Skip to content

Commit 144ab5f

Browse files
fix: Double free issue
read consumes the dtvcc struct resulting the pointer drops immediately which we don't want
1 parent 3665096 commit 144ab5f

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/rust/src/lib.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,15 +97,19 @@ extern "C" fn ccxr_dtvcc_init<'a>(opts_ptr: *const ccx_decoder_dtvcc_settings) -
9797
/// - dtvcc_rust.decoders[i].tv
9898
#[no_mangle]
9999
extern "C" fn ccxr_dtvcc_free(dtvcc_rust: *mut Dtvcc) {
100-
let dtvcc = unsafe { dtvcc_rust.read() };
100+
let dtvcc = unsafe { &mut *dtvcc_rust };
101101

102102
// closely follows `dtvcc_free` at `src/lib_ccx/ccx_dtvcc.c:126`
103103
for i in 0..decoder::CCX_DTVCC_MAX_SERVICES {
104104
if utils::is_false(dtvcc.services_active[i]) {
105105
continue;
106106
}
107107

108-
let decoder = &mut dtvcc.decoders[i].to_owned().unwrap();
108+
if dtvcc.decoders[i].is_none() {
109+
continue;
110+
}
111+
112+
let decoder = &mut dtvcc.decoders[i].as_mut().unwrap();
109113

110114
decoder.windows.iter_mut().for_each(|window| {
111115
if utils::is_false(window.memory_reserved) {

0 commit comments

Comments
 (0)