vo: make mp_frame_perf thread safe

It was unsafe to return pointer to memory that was freed on another
thread, just copy the string to caller owned sturcture.

Fixes crashes when displaying passes stats with gpu-next.

3 files changed, 7 insertions, 7 deletions

diff --git a/video/out/gpu/video.c b/video/out/gpu/video.c
index dbe138c009..0994548034 100644
--- a/video/out/gpu/video.c
+++ b/video/out/gpu/video.c
@@ -3580,7 +3580,9 @@ static void frame_perf_data(struct pass_info pass[], struct mp_frame_perf *out)
         if (!pass[i].desc.len)
             break;
         out->perf[out->count] = pass[i].perf;
-        out->desc[out->count] = pass[i].desc.start;
+        strncpy(out->desc[out->count], pass[i].desc.start,
+                sizeof(out->desc[out->count]) - 1);
+        out->desc[out->count][sizeof(out->desc[out->count]) - 1] = '\0';
         out->count++;
     }
 }
diff --git a/video/out/vo.h b/video/out/vo.h
index 55c55df15e..085658f3dc 100644
--- a/video/out/vo.h
+++ b/video/out/vo.h
@@ -164,14 +164,12 @@ struct mp_pass_perf {
 };
 
 #define VO_PASS_PERF_MAX 64
+#define VO_PASS_DESC_MAX_LEN 128
 
 struct mp_frame_perf {
     int count;
     struct mp_pass_perf perf[VO_PASS_PERF_MAX];
-    // The owner of this struct does not have ownership over the names, and
-    // they may change at any time - so this struct should not be stored
-    // anywhere or the results reused
-    char *desc[VO_PASS_PERF_MAX];
+    char desc[VO_PASS_PERF_MAX][VO_PASS_DESC_MAX_LEN];
 };
 
 struct voctrl_performance_data {
diff --git a/video/out/vo_gpu_next.c b/video/out/vo_gpu_next.c
index 9158479a7c..e37b8cb36e 100644
--- a/video/out/vo_gpu_next.c
+++ b/video/out/vo_gpu_next.c
@@ -769,8 +769,8 @@ static void info_callback(void *priv, const struct pl_render_info *info)
     perf->peak = pass->peak;
     perf->avg = pass->average;
 
-    talloc_free(frame->desc[index]);
-    frame->desc[index] = talloc_strdup(p, pass->shader->description);
+    strncpy(frame->desc[index], pass->shader->description, sizeof(frame->desc[index]) - 1);
+    frame->desc[index][sizeof(frame->desc[index]) - 1] = '\0';
     frame->count = index + 1;
 
     pthread_mutex_unlock(&p->perf_lock);