This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new ab7b6ef0a2 hwcontext_vulkan: fix double free when vulkan_map_to_drm
fails
ab7b6ef0a2 is described below
commit ab7b6ef0a2c54c363abcb87b0df7b6f71d256f08
Author: nyanmisaka <[email protected]>
AuthorDate: Sun Apr 12 20:50:38 2026 +0800
Commit: nyanmisaka <[email protected]>
CommitDate: Sun Apr 12 20:50:38 2026 +0800
hwcontext_vulkan: fix double free when vulkan_map_to_drm fails
The multiplanar image with storage_bit enabled fails to be exported
to DMA-BUF on the QCOM turnip driver, thus triggering this double-free
issue.
```
[Parsed_hwmap_2 @ 0xffff5c002a70] Configure hwmap vulkan -> drm_prime.
[hwmap @ 0xffff5c001180] Filter input: vulkan, 1920x1080 (0).
[AVHWFramesContext @ 0xffff5c004e00] Unable to export the image as a FD!
free(): double free detected in tcache 2
Aborted
```
Additionally, add back an av_unused attribute. Otherwise, the compiler
will complain about unused variables when CUDA is not enabled.
Signed-off-by: nyanmisaka <[email protected]>
---
libavutil/hwcontext_vulkan.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/libavutil/hwcontext_vulkan.c b/libavutil/hwcontext_vulkan.c
index 16f286d1b8..929f6d9944 100644
--- a/libavutil/hwcontext_vulkan.c
+++ b/libavutil/hwcontext_vulkan.c
@@ -4248,7 +4248,7 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc,
AVFrame *dst,
.sType = VK_STRUCTURE_TYPE_IMAGE_DRM_FORMAT_MODIFIER_PROPERTIES_EXT,
};
const int nb_sems = nb_images;
-
+ int free_drm_desc_on_err = 1;
int sync_fd = -1;
AVDRMFrameDescriptor *drm_desc = av_mallocz(sizeof(*drm_desc));
@@ -4286,6 +4286,9 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc,
AVFrame *dst,
if (err < 0)
goto end;
+ /* It will be freed in ff_hwframe_map_create callback */
+ free_drm_desc_on_err = 0;
+
ret = vk->GetImageDrmFormatModifierPropertiesEXT(hwctx->act_dev, f->img[0],
&drm_mod);
if (ret != VK_SUCCESS) {
@@ -4386,7 +4389,8 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc,
AVFrame *dst,
end:
for (int i = 0; i < drm_desc->nb_objects; i++)
close(drm_desc->objects[i].fd);
- av_free(drm_desc);
+ if (free_drm_desc_on_err)
+ av_free(drm_desc);
if (sync_fd >= 0)
close(sync_fd);
return err;
@@ -4868,7 +4872,7 @@ end:
static int vulkan_transfer_data_to(AVHWFramesContext *hwfc, AVFrame *dst,
const AVFrame *src)
{
- VulkanDevicePriv *p = hwfc->device_ctx->hwctx;
+ av_unused VulkanDevicePriv *p = hwfc->device_ctx->hwctx;
switch (src->format) {
#if CONFIG_CUDA
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
