Skip to content

Commit e8cf6ae

Browse files
fix: Double free issue
read consumes the dtvcc struct resulting the pointer drops immediately which we don't want
1 parent 6cb6f6e commit e8cf6ae

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/rust/src/lib.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,15 +96,19 @@ extern "C" fn ccxr_dtvcc_init<'a>(opts_ptr: *const ccx_decoder_dtvcc_settings) -
9696
/// - dtvcc_rust.decoders[i].tv
9797
#[no_mangle]
9898
extern "C" fn ccxr_dtvcc_free(dtvcc_rust: *mut Dtvcc) {
99-
let dtvcc = unsafe { dtvcc_rust.read() };
99+
let dtvcc = unsafe { &mut *dtvcc_rust };
100100

101101
// closely follows `dtvcc_free` at `src/lib_ccx/ccx_dtvcc.c:126`
102102
for i in 0..decoder::CCX_DTVCC_MAX_SERVICES {
103103
if utils::is_false(dtvcc.services_active[i]) {
104104
continue;
105105
}
106106

107-
let decoder = &mut dtvcc.decoders[i].to_owned().unwrap();
107+
if dtvcc.decoders[i].is_none() {
108+
continue;
109+
}
110+
111+
let decoder = &mut dtvcc.decoders[i].as_mut().unwrap();
108112

109113
decoder.windows.iter_mut().for_each(|window| {
110114
if utils::is_false(window.memory_reserved) {

0 commit comments

Comments
 (0)