shithub: dav1d

Info  •  Files  •  Log  •  Branches

ref: don't leave dangling pointers around when freeing Dav1dRef

Signed-off-by: James Almer <jamrial@gmail.com>

--- a/src/cdf.c

+++ b/src/cdf.c

@@ -4232,7 +4232,7 @@

 }

 void dav1d_cdf_thread_unref(CdfThreadContext *const cdf) {

-    dav1d_ref_dec(cdf->ref);

+    dav1d_ref_dec(&cdf->ref);

     memset(cdf, 0, sizeof(*cdf));

 }

--- a/src/data.c

+++ b/src/data.c

@@ -69,7 +69,7 @@

     if (buf->ref) {

         validate_input(buf->data != NULL);

-        dav1d_ref_dec(buf->ref);

+        dav1d_ref_dec(&buf->ref);

     }

     memset(buf, 0, sizeof(*buf));

 }

--- a/src/decode.c

+++ b/src/decode.c

@@ -2760,8 +2760,7 @@

     for (int i = 0; i < 7; i++) {

         if (f->refp[i].p.data[0])

             dav1d_thread_picture_unref(&f->refp[i]);

-        if (f->ref_mvs_ref[i])

-            dav1d_ref_dec(f->ref_mvs_ref[i]);

+        dav1d_ref_dec(&f->ref_mvs_ref[i]);

     }

     dav1d_thread_picture_unref(&f->cur);

@@ -2768,12 +2767,9 @@

     dav1d_cdf_thread_unref(&f->in_cdf);

     if (f->frame_hdr.refresh_context)

             dav1d_cdf_thread_unref(&f->out_cdf);

-    if (f->cur_segmap_ref)

-        dav1d_ref_dec(f->cur_segmap_ref);

-    if (f->prev_segmap_ref)

-        dav1d_ref_dec(f->prev_segmap_ref);

-    if (f->mvs_ref)

-        dav1d_ref_dec(f->mvs_ref);

+    dav1d_ref_dec(&f->cur_segmap_ref);

+    dav1d_ref_dec(&f->prev_segmap_ref);

+    dav1d_ref_dec(&f->mvs_ref);

     for (int i = 0; i < f->n_tile_data; i++)

         dav1d_data_unref(&f->tile[i].data);

@@ -3017,16 +3013,12 @@

             memcpy(c->refs[i].gmv, f->frame_hdr.gmv, sizeof(c->refs[i].gmv));

             c->refs[i].film_grain = f->frame_hdr.film_grain.data;

-            if (c->refs[i].segmap)

-                dav1d_ref_dec(c->refs[i].segmap);

+            dav1d_ref_dec(&c->refs[i].segmap);

             c->refs[i].segmap = f->cur_segmap_ref;

             if (f->cur_segmap_ref)

                 dav1d_ref_inc(f->cur_segmap_ref);

-            if (c->refs[i].refmvs)

-                dav1d_ref_dec(c->refs[i].refmvs);

-            if (f->frame_hdr.allow_intrabc) {

-                c->refs[i].refmvs = NULL;

-            } else {

+            dav1d_ref_dec(&c->refs[i].refmvs);

+            if (!f->frame_hdr.allow_intrabc) {

                 c->refs[i].refmvs = f->mvs_ref;

                 if (f->mvs_ref)

                     dav1d_ref_inc(f->mvs_ref);

@@ -3045,14 +3037,8 @@

                         dav1d_thread_picture_unref(&c->refs[i].p);

                     if (c->cdf[i].cdf)

                         dav1d_cdf_thread_unref(&c->cdf[i]);

-                    if (c->refs[i].segmap) {

-                        dav1d_ref_dec(c->refs[i].segmap);

-                        c->refs[i].segmap = NULL;

-                    }

-                    if (c->refs[i].refmvs) {

-                        dav1d_ref_dec(c->refs[i].refmvs);

-                        c->refs[i].refmvs = NULL;

-                    }

+                    dav1d_ref_dec(&c->refs[i].segmap);

+                    dav1d_ref_dec(&c->refs[i].refmvs);

                 }

             }

             return res;

@@ -3070,13 +3056,11 @@

     for (int i = 0; i < 7; i++) {

         if (f->refp[i].p.data[0])

             dav1d_thread_picture_unref(&f->refp[i]);

-        if (f->ref_mvs_ref[i])

