Commit 6cab63a2 authored by Phil Roffe and David Grellscheid's avatar Phil Roffe and David Grellscheid Committed by Antoine Cellerier

Fixed by decrementing the i_refcount variable in the correct manner -

and therefore freeing the memory only when the i_refcount successfully
went to 0.

The problem was that i_refcount is an unsigned variable, and was being
decremented twice, once erroneously by mosaic_bridge, and then again in
the picture's original pf_release function. If i_refcount started at 1,
it wrapped to the maximum unsigned value rather than -1, failing the
refcount tests in the pf_release function.

Patch Authors: Phil Roffe and David Grellscheid
Signed-off-by: default avatarAntoine Cellerier <dionoea@videolan.org>
parent f7a5c96a
...@@ -80,8 +80,6 @@ static void ReleasePicture( picture_t *p_pic ) ...@@ -80,8 +80,6 @@ static void ReleasePicture( picture_t *p_pic )
{ {
assert( p_pic ); assert( p_pic );
if( --p_pic->i_refcount > 0 )
return;
if( p_pic->p_sys ) if( p_pic->p_sys )
{ {
...@@ -91,9 +89,12 @@ static void ReleasePicture( picture_t *p_pic ) ...@@ -91,9 +89,12 @@ static void ReleasePicture( picture_t *p_pic )
} }
else else
{ {
free( p_pic->p_q ); if( --p_pic->i_refcount == 0 )
free( p_pic->p_data_orig ); {
free( p_pic ); free( p_pic->p_q );
free( p_pic->p_data_orig );
free( p_pic );
}
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment