Skip to content
This repository was archived by the owner on Apr 16, 2026. It is now read-only.

Commit 2c1ec00

Browse files
m4mmonm4mmon
committed
add IMPOSDRgnAttr member to OSDItem structure. Seems that the data is accessed beyond the scope of the previous locally declared variables, leading to random but consistent crashes, at least on eufy E220 and wuuk Y0510 when playing too much with OSD.
1 parent 91b6ee5 commit 2c1ec00

2 files changed

Lines changed: 31 additions & 35 deletions

File tree

‎src/OSD.cpp‎

Lines changed: 30 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ int OSD::libschrift_init()
251251
return 0;
252252
}
253253

254-
void OSD::set_text(OSDItem *osdItem, IMPOSDRgnAttr *rgnAttr, const char *text, int posX, int posY, int angle)
254+
void OSD::set_text(OSDItem *osdItem, IMPOSDRgnAttr *irgnAttr, const char *text, int posX, int posY, int angle)
255255
{
256256

257257
// size and stroke
@@ -279,21 +279,20 @@ void OSD::set_text(OSDItem *osdItem, IMPOSDRgnAttr *rgnAttr, const char *text, i
279279

280280
if (item_width != osdItem->width || item_height != osdItem->height)
281281
{
282-
if (rgnAttr == nullptr)
282+
if (irgnAttr == nullptr)
283283
{
284-
rgnAttr = new IMPOSDRgnAttr();
285-
IMP_OSD_GetRgnAttr(osdItem->imp_rgn, rgnAttr);
284+
IMP_OSD_GetRgnAttr(osdItem->imp_rgn, &osdItem->rgnAttr);
286285
}
287286

288-
set_pos(rgnAttr, posX, posY, item_width, item_height, stream_width, stream_height);
287+
set_pos(&osdItem->rgnAttr, posX, posY, item_width, item_height, stream_width, stream_height);
289288

290-
rgnAttr->data.picData.pData = osdItem->data;
291-
osdItem->rgnAttrData = &rgnAttr->data;
289+
osdItem->rgnAttr.data.picData.pData = osdItem->data;
290+
osdItem->rgnAttrData = &osdItem->rgnAttr.data;
292291

293292
osdItem->width = item_width;
294293
osdItem->height = item_height;
295294

296-
IMP_OSD_SetRgnAttr(osdItem->imp_rgn, rgnAttr);
295+
IMP_OSD_SetRgnAttr(osdItem->imp_rgn, &osdItem->rgnAttr);
297296
}
298297
else
299298
{
@@ -564,13 +563,12 @@ void OSD::init()
564563
IMP_OSD_RegisterRgn(osdTime.imp_rgn, osdGrp, nullptr);
565564
osd.regions.time = osdTime.imp_rgn;
566565

567-
IMPOSDRgnAttr rgnAttr;
568-
memset(&rgnAttr, 0, sizeof(IMPOSDRgnAttr));
569-
rgnAttr.type = OSD_REG_PIC;
570-
rgnAttr.fmt = PIX_FMT_BGRA;
571-
set_text(&osdTime, &rgnAttr, osd.time_format,
566+
memset(&osdTime.rgnAttr, 0, sizeof(IMPOSDRgnAttr));
567+
osdTime.rgnAttr.type = OSD_REG_PIC;
568+
osdTime