libff: Fix heap corruption caused by unnecessary av_dup_packet call

There's no need to duplicate the packet as the reference count will be 1
after the av_read_frame call. Duplicating causes heap corruption when a
synthetic clock packet is duplicated and assigned the buffer from the
stack-based temporary packet which is then double-freed by the decoder
thread.
上级 ba70b441
......@@ -61,10 +61,6 @@ int packet_queue_put(struct ff_packet_queue *q, struct ff_packet *packet)
{
struct ff_packet_list *new_packet;
if (packet != &q->flush_packet
&& av_dup_packet(&packet->base) < 0)
return FF_PACKET_FAIL;
new_packet = av_malloc(sizeof(struct ff_packet_list));
if (new_packet == NULL)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册