From 26d3f42b8947cebd0f55f4170007f1bb9a9e1556 Mon Sep 17 00:00:00 2001 From: wangrui05 Date: Fri, 17 Aug 2018 12:25:40 +0800 Subject: [PATCH] libobs: Fix heap corruption in obs_source_output_video --- libobs/obs-source.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/libobs/obs-source.c b/libobs/obs-source.c index d77be3249..0e61af64c 100644 --- a/libobs/obs-source.c +++ b/libobs/obs-source.c @@ -2342,7 +2342,7 @@ static void clean_cache(obs_source_t *source) } #define MAX_ASYNC_FRAMES 30 - +//if return value is not null then do (os_atomic_dec_long(&output->refs) == 0) && obs_source_frame_destroy(output) static inline struct obs_source_frame *cache_video(struct obs_source *source, const struct obs_source_frame *frame) { @@ -2399,11 +2399,6 @@ static inline struct obs_source_frame *cache_video(struct obs_source *source, copy_frame_data(new_frame, frame); - if (os_atomic_dec_long(&new_frame->refs) == 0) { - obs_source_frame_destroy(new_frame); - new_frame = NULL; - } - return new_frame; } @@ -2422,13 +2417,17 @@ void obs_source_output_video(obs_source_t *source, cache_video(source, frame) : NULL; /* ------------------------------------------- */ - + pthread_mutex_lock(&source->async_mutex); if (output) { - pthread_mutex_lock(&source->async_mutex); - da_push_back(source->async_frames, &output); - pthread_mutex_unlock(&source->async_mutex); - source->async_active = true; + if (os_atomic_dec_long(&output->refs) == 0) { + obs_source_frame_destroy(output); + output = NULL; + } else { + da_push_back(source->async_frames, &output); + source->async_active = true; + } } + pthread_mutex_unlock(&source->async_mutex); } static inline bool preload_frame_changed(obs_source_t *source, -- GitLab