decklink_dec.cpp captured audio packets are already-freed memory

[liquidblueocean]

Summary of the bug:

This can be seen by simple code inspection.
While the code calls AddRef on the received videoFrame, it doesn't do it for the audioFrame. When it exits the callback made by the DeckLinkAPI, that memory will be freed. Thus the avpacket passed on points to freed memory. Looks like this bug has been there all the time :(

How to reproduce:

Any usage of a DeckLink device that captures audio.

[mkver]

avpacket_queue_put() calls av_packet_make_refcounted() on the packet before putting it into the queue. Because the packet is not already refcounted, this will make a copy. So everything should be fine. But I don't have a decklink device at all, so I can't test this and am therefore not closing it. Have you actually experienced a use-after-free yourself in the scenario you describe?

(The handling of video avoids copying the data, instead adding references.)

[liquidblueocean]

ok, it's my mistake then. I looked at the code of avpacket_queue_put but didn't realize from the name that av_packet_make_refcounted makes a copy. This can be closed