ipc: fix minor error cleanup issues

The ipc_thread can exit any time, and will free the mp_ipc_ctx when
doing this, leaving a dangling pointer. This was somewhat handled in the
original commit by setting mpctx->ipc_ctx to NULL when the thread
exited, but that was still a race condition.

Handle it by freeing most things after joining the ipc_thread. This
means some resources will not be freed until player exit, but that
should be ok (it's an exceptional error situation).

Also, actually close the pipe FDs in mp_init_ipc() on another error
path.

1 files changed, 8 insertions, 8 deletions

diff --git a/input/ipc.c b/input/ipc.c
index a46ca7407b..872b7718ba 100644
--- a/input/ipc.c
+++ b/input/ipc.c
@@ -719,12 +719,6 @@ done:
     if (ipc_fd >= 0)
         close(ipc_fd);
 
-    close(arg->death_pipe[0]);
-    arg->death_pipe[0] = -1;
-    close(arg->death_pipe[1]);
-    arg->death_pipe[1] = -1;
-
-    talloc_free(arg);
     return NULL;
 }
 
@@ -738,6 +732,7 @@ struct mp_ipc_ctx *mp_init_ipc(struct mp_client_api *client_api,
         .log        = mp_log_new(arg, global->log, "ipc"),
         .client_api = client_api,
         .path       = mp_get_user_path(arg, global, opts->ipc_path),
+        .death_pipe = {-1, -1},
     };
 
     if (opts->input_file && *opts->input_file)
@@ -755,6 +750,8 @@ struct mp_ipc_ctx *mp_init_ipc(struct mp_client_api *client_api,
     return arg;
 
 out:
+    close(arg->death_pipe[0]);
+    close(arg->death_pipe[1]);
     talloc_free(arg);
     return NULL;
 }
@@ -764,7 +761,10 @@ void mp_uninit_ipc(struct mp_ipc_ctx *arg)
     if (!arg)
         return;
 
-    if (arg->death_pipe[1] != -1)
-        write(arg->death_pipe[1], &(char){0}, 1);
+    write(arg->death_pipe[1], &(char){0}, 1);
     pthread_join(arg->thread, NULL);
+
+    close(arg->death_pipe[0]);
+    close(arg->death_pipe[1]);
+    talloc_free(arg);
 }