diff options
author | wm4 <wm4@nowhere> | 2012-08-04 22:18:58 +0200 |
---|---|---|
committer | wm4 <wm4@nowhere> | 2012-08-04 22:22:37 +0200 |
commit | a62b9cf7a3693ef99cddc2d0d1b2d80b89ab2e2e (patch) | |
tree | dbdaecb1dc93b090390c95ec316c2ae2c185457a /sub | |
parent | f7e9c15c7babadc23bd6deeb340925e6eb2a6776 (diff) | |
download | mpv-a62b9cf7a3693ef99cddc2d0d1b2d80b89ab2e2e.tar.bz2 mpv-a62b9cf7a3693ef99cddc2d0d1b2d80b89ab2e2e.tar.xz |
osd: free buffer allocated with av_malloc with av_free
free() was used before, which could in theory lead to crashes if
the OSD buffer was freed or resized. (Whether using free() actually
works depends on what function libavutil's av_malloc() uses internally.
On Linux, it seems to use memalign(), which uses free() as counterpart
for deallocation, so the bug never triggered for me.)
Diffstat (limited to 'sub')
-rw-r--r-- | sub/sub.c | 8 |
1 files changed, 4 insertions, 4 deletions
@@ -99,8 +99,8 @@ void osd_alloc_buf(mp_osd_obj_t* obj) len = obj->stride*(obj->bbox.y2-obj->bbox.y1); if (obj->allocated<len) { obj->allocated = len; - free(obj->bitmap_buffer); - free(obj->alpha_buffer); + av_free(obj->bitmap_buffer); + av_free(obj->alpha_buffer); obj->bitmap_buffer = av_malloc(len); obj->alpha_buffer = av_malloc(len); } @@ -211,8 +211,8 @@ void osd_free(struct osd_state *osd) mp_osd_obj_t* obj=vo_osd_list; while(obj){ mp_osd_obj_t* next=obj->next; - free(obj->alpha_buffer); - free(obj->bitmap_buffer); + av_free(obj->alpha_buffer); + av_free(obj->bitmap_buffer); free(obj); obj=next; } |