video/vf_amf: fix use-after-free on AMF_INPUT_FULL

kasper93 · kasper93 · commit 304426c39090 · 2026-06-09T11:52:29.000+02:00
diff --git a/video/filter/vf_amf.c b/video/filter/vf_amf.c
@@ -629,6 +629,7 @@ static void process(struct mp_filter *f)
 
     if (res == AMF_INPUT_FULL) {
         MP_WARN(f, "FRC input queue full...\n");
+        frame = (struct mp_frame){MP_FRAME_VIDEO, mp_image_new_ref(p->ref_image)};
         mp_pin_out_unread(f->ppins[0], frame);
         return;
     }

Original file line number	Diff line number	Diff line change
`@@ -629,6 +629,7 @@ static void process(struct mp_filter *f)`
`629`	`629`
`630`	`630`	`if (res == AMF_INPUT_FULL) {`
`631`	`631`	`MP_WARN(f, "FRC input queue full...\n");`
	`632`	`+ frame = (struct mp_frame){MP_FRAME_VIDEO, mp_image_new_ref(p->ref_image)};`
`632`	`633`	`mp_pin_out_unread(f->ppins[0], frame);`
`633`	`634`	`return;`
`634`	`635`	`}`