callback(mpv_render_context *ctx,
     pthread_mutex_unlock(&ctx->control_lock);
 }
 
-static void kill_cb(void *ptr)
-{
-    struct mpv_render_context *ctx = ptr;
-
-    pthread_mutex_lock(&ctx->update_lock);
-    ctx->had_kill_update = true;
-    pthread_cond_broadcast(&ctx->update_cond);
-    pthread_mutex_unlock(&ctx->update_lock);
-}
-
 void mpv_render_context_free(mpv_render_context *ctx)
 {
     if (!ctx)
@@ -269,7 +259,7 @@ void mpv_render_context_free(mpv_render_context *ctx)
     // context. The above removal guarantees it can't come back (so ctx->vo
     // can't change to non-NULL).
     if (atomic_load(&ctx->in_use)) {
-        kill_video_async(ctx->client_api, kill_cb, ctx);
+        kill_video_async(ctx->client_api);
 
         while (atomic_load(&ctx->in_use)) {
             // As long as the video decoders are not destroyed, they can still
@@ -279,7 +269,7 @@ void mpv_render_context_free(mpv_render_context *ctx)
             if (ctx->dispatch)
                 mp_dispatch_queue_process(ctx->dispatch, 0);
 
-            // Wait for kill_cb() or update() calls.
+            // Wait for update() calls.
             pthread_mutex_lock(&ctx->update_lock);
             if (!ctx->had_kill_update)
                 pthread_cond_wait(&ctx->update_cond, &ctx->update_lock);

Places

File mpv_PR6741.patch of Package mpv (Revision 347002b14ab3859f4eb3ef505580f796)

Places