Skip to content

Commit 4c317dc

Browse files
fix: Double free issue
read consumes the dtvcc struct resulting the pointer drops immediately which we don't want
1 parent 9687a30 commit 4c317dc

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/rust/src/lib.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,15 +82,19 @@ extern "C" fn ccxr_dtvcc_init<'a>(opts_ptr: *const ccx_decoder_dtvcc_settings) -
8282
/// - dtvcc_rust.decoders[i].tv
8383
#[no_mangle]
8484
extern "C" fn ccxr_dtvcc_free(dtvcc_rust: *mut Dtvcc) {
85-
let dtvcc = unsafe { dtvcc_rust.read() };
85+
let dtvcc = unsafe { &mut *dtvcc_rust };
8686

8787
// closely follows `dtvcc_free` at `src/lib_ccx/ccx_dtvcc.c:126`
8888
for i in 0..decoder::CCX_DTVCC_MAX_SERVICES {
8989
if utils::is_false(dtvcc.services_active[i]) {
9090
continue;
9191
}
9292

93-
let decoder = &mut dtvcc.decoders[i].to_owned().unwrap();
93+
if dtvcc.decoders[i].is_none() {
94+
continue;
95+
}
96+
97+
let decoder = &mut dtvcc.decoders[i].as_mut().unwrap();
9498

9599
decoder.windows.iter_mut().for_each(|window| {
96100
if utils::is_false(window.memory_reserved) {

0 commit comments

Comments
 (0)