Skip to content

Commit 998f8d6

Browse files
fix: Double free issue
read consumes the dtvcc struct resulting the pointer drops immediately which we don't want
1 parent 7cfd169 commit 998f8d6

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/rust/src/lib.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,15 +69,19 @@ extern "C" fn ccxr_dtvcc_init<'a>(opts_ptr: *const ccx_decoder_dtvcc_settings) -
6969
/// - dtvcc_rust.decoders[i].tv
7070
#[no_mangle]
7171
extern "C" fn ccxr_dtvcc_free(dtvcc_rust: *mut Dtvcc) {
72-
let dtvcc = unsafe { dtvcc_rust.read() };
72+
let dtvcc = unsafe { &mut *dtvcc_rust };
7373

7474
// closely follows `dtvcc_free` at `src/lib_ccx/ccx_dtvcc.c:126`
7575
for i in 0..decoder::CCX_DTVCC_MAX_SERVICES {
7676
if utils::is_false(dtvcc.services_active[i]) {
7777
continue;
7878
}
7979

80-
let decoder = &mut dtvcc.decoders[i].to_owned().unwrap();
80+
if dtvcc.decoders[i].is_none() {
81+
continue;
82+
}
83+
84+
let decoder = &mut dtvcc.decoders[i].as_mut().unwrap();
8185

8286
decoder.windows.iter_mut().for_each(|window| {
8387
if utils::is_false(window.memory_reserved) {

0 commit comments

Comments
 (0)