[Encode] Fix Wild Pointer Double Free Heap Corruption Issue

There is two pointer points to an avp interface and may cause heap corruption due to double free. This fix is to set one pointer to nullptr as not used to avoid free again.
intel · Dec 18, 2024 · 3d2c719 · 3d2c719
1 parent a943748
commit 3d2c719
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 5 deletions.
diff --git a/media_driver/agnostic/Xe_M/Xe_HPM/codec/hal/codechal_hw_xe_hpm.cpp b/media_driver/agnostic/Xe_M/Xe_HPM/codec/hal/codechal_hw_xe_hpm.cpp
@@ -135,7 +135,7 @@ CodechalHwInterfaceXe_Hpm::CodechalHwInterfaceXe_Hpm(
     : CodechalHwInterfaceG12(osInterface, codecFunction, mhwInterfaces, disableScalability)
 {
     CODECHAL_HW_FUNCTION_ENTER;
-    m_avpInterface = static_cast<MhwInterfacesXehp_Sdv*>(mhwInterfaces)->m_avpInterface;
+
     PrepareCmdSize(codecFunction);
 }
 

diff --git a/media_driver/agnostic/Xe_M/Xe_XPM/codec/hal/codechal_hw_xe_xpm.cpp b/media_driver/agnostic/Xe_M/Xe_XPM/codec/hal/codechal_hw_xe_xpm.cpp
@@ -49,9 +49,6 @@ CodechalHwInterfaceXe_Xpm::CodechalHwInterfaceXe_Xpm(
 {
     CODECHAL_HW_FUNCTION_ENTER;
 
-
-    m_avpInterface = static_cast<MhwInterfacesXehp_Sdv*>(mhwInterfaces)->m_avpInterface;
-
     m_bltState = MOS_New(BltStateXe_Xpm, m_osInterface);
     if(m_bltState != nullptr)
     {

diff --git a/media_driver/agnostic/gen12/codec/hal/codechal_hw_g12_X.cpp b/media_driver/agnostic/gen12/codec/hal/codechal_hw_g12_X.cpp
@@ -198,7 +198,13 @@ CodechalHwInterfaceG12::CodechalHwInterfaceG12(
     : CodechalHwInterface(osInterface, codecFunction, mhwInterfaces, disableScalability)
 {
     CODECHAL_HW_FUNCTION_ENTER;
-    m_avpInterface = static_cast<MhwInterfacesG12Tgllp*>(mhwInterfaces)->m_avpInterface;
+
+    MhwInterfacesG12Tgllp *mhwItfG12Tgllp = static_cast<MhwInterfacesG12Tgllp *>(mhwInterfaces);
+    CODECHAL_HW_ASSERT(mhwItfG12Tgllp);
+    m_avpInterface                        = mhwItfG12Tgllp->m_avpInterface;
+    //Set the original m_avpInterface to nullptr to avoid double free and wild pointer
+    mhwItfG12Tgllp->m_avpInterface        = nullptr;
+
     m_mediaSfcItf  = std::make_shared<MediaSfcInterfaceLegacy>(m_osInterface);
 
     InternalInit(codecFunction);