summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVíctor Manuel Jáquez Leal <vjaquez@igalia.com>2019-12-17 16:49:47 +0100
committerVíctor Manuel Jáquez Leal <vjaquez@igalia.com>2019-12-17 18:31:29 +0100
commit47b0932911bc7b7043e16355ba39c722c0289029 (patch)
treed282a8fe30948393cceacdc3e19f81c766abd97a
parent6ecbb8d100cc3ac71f2d52191c8a6527bc35498d (diff)
libs: encoder: h264fei: don't free memory on stack
Issue detected by Coverity `info_to_pak` variable in gst_vaapi_encoder_h264_fei_encode() is declared in the stack, but it is free in gst_vaapi_feienc_h264_encode() as if declared on the heap. This patch initializes the structure and removes the free. A non-heap pointer is placed on the free list, likely causing a crash later. In gst_vaapi_encoder_h264_fei_encode: Free of an address-of expression, which can never be heap allocated.
-rw-r--r--gst-libs/gst/vaapi/gstvaapiencoder_h264_fei.c2
-rw-r--r--gst-libs/gst/vaapi/gstvaapifeienc_h264.c1
2 files changed, 1 insertions, 2 deletions
diff --git a/gst-libs/gst/vaapi/gstvaapiencoder_h264_fei.c b/gst-libs/gst/vaapi/gstvaapiencoder_h264_fei.c
index f5d74a6e..e0fbe505 100644
--- a/gst-libs/gst/vaapi/gstvaapiencoder_h264_fei.c
+++ b/gst-libs/gst/vaapi/gstvaapiencoder_h264_fei.c
@@ -2741,7 +2741,7 @@ gst_vaapi_encoder_h264_fei_encode (GstVaapiEncoder * base_encoder,
GstVaapiEncoderStatus status = GST_VAAPI_ENCODER_STATUS_ERROR_UNKNOWN;
GstVaapiSurfaceProxy *reconstruct = NULL;
GstVaapiEncPicture *picture2 = NULL;
- GstVaapiFeiInfoToPakH264 info_to_pak;
+ GstVaapiFeiInfoToPakH264 info_to_pak = { {0} };
reconstruct = gst_vaapi_encoder_create_surface (base_encoder);
diff --git a/gst-libs/gst/vaapi/gstvaapifeienc_h264.c b/gst-libs/gst/vaapi/gstvaapifeienc_h264.c
index 67fcfbee..ab8642a5 100644
--- a/gst-libs/gst/vaapi/gstvaapifeienc_h264.c
+++ b/gst-libs/gst/vaapi/gstvaapifeienc_h264.c
@@ -1403,7 +1403,6 @@ gst_vaapi_feienc_h264_encode (GstVaapiEncoder * base_encoder,
return GST_VAAPI_ENCODER_STATUS_SUCCESS;
error:
- g_slice_free (GstVaapiFeiInfoToPakH264, info_to_pak);
return ret;
}