aboutsummaryrefslogtreecommitdiffstats
path: root/meta-rcar-gen2/recipes-multimedia/gstreamer/gstreamer1.0-omx/0002-Fixed-memory-corruption-and-bad-access.patch
blob: 354a7a92b3e1f5c87d6a882dab3f6eb19dba61a2 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
From 3e528cda6fb9d0da2be52e18a305096cf6e37528 Mon Sep 17 00:00:00 2001
From: Andrey Vostrikov <andrey.vostrikov@cogentembedded.com>
Date: Sat, 18 Jul 2015 15:52:59 +0300
Subject: [PATCH] Fixed memory corruption and bad access

---
 omx/gstomxh264dec.c  |  4 ++--
 omx/gstomxvideodec.c | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/omx/gstomxh264dec.c b/omx/gstomxh264dec.c
index 7799e69..5509cc0 100644
--- a/omx/gstomxh264dec.c
+++ b/omx/gstomxh264dec.c
@@ -104,7 +104,7 @@ gst_omx_h264_dec_retrieve_sps_pps (GstOMXH264Dec * self, guint8 * data)
 
   sps_num = ptr[5] & 0x1f;      /* reserved(3bit) + numOfSequenceParameterSets(uint 5bit) */
 
-  sps_size_list = g_malloc (sps_num);
+  sps_size_list = g_malloc (sps_num * sizeof (guint));
   if (!sps_size_list) {
     GST_ERROR_OBJECT (self, "failed g_malloc");
     return NULL;
@@ -119,7 +119,7 @@ gst_omx_h264_dec_retrieve_sps_pps (GstOMXH264Dec * self, guint8 * data)
   }
 
   pps_num = *ptr++;             /* numOfPictureParameterSets (unint 8bit) */
-  pps_size_list = g_malloc (pps_num);
+  pps_size_list = g_malloc (pps_num * sizeof (guint));
   if (!pps_size_list) {
     GST_ERROR_OBJECT (self, "failed g_malloc");
     g_free (sps_size_list);
diff --git a/omx/gstomxvideodec.c b/omx/gstomxvideodec.c
index c5b69ab..4a9706f 100644
--- a/omx/gstomxvideodec.c
+++ b/omx/gstomxvideodec.c
@@ -563,10 +563,12 @@ gst_omx_buffer_pool_free_buffer (GstBufferPool * bpool, GstBuffer * buffer)
       gst_omx_buffer_data_quark);
 #ifdef HAVE_MMNGRBUF
   if (self->use_dmabuf) {
-    vdbuf_data = (GstOMXVideoDecBufferData *) omx_buf->private_data;
-    for (i = 0; i < GST_VIDEO_MAX_PLANES; i++)
-      if (vdbuf_data->id_export[i] >= 0)
-        mmngr_export_end_in_user (vdbuf_data->id_export[i]);
+      vdbuf_data = (GstOMXVideoDecBufferData *) omx_buf->private_data;
+      if (vdbuf_data) {
+          for (i = 0; i < GST_VIDEO_MAX_PLANES; i++)
+              if (vdbuf_data->id_export[i] >= 0)
+                  mmngr_export_end_in_user (vdbuf_data->id_export[i]);
+      }
   }
 #endif
   g_slice_free (GstOMXVideoDecBufferData, omx_buf->private_data);
@@ -1684,8 +1686,6 @@ gst_omx_video_dec_deallocate_output_buffers (GstOMXVideoDec * self)
 
 static void GstOMXBufCallbackfunc (struct GstOMXBufferCallback *release)
 {
-  gint i;
-
   if (!release)
     return;
 
-- 
2.1.4