mpv icon indicating copy to clipboard operation
mpv copied to clipboard

vo_gpu_next: fix null pointer dereference

Open skbeh opened this issue 2 years ago • 3 comments

During the call to update_icc_opts by update_render_options, sometimes opts->size_str is not set, so the call to gl_parse_3dlut_size (https://github.com/mpv-player/mpv/blob/2f747341f99d9f8697303be01c67ae3b3437cd18/video/out/vo_gpu_next.c#L1619) causes a null pointer dereference. Only parse 3dlut size if opts->size_str is set.

skbeh avatar Nov 12 '22 18:11 skbeh

Hi, and thanks for the contribution.

With a quick look of the code, at least the options definition seems to contain defaults, so I'd expect those be filled in when the options structure is initialized:

video/out/gpu/lcms.c-    .defaults = &(const struct mp_icc_opts) {
video/out/gpu/lcms.c:        .size_str = "64x64x64",
video/out/gpu/lcms.c-        .intent = INTENT_RELATIVE_COLORIMETRIC,
video/out/gpu/lcms.c-        .use_embedded = true,
video/out/gpu/lcms.c-    },

Can you give an example of when this is hit, as it sounds like there might be a bug in gpu-next utilizing the options struct before it is initialized, which of course is a deeper issue with the VO if it is true.

jeeb avatar Nov 12 '22 18:11 jeeb

@jeeb In my system, /usr/bin/mpv --no-config --vo=gpu-next <video> just crashes. I am using latest Arch Linux and Nvidia's proprietary driver. I built mpv with the following command:

waf configure --prefix=/usr \
    --confdir=/etc/mpv \
    --disable-cdda \
    --disable-dvb \
    --disable-dvdnav \
    --enable-libarchive \
    --enable-libmpv-shared \
    --disable-build-date \
    --disable-caca \
    --enable-vapoursynth \
    --enable-pipewire \
    --disable-pulse \
    --disable-jack \
    --disable-alsa \
    --enable-x11 \
    --disable-debug-build \
    --disable-xv \
    --disable-lcms2 \
    --disable-zimg \
    --disable-drm \
    --disable-sixel \
    --lua=luajit \
    --disable-cplugins \
    --disable-javascript \
    --disable-vdpau \
    --disable-vaapi

skbeh avatar Nov 13 '22 07:11 skbeh

The coredump and the binary: mpv.tar.gz

skbeh avatar Nov 13 '22 07:11 skbeh