diff options
author | NRK <nrk@disroot.org> | 2023-06-28 07:09:42 +0600 |
---|---|---|
committer | Dudemanguy <random342@airmail.cc> | 2023-06-28 02:10:14 +0000 |
commit | c3781b2d6837389c0eb6af6ad0e1998c0df76bc1 (patch) | |
tree | cf98a844f259c44f0712a072168614e6b0a61e66 /video | |
parent | e7902eb83dc68dcb0adb99568d72bd3f9a4e4550 (diff) | |
download | mpv-c3781b2d6837389c0eb6af6ad0e1998c0df76bc1.tar.bz2 mpv-c3781b2d6837389c0eb6af6ad0e1998c0df76bc1.tar.xz |
vo_drm: fix null dereference and using closed fd
when vo_drm_init() fails inside of preinit(), uninit() will be called as
part of cleanup with vo->drm being NULL and thus `drm->fd` would lead to
null dereference.
and since vo_drm_uninit() closes drm->fd, destroy_framebuffer() ends up
using a closed fd.
according to the drm-gem manpage [0]:
> If you close the DRM file-descriptor, all open dumb-buffers are
> automatically destroyed.
so remove the destroy_framebuffer() loop entirely, which fixes both the
issues.
[0]: https://www.systutorials.com/docs/linux/man/7-drm-gem/
Diffstat (limited to 'video')
-rw-r--r-- | video/out/vo_drm.c | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/video/out/vo_drm.c b/video/out/vo_drm.c index 1b1fe81e05..96d02c5f00 100644 --- a/video/out/vo_drm.c +++ b/video/out/vo_drm.c @@ -382,8 +382,6 @@ static void flip_page(struct vo *vo) static void uninit(struct vo *vo) { struct priv *p = vo->priv; - struct vo_drm_state *drm = vo->drm; - int fd = drm->fd; vo_drm_uninit(vo); @@ -391,9 +389,6 @@ static void uninit(struct vo *vo) swapchain_step(vo); } - for (int i = 0; i < p->buf_count; ++i) - destroy_framebuffer(fd, p->bufs[i]); - talloc_free(p->last_input); talloc_free(p->cur_frame); talloc_free(p->cur_frame_cropped); |