summaryrefslogtreecommitdiffstats
path: root/sub
diff options
context:
space:
mode:
authorwm4 <wm4@nowhere>2012-08-04 22:18:58 +0200
committerwm4 <wm4@nowhere>2012-08-04 22:22:37 +0200
commita62b9cf7a3693ef99cddc2d0d1b2d80b89ab2e2e (patch)
treedbdaecb1dc93b090390c95ec316c2ae2c185457a /sub
parentf7e9c15c7babadc23bd6deeb340925e6eb2a6776 (diff)
downloadmpv-a62b9cf7a3693ef99cddc2d0d1b2d80b89ab2e2e.tar.bz2
mpv-a62b9cf7a3693ef99cddc2d0d1b2d80b89ab2e2e.tar.xz
osd: free buffer allocated with av_malloc with av_free
free() was used before, which could in theory lead to crashes if the OSD buffer was freed or resized. (Whether using free() actually works depends on what function libavutil's av_malloc() uses internally. On Linux, it seems to use memalign(), which uses free() as counterpart for deallocation, so the bug never triggered for me.)
Diffstat (limited to 'sub')
-rw-r--r--sub/sub.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sub/sub.c b/sub/sub.c
index cc0407ea1c..731bec3565 100644
--- a/sub/sub.c
+++ b/sub/sub.c
@@ -99,8 +99,8 @@ void osd_alloc_buf(mp_osd_obj_t* obj)
len = obj->stride*(obj->bbox.y2-obj->bbox.y1);
if (obj->allocated<len) {
obj->allocated = len;
- free(obj->bitmap_buffer);
- free(obj->alpha_buffer);
+ av_free(obj->bitmap_buffer);
+ av_free(obj->alpha_buffer);
obj->bitmap_buffer = av_malloc(len);
obj->alpha_buffer = av_malloc(len);
}
@@ -211,8 +211,8 @@ void osd_free(struct osd_state *osd)
mp_osd_obj_t* obj=vo_osd_list;
while(obj){
mp_osd_obj_t* next=obj->next;
- free(obj->alpha_buffer);
- free(obj->bitmap_buffer);
+ av_free(obj->alpha_buffer);
+ av_free(obj->bitmap_buffer);
free(obj);
obj=next;
}