From f29fcafb81de1a8d23773a1db4afeb2d96bc5a31 Mon Sep 17 00:00:00 2001 From: nanahi <130121847+na-na-hi@users.noreply.github.com> Date: Sat, 23 May 2026 08:35:04 -0400 Subject: [PATCH] video/filter/vf_gpu_vulkan: parent opts to ctx And only free explicitly on success. On failure it will be freed by parent. Fixes: [Bug] vf_gpu_vulkan: Use-after-free of ctx_opts --- video/filter/vf_gpu_vulkan.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/video/filter/vf_gpu_vulkan.c b/video/filter/vf_gpu_vulkan.c index 0b3133f119..71628fe91e 100644 --- a/video/filter/vf_gpu_vulkan.c +++ b/video/filter/vf_gpu_vulkan.c @@ -67,19 +67,17 @@ static struct offscreen_ctx *vk_offscreen_ctx_create(struct mpv_global *global, goto error; struct pl_vk_inst_params pl_vk_params = {0}; - struct ra_ctx_opts *ctx_opts = mp_get_config_group(NULL, global, &ra_ctx_conf); + struct ra_ctx_opts *ctx_opts = mp_get_config_group(ctx, global, &ra_ctx_conf); pl_vk_params.debug = ctx_opts->debug; - talloc_free(ctx_opts); mppl_log_set_probing(vk->pllog, true); vk->vkinst = pl_vk_inst_create(vk->pllog, &pl_vk_params); mppl_log_set_probing(vk->pllog, false); if (!vk->vkinst) goto error; - struct vulkan_opts *vk_opts = mp_get_config_group(NULL, global, &vulkan_conf); + struct vulkan_opts *vk_opts = mp_get_config_group(ctx, global, &vulkan_conf); vk->vulkan = mppl_create_vulkan(vk_opts, vk->vkinst, vk->pllog, VK_NULL_HANDLE, ctx_opts->allow_sw); - talloc_free(vk_opts); if (!vk->vulkan) goto error; @@ -97,6 +95,8 @@ static struct offscreen_ctx *vk_offscreen_ctx_create(struct mpv_global *global, ctx->ra = ractx->ra; ctx->priv = vkctx; + talloc_free(ctx_opts); + talloc_free(vk_opts); return ctx; error: