-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
video: vo_tct: lack check of mpi in draw_image #11840
Comments
Can you share the sample file that triggers this? |
we perform 'software fault injection' on mpv, so sadly we can't provide a sample file, since the bug occurs when system oom.
Line 320 in e7902eb
so we need to check nullptr at cmdline: ./build/mpv --vo=tct /root/output1.mp4 |
Huh. I would have expected it to abort explicitly on failed allocation. That's how talloc works, but I guess this is one of those friction points because of the use of av_buffer_ref. |
I see.
Some of the other VO treat null image as a signal to clear the screen, it seems. But if it's returning null due to |
This is generally odd. Some callers of |
this changes mp_image_new_ref() to handle allocation failure itself instead of doing it at its many call-sites (some of which never checked for failure at all). also remove MP_HANDLE_OOM() from the call sites since this is not necessary anymore. not all the call-sites have been touched, since some of the caller might be relying on `mp_image_new_ref(NULL)` returning NULL. Fixes: mpv-player#11840
this changes mp_image_new_ref() to handle allocation failure itself instead of doing it at its many call-sites (some of which never checked for failure at all). also remove MP_HANDLE_OOM() from the call sites since this is not necessary anymore. not all the call-sites have been touched, since some of the caller might be relying on `mp_image_new_ref(NULL)` returning NULL. Fixes: #11840
this changes mp_image_new_ref() to handle allocation failure itself instead of doing it at its many call-sites (some of which never checked for failure at all). also remove MP_HANDLE_OOM() from the call sites since this is not necessary anymore. not all the call-sites have been touched, since some of the caller might be relying on `mp_image_new_ref(NULL)` returning NULL. Fixes: mpv-player#11840
this changes mp_image_new_ref() to handle allocation failure itself instead of doing it at its many call-sites (some of which never checked for failure at all). also remove MP_HANDLE_OOM() from the call sites since this is not necessary anymore. not all the call-sites have been touched, since some of the caller might be relying on `mp_image_new_ref(NULL)` returning NULL. Fixes: mpv-player#11840
TL;DR
we perform a fuzz on mpv and find this bug.
here lacks a null ptr check on
mpi
, and dereference it directly, then it will crash.mpv/video/out/vo_tct.c
Line 248 in e7902eb
Log file
The text was updated successfully, but these errors were encountered: