Skip to content

Commit b33afc9

Browse files
fix: Double free issue
read consumes the dtvcc struct resulting the pointer drops immediately which we don't want
1 parent 450aa5c commit b33afc9

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/rust/src/lib.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,19 @@ extern "C" fn ccxr_dtvcc_init<'a>(opts_ptr: *const ccx_decoder_dtvcc_settings) -
6868
/// - dtvcc_rust.decoders[i].tv
6969
#[no_mangle]
7070
extern "C" fn ccxr_dtvcc_free(dtvcc_rust: *mut Dtvcc) {
71-
let dtvcc = unsafe { dtvcc_rust.read() };
71+
let dtvcc = unsafe { &mut *dtvcc_rust };
7272

7373
// closely follows `dtvcc_free` at `src/lib_ccx/ccx_dtvcc.c:126`
7474
for i in 0..decoder::CCX_DTVCC_MAX_SERVICES {
7575
if utils::is_false(dtvcc.services_active[i]) {
7676
continue;
7777
}
7878

79-
let decoder = &mut dtvcc.decoders[i].to_owned().unwrap();
79+
if dtvcc.decoders[i].is_none() {
80+
continue;
81+
}
82+
83+
let decoder = &mut dtvcc.decoders[i].as_mut().unwrap();
8084

8185
decoder.windows.iter_mut().for_each(|window| {
8286
if utils::is_false(window.memory_reserved) {

0 commit comments

Comments
 (0)