mpv
mpv copied to clipboard
vo_gpu_next: fix null pointer dereference
During the call to update_icc_opts
by update_render_options
, sometimes opts->size_str
is not set, so the call to gl_parse_3dlut_size (https://github.com/mpv-player/mpv/blob/2f747341f99d9f8697303be01c67ae3b3437cd18/video/out/vo_gpu_next.c#L1619) causes a null pointer dereference.
Only parse 3dlut size if opts->size_str
is set.
Hi, and thanks for the contribution.
With a quick look of the code, at least the options definition seems to contain defaults, so I'd expect those be filled in when the options structure is initialized:
video/out/gpu/lcms.c- .defaults = &(const struct mp_icc_opts) {
video/out/gpu/lcms.c: .size_str = "64x64x64",
video/out/gpu/lcms.c- .intent = INTENT_RELATIVE_COLORIMETRIC,
video/out/gpu/lcms.c- .use_embedded = true,
video/out/gpu/lcms.c- },
Can you give an example of when this is hit, as it sounds like there might be a bug in gpu-next utilizing the options struct before it is initialized, which of course is a deeper issue with the VO if it is true.
@jeeb In my system, /usr/bin/mpv --no-config --vo=gpu-next <video>
just crashes.
I am using latest Arch Linux and Nvidia's proprietary driver. I built mpv with the following command:
waf configure --prefix=/usr \
--confdir=/etc/mpv \
--disable-cdda \
--disable-dvb \
--disable-dvdnav \
--enable-libarchive \
--enable-libmpv-shared \
--disable-build-date \
--disable-caca \
--enable-vapoursynth \
--enable-pipewire \
--disable-pulse \
--disable-jack \
--disable-alsa \
--enable-x11 \
--disable-debug-build \
--disable-xv \
--disable-lcms2 \
--disable-zimg \
--disable-drm \
--disable-sixel \
--lua=luajit \
--disable-cplugins \
--disable-javascript \
--disable-vdpau \
--disable-vaapi
The coredump and the binary: mpv.tar.gz