diff options
| author | nanahi <130121847+na-na-hi@users.noreply.github.com> | 2024-02-07 16:07:57 -0500 |
|---|---|---|
| committer | sfan5 <sfan5@live.de> | 2024-02-08 18:16:21 +0100 |
| commit | aa100d1512d371f57d1311033e256c806d7099ca (patch) | |
| tree | 5fee7fda40f6547ed7fdb8465e7c60410b3c4fec /filters/f_output_chain.c | |
| parent | fd2c5ee21d8b5c4d28e8a8fa11d5125610a94810 (diff) | |
| download | mpv-aa100d1512d371f57d1311033e256c806d7099ca.tar.bz2 mpv-aa100d1512d371f57d1311033e256c806d7099ca.tar.xz | |
f_output_chain: prevent double free of child filters
When mp_output_chain_update_filters() fails, talloc_free() is called on
each mp_user_filter. But because the structure doesn't have a talloc
destructor, the args aren't freed, resulting in stale references.
Fix this by calling the destructor of the wrapped filter instead.
Diffstat (limited to 'filters/f_output_chain.c')
| -rw-r--r-- | filters/f_output_chain.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/filters/f_output_chain.c b/filters/f_output_chain.c index ccb4d53af9..ffad932a57 100644 --- a/filters/f_output_chain.c +++ b/filters/f_output_chain.c @@ -627,7 +627,7 @@ bool mp_output_chain_update_filters(struct mp_output_chain *c, error: for (int n = 0; n < num_add; n++) - talloc_free(add[n]); + talloc_free(add[n]->wrapper); talloc_free(add); talloc_free(used); return false; |