Coverage Report

Created: 2026-01-25 07:18

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ffmpeg/libavutil/buffer.c
Line
Count
Source
1
/*
2
 * This file is part of FFmpeg.
3
 *
4
 * FFmpeg is free software; you can redistribute it and/or
5
 * modify it under the terms of the GNU Lesser General Public
6
 * License as published by the Free Software Foundation; either
7
 * version 2.1 of the License, or (at your option) any later version.
8
 *
9
 * FFmpeg is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12
 * Lesser General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU Lesser General Public
15
 * License along with FFmpeg; if not, write to the Free Software
16
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17
 */
18
19
#include <stdatomic.h>
20
#include <stdint.h>
21
#include <string.h>
22
23
#include "avassert.h"
24
#include "buffer_internal.h"
25
#include "common.h"
26
#include "mem.h"
27
#include "thread.h"
28
29
static AVBufferRef *buffer_create(AVBuffer *buf, uint8_t *data, size_t size,
30
                                  void (*free)(void *opaque, uint8_t *data),
31
                                  void *opaque, int flags)
32
0
{
33
0
    AVBufferRef *ref = NULL;
34
35
0
    buf->data     = data;
36
0
    buf->size     = size;
37
0
    buf->free     = free ? free : av_buffer_default_free;
38
0
    buf->opaque   = opaque;
39
40
0
    atomic_init(&buf->refcount, 1);
41
42
0
    buf->flags = flags;
43
44
0
    ref = av_mallocz(sizeof(*ref));
45
0
    if (!ref)
46
0
        return NULL;
47
48
0
    ref->buffer = buf;
49
0
    ref->data   = data;
50
0
    ref->size   = size;
51
52
0
    return ref;
53
0
}
54
55
AVBufferRef *av_buffer_create(uint8_t *data, size_t size,
56
                              void (*free)(void *opaque, uint8_t *data),
57
                              void *opaque, int flags)
58
0
{
59
0
    AVBufferRef *ret;
60
0
    AVBuffer *buf = av_mallocz(sizeof(*buf));
61
0
    if (!buf)
62
0
        return NULL;
63
64
0
    ret = buffer_create(buf, data, size, free, opaque, flags);
65
0
    if (!ret) {
66
0
        av_free(buf);
67
0
        return NULL;
68
0
    }
69
0
    return ret;
70
0
}
71
72
void av_buffer_default_free(void *opaque, uint8_t *data)
73
0
{
74
0
    av_free(data);
75
0
}
76
77
AVBufferRef *av_buffer_alloc(size_t size)
78
0
{
79
0
    AVBufferRef *ret = NULL;
80
0
    uint8_t    *data = NULL;
81
82
0
    data = av_malloc(size);
83
0
    if (!data)
84
0
        return NULL;
85
86
0
    ret = av_buffer_create(data, size, av_buffer_default_free, NULL, 0);
87
0
    if (!ret)
88
0
        av_freep(&data);
89
90
0
    return ret;
91
0
}
92
93
AVBufferRef *av_buffer_allocz(size_t size)
94
0
{
95
0
    AVBufferRef *ret = av_buffer_alloc(size);
96
0
    if (!ret)
97
0
        return NULL;
98
99
0
    memset(ret->data, 0, size);
100
0
    return ret;
101
0
}
102
103
AVBufferRef *av_buffer_ref(const AVBufferRef *buf)
104
0
{
105
0
    AVBufferRef *ret = av_mallocz(sizeof(*ret));
106
107
0
    if (!ret)
108
0
        return NULL;
109
110
0
    *ret = *buf;
111
112
0
    atomic_fetch_add_explicit(&buf->buffer->refcount, 1, memory_order_relaxed);
113
114
0
    return ret;
115
0
}
116
117
static void buffer_replace(AVBufferRef **dst, AVBufferRef **src)
118
0
{
119
0
    AVBuffer *b;
120
121
0
    b = (*dst)->buffer;
122
123
0
    if (src) {
124
0
        **dst = **src;
125
0
        av_freep(src);
126
0
    } else
127
0
        av_freep(dst);
128
129
0
    if (atomic_fetch_sub_explicit(&b->refcount, 1, memory_order_acq_rel) == 1) {
130
        /* b->free below might already free the structure containing *b,
131
         * so we have to read the flag now to avoid use-after-free. */
132
0
        int free_avbuffer = !(b->flags_internal & BUFFER_FLAG_NO_FREE);
133
0
        b->free(b->opaque, b->data);
134
0
        if (free_avbuffer)
135
0
            av_free(b);
136
0
    }
137
0
}
138
139
void av_buffer_unref(AVBufferRef **buf)
140
5.45k
{
141
5.45k
    if (!buf || !*buf)
142
5.45k
        return;
143
144
0
    buffer_replace(buf, NULL);
145
0
}
146
147
int av_buffer_is_writable(const AVBufferRef *buf)
148
0
{
149
0
    if (buf->buffer->flags & AV_BUFFER_FLAG_READONLY)
150
0
        return 0;
151
152
0
    return atomic_load(&buf->buffer->refcount) == 1;
153
0
}
154
155
void *av_buffer_get_opaque(const AVBufferRef *buf)
156
0
{
157
0
    return buf->buffer->opaque;
158
0
}
159
160
