Commit patch by cfsworks to fix double-free issue with ffmpeg

This commit is contained in:
rdb 2014-04-16 13:49:53 +00:00
parent 51dffd0f5a
commit caad44773b
2 changed files with 13 additions and 11 deletions

View File

@ -38,7 +38,6 @@ FfmpegVirtualFile() :
_format_context(NULL),
_in(NULL),
_owns_in(false),
_buffer(NULL),
_buffer_size(ffmpeg_read_buffer_size)
{
}
@ -106,8 +105,11 @@ open_vfs(const Filename &filename) {
_start = 0;
_size = vfile->get_file_size(_in);
_buffer = (unsigned char*) av_malloc(_buffer_size);
_io_context = avio_alloc_context(_buffer, _buffer_size, 0, (void*) this,
// NOTE: The AVIO system owns the buffer after allocation and may realloc it
// internally. Therefore, when we're done with the buffer, we use
// _io_context->buffer to deallocate it rather than holding on to this pointer.
unsigned char *buffer = (unsigned char*) av_malloc(_buffer_size);
_io_context = avio_alloc_context(buffer, _buffer_size, 0, (void*) this,
&read_packet, 0, &seek);
_format_context = avformat_alloc_context();
@ -157,8 +159,11 @@ open_subfile(const SubfileInfo &info) {
_in->seekg(_start);
_buffer = (unsigned char*) av_malloc(_buffer_size);
_io_context = avio_alloc_context(_buffer, _buffer_size, 0, (void*) this,
// NOTE: The AVIO system owns the buffer after allocation and may realloc it
// internally. Therefore, when we're done with the buffer, we use
// _io_context->buffer to deallocate it rather than holding on to this pointer.
unsigned char *buffer = (unsigned char*) av_malloc(_buffer_size);
_io_context = avio_alloc_context(buffer, _buffer_size, 0, (void*) this,
&read_packet, 0, &seek);
_format_context = avformat_alloc_context();
@ -197,15 +202,13 @@ close() {
}
if (_io_context != NULL) {
if (_io_context->buffer != NULL) {
av_free(_io_context->buffer);
}
av_free(_io_context);
_io_context = NULL;
}
if (_buffer != NULL) {
av_free(_buffer);
_buffer = NULL;
}
if (_owns_in) {
nassertv(_in != NULL);
VirtualFileSystem::close_read_file(_in);

View File

@ -67,7 +67,6 @@ private:
istream *_in;
pifstream _file_in;
bool _owns_in;
unsigned char *_buffer;
int _buffer_size;
};