avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects
authorAaron Levinson <alevinsn@aracnet.com>
Tue, 16 May 2017 12:04:36 +0000 (05:04 -0700)
committerMark Thompson <sw@jkqxz.net>
Tue, 16 May 2017 20:45:52 +0000 (21:45 +0100)
commit0c1c514643d5e1645160d697fa4c27cd38c7c791
tree9f12f38c010f7b4615639a37c9e02ac9374910f5
parent605c5ca3123a051cfb37ad52f608ffd2f6a91abf
avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects

Add dxva2_pool_release_dummy() and use it in call to
av_buffer_create() in dxva2_pool_alloc().

Prior to this change, av_buffer_create() was called with NULL for the
third argument, which indicates that av_buffer_default_free() should
be used to free the buffer's data.  Eventually, it gets to
buffer_pool_free() and calls buf->free() on a surface object (which is
av_buffer_default_free()).

This can result in a crash when the debug version of the C-runtime is
used on Windows.  While it doesn't appear to result in a crash when
the release version of the C-runtime is used on Windows, it likely
results in memory corruption, since av_free() is being called on
memory that was allocated using
IDirectXVideoAccelerationService::CreateSurface().

Signed-off-by: Aaron Levinson <alevinsn@aracnet.com>
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Reviewed-by: Mark Thompson <sw@jkqxz.net>
libavutil/hwcontext_dxva2.c