int av_buffer_get_ref_count(const AVBufferRef *buf)
161
0
{
162
0
    return atomic_load(&buf->buffer->refcount);
163
0
}
164
165
int av_buffer_make_writable(AVBufferRef **pbuf)
166
0
{
167
0
    AVBufferRef *newbuf, *buf = *pbuf;
168
169
0
    if (av_buffer_is_writable(buf))
170
0
        return 0;
171
172
0
    newbuf = av_buffer_alloc(buf->size);
173
0
    if (!newbuf)
174
0
        return AVERROR(ENOMEM);
175
176
0
    memcpy(newbuf->data, buf->data, buf->size);
177
178
0
    buffer_replace(pbuf, &newbuf);
179
180
0
    return 0;
181
0
}
182
183
int av_buffer_realloc(AVBufferRef **pbuf, size_t size)
184
0
{
185
0
    AVBufferRef *buf = *pbuf;
186
0
    uint8_t *tmp;
187
0
    int ret;
188
189
0
    if (!buf) {
190
        /* allocate a new buffer with av_realloc(), so it will be reallocatable
191
         * later */
192
0
        uint8_t *data = av_realloc(NULL, size);
193
0
        if (!data)
194
0
            return AVERROR(ENOMEM);
195
196
0
        buf = av_buffer_create(data, size, av_buffer_default_free, NULL, 0);
197
0
        if (!buf) {
198
0
            av_freep(&data);
199
0
            return AVERROR(ENOMEM);
200
0
        }
201
202
0
        buf->buffer->flags_internal |= BUFFER_FLAG_REALLOCATABLE;
203
0
        *pbuf = buf;
204
205
0
        return 0;
206
0
    } else if (buf->size == size)
207
0
        return 0;
208
209
0
    if (!(buf->buffer->flags_internal & BUFFER_FLAG_REALLOCATABLE) ||
210
0
        !av_buffer_is_writable(buf) || buf->data != buf->buffer->data) {
211
        /* cannot realloc, allocate a new reallocable buffer and copy data */
212
0
        AVBufferRef *new = NULL;
213
214
0
        ret = av_buffer_realloc(&new, size);
215
0
        if (ret < 0)
216
0
            return ret;
217
218
0
        memcpy(new->data, buf->data, FFMIN(size, buf->size));
219
220
0
        buffer_replace(pbuf, &new);
221
0
        return 0;
222
0
    }
223
224
0
    tmp = av_realloc(buf->buffer->data, size);
225
0
    if (!tmp)
226
0
        return AVERROR(ENOMEM);
227
228
0
    buf->buffer->data = buf->data = tmp;
229
0
    buf->buffer->size = buf->size = size;
230
0
    return 0;
231
0
}
232
233
int av_buffer_replace(AVBufferRef **pdst, const AVBufferRef *src)
234
0
{
235
0
    AVBufferRef *dst = *pdst;
236
0
    AVBufferRef *tmp;
237
238
0
    if (!src) {
239
0
        av_buffer_unref(pdst);
240
0
        return 0;
241
0
    }
242
243
0
    if (dst && dst->buffer == src->buffer) {
244
        /* make sure the data pointers match */
245
0
        dst->data = src->data;
246
0
        dst->size = src->size;
247
0
        return 0;
248
0
    }
249
250
0
    tmp = av_buffer_ref(src);
251
0
    if (!tmp)
252
0
        return AVERROR(ENOMEM);
253
254
0
    av_buffer_unref(pdst);
255
0
    *pdst = tmp;
256
0
    return 0;
257
0
}
258
259
AVBufferPool *av_buffer_pool_init2(size_t size, void *opaque,
260
                                   AVBufferRef* (*alloc)(void *opaque, size_t size),
261
                                   void (*pool_free)(void *opaque))
262
0
{
263
0
    AVBufferPool *pool = av_mallocz(sizeof(*pool));
264
0
    if (!pool)
265
0
        return NULL;
266
267
0
    if (ff_mutex_init(&pool->mutex, NULL)) {
268
0
        av_free(pool);
269
0
        return NULL;
270
0
    }
271
272
0
    pool->size      = size;
273
0
    pool->opaque    = opaque;
274
0
    pool->alloc2    = alloc;
275
0
    pool->alloc     = av_buffer_alloc; // fallback
276
0
    pool->pool_free = pool_free;
277
278
0
    atomic_init(&pool->refcount, 1);
279
280
0
    return pool;
281
0
}
282
283
AVBufferPool *av_buffer_pool_init(size_t size, AVBufferRef* (*alloc)(size_t size))
284
0
{
285
0
    AVBufferPool *pool = av_mallocz(sizeof(*pool));
286
0
    if (!pool)
287
0
        return NULL;
288
289
0
    if (ff_mutex_init(&pool->mutex, NULL)) {
290
0
        av_free(pool);
291
0
        return NULL;
292
0
    }
293
294
0
    pool->size     = size;
295
0
    pool->alloc    = alloc ? alloc : av_buffer_alloc;
296
297
0
    atomic_init(&pool->refcount, 1);
298
299
0
    return pool;
300
0
}
301
302
static void buffer_pool_flush(AVBufferPool *pool)
303
0
{
304
0
    while (pool->pool) {
305
0
        BufferPoolEntry *buf = pool->pool;
306
0
        pool->pool = buf->next;
307
308
0
        buf->free(buf->opaque, buf->data);
309
0
        av_freep(&buf);
310
0
    }
311
0
}
312
313
/*
314
 * This function gets called when the pool has been uninited and
315
 * all the buffers returned to it.
316
 */
317
static void buffer_pool_free(AVBufferPool *pool)
318
0
{
319
0
    buffer_pool_flush(pool);
320
0
    ff_mutex_destroy(&pool->mutex);
321
322
0
    if (pool->pool_free)
323
0
        pool->pool_free(pool->opaque);
324
325
0
    av_freep(&pool);
326
0
}
327
328
void av_buffer_pool_uninit(AVBufferPool **ppool)
329
0
{
330
0
    AVBufferPool *pool;
331
332
0
    if (!ppool || !*ppool)
333
0
        return;
334
0
    pool   = *ppool;
335
0
    *ppool = NULL;
336
337
0
    ff_mutex_lock(&pool->mutex);
338
0
    buffer_pool_flush(pool);
339
0
    ff_mutex_unlock(&pool->mutex);
340
341
0
    if (atomic_fetch_sub_explicit(&pool->refcount, 1, memory_order_acq_rel) == 1)
342
0
        buffer_pool_free(pool);
343
0
}
344
345
static void pool_release_buffer(void *opaque, uint8_t *data)
346
0
{
347
0
    BufferPoolEntry *buf = opaque;
348
0
    AVBufferPool *pool = buf->pool;
349
350
0
    ff_mutex_lock(&pool->mutex);
351
0
    buf->next = pool->pool;
352
0
    pool->pool = buf;
353
0
    ff_mutex_unlock(&pool->mutex);
354
355
0
    if (atomic_fetch_sub_explicit(&pool->refcount, 1, memory_order_acq_rel) == 1)
356
0
        buffer_pool_free(pool);
357
0
}
358
359
/* allocate a new buffer and override its free() callback so that
360
 * it is returned to the pool on free */
361
static AVBufferRef *pool_alloc_buffer(AVBufferPool *pool)
362
0
{
363
0
    BufferPoolEntry *buf;
364
0
    AVBufferRef     *ret;
365
366
0
    av_assert0(pool->alloc || pool->alloc2);
367
368
0
    ret = pool->alloc2 ? pool->alloc2(pool->opaque, pool->size) :
369
0
                         pool->alloc(pool->size);
370
0
    if (!ret)
371
0
        return NULL;
372
373
0
    buf = av_mallocz(sizeof(*buf));
374
0
    if (!buf) {
375
0
        av_buffer_unref(&ret);
376
0
        return NULL;
377
0
    }
378
379
0
    buf->data   = ret->buffer->data;
380
0
    buf->opaque = ret->buffer->opaque;
381
0
    buf->free   = ret->buffer->free;
382
0
    buf->pool   = pool;
383
384
0
    ret->buffer->opaque = buf;
385
0
    ret->buffer->free   = pool_release_buffer;
386
387
0
    return ret;
388
0
}
389
390
AVBufferRef *av_buffer_pool_get(AVBufferPool *pool)
391
0
{
392
0
    AVBufferRef *ret;
393
0
    BufferPoolEntry *buf;
394
395
0
    ff_mutex_lock(&pool->mutex);
396
0
    buf = pool->pool;
397
0
    if (buf) {
398
0
        memset(&buf->buffer, 0, sizeof(buf->buffer));
399
0
        ret = buffer_create(&buf->buffer, buf->data, pool->size,
400
0
                            pool_release_buffer, buf, 0);
401
0
        if (ret) {
402
0
            pool->pool = buf->next;
403
0
            buf->next = NULL;
404
0
            buf->buffer.flags_internal |= BUFFER_FLAG_NO_FREE;
405
0
        }
406
0
    } else {
407
0
        ret = pool_alloc_buffer(pool);
408
0
    }
409
0
    ff_mutex_unlock(&pool->mutex);
410
411
0
    if (ret)
412
0
        atomic_fetch_add_explicit(&pool->refcount, 1, memory_order_relaxed);
413
414
0
    return ret;
415
0
}
416
417
void *av_buffer_pool_buffer_get_opaque(const AVBufferRef *ref)
418
0
{
419
0
    BufferPoolEntry *buf = ref->buffer->opaque;
420
0
    av_assert0(buf);
421
0
    return buf->opaque;
422
0
}