-            dav1d_ref_dec(f->ref_mvs_ref[i]);

+        dav1d_ref_dec(&f->ref_mvs_ref[i]);

     }

     dav1d_picture_unref(&c->out);

     dav1d_thread_picture_unref(&f->cur);

-    if (f->mvs_ref)

-        dav1d_ref_dec(f->mvs_ref);

+    dav1d_ref_dec(&f->mvs_ref);

     for (int i = 0; i < f->n_tile_data; i++)

         dav1d_data_unref(&f->tile[i].data);

--- a/src/lib.c

+++ b/src/lib.c

@@ -313,10 +313,8 @@

             dav1d_cdf_thread_unref(&c->cdf[n]);

         if (c->refs[n].p.p.data[0])

             dav1d_thread_picture_unref(&c->refs[n].p);

-        if (c->refs[n].refmvs)

-            dav1d_ref_dec(c->refs[n].refmvs);

-        if (c->refs[n].segmap)

-            dav1d_ref_dec(c->refs[n].segmap);

+        dav1d_ref_dec(&c->refs[n].refmvs);

+        dav1d_ref_dec(&c->refs[n].segmap);

     }

     dav1d_freep_aligned(c_out);

 }

--- a/src/obu.c

+++ b/src/obu.c

@@ -1059,14 +1059,8 @@

             for (int i = 0; i < 8; i++) {

                 if (c->refs[i].p.p.data[0])

                     dav1d_thread_picture_unref(&c->refs[i].p);

-                if (c->refs[i].segmap) {

-                    dav1d_ref_dec(c->refs[i].segmap);

-                    c->refs[i].segmap = NULL;

-                }

-                if (c->refs[i].refmvs) {

-                    dav1d_ref_dec(c->refs[i].refmvs);

-                    c->refs[i].refmvs = NULL;

-                }

+                dav1d_ref_dec(&c->refs[i].segmap);

+                dav1d_ref_dec(&c->refs[i].refmvs);

                 if (c->cdf[i].cdf)

                     dav1d_cdf_thread_unref(&c->cdf[i]);

             }

@@ -1188,14 +1182,11 @@

                     c->refs[i].gmv[j] = dav1d_default_wm_params;

                 c->refs[i].film_grain = c->refs[r].film_grain;

-                if (c->refs[i].segmap)

-                    dav1d_ref_dec(c->refs[i].segmap);

+                dav1d_ref_dec(&c->refs[i].segmap);

                 c->refs[i].segmap = c->refs[r].segmap;

                 if (c->refs[r].segmap)

                     dav1d_ref_inc(c->refs[r].segmap);

-                if (c->refs[i].refmvs)

-                    dav1d_ref_dec(c->refs[i].refmvs);

-                c->refs[i].refmvs = NULL;

+                dav1d_ref_dec(&c->refs[i].refmvs);

                 c->refs[i].qidx = c->refs[r].qidx;

             }

         }

--- a/src/picture.c

+++ b/src/picture.c

@@ -198,7 +198,7 @@

     if (p->ref) {

         validate_input(p->data[0] != NULL);

-        dav1d_ref_dec(p->ref);

+        dav1d_ref_dec(&p->ref);

     }

     memset(p, 0, sizeof(*p));

 }

--- a/src/ref.c

+++ b/src/ref.c

@@ -72,9 +72,14 @@

     atomic_fetch_add(&ref->ref_cnt, 1);

 }

-void dav1d_ref_dec(Dav1dRef *const ref) {

+void dav1d_ref_dec(Dav1dRef **const pref) {

+    assert(pref != NULL);

+

+    Dav1dRef *const ref = *pref;

+    if (!ref) return;

+

     if (atomic_fetch_sub(&ref->ref_cnt, 1) == 1) {

         ref->free_callback(ref->const_data, ref->user_data);

-        free(ref);

+        freep(pref);

     }

 }

--- a/src/ref.h

+++ b/src/ref.h

@@ -46,6 +46,6 @@

                          void (*free_callback)(const uint8_t *data, void *user_data),

                          void *user_data);

 void dav1d_ref_inc(Dav1dRef *ref);

-void dav1d_ref_dec(Dav1dRef *ref);

+void dav1d_ref_dec(Dav1dRef **ref);

 #endif /* __DAV1D_SRC_REF_H__ */