Commit ce0d3b2c authored by Filip Roséen's avatar Filip Roséen Committed by Rémi Denis-Courmont
Browse files

misc/image: ImageRead: use vlc_format_Copy



If the decoder allocates data within video_format_t.p_palette, the
previous implementation would result in a use-after-free (among other
issues) due to the ownership of said p_palette not being well-defined.

This fixes the issue by using video_format_Copy, so that the two fmts
do not refer to the same palette.

fixes: #18334
Signed-off-by: Rémi Denis-Courmont's avatarRémi Denis-Courmont <remi@remlab.net>
parent 911f67ec
......@@ -251,9 +251,15 @@ static picture_t *ImageRead( image_handler_t *p_image, block_t *p_block,
}
p_pic = p_image->p_filter->pf_video_filter( p_image->p_filter, p_pic );
*p_fmt_out = p_image->p_filter->fmt_out.video;
video_format_Clean( p_fmt_out );
video_format_Copy( p_fmt_out, &p_image->p_filter->fmt_out.video );
}
else
{
video_format_Clean( p_fmt_out );
video_format_Copy( p_fmt_out, &p_image->p_dec->fmt_out.video );
}
else *p_fmt_out = p_image->p_dec->fmt_out.video;
return p_pic;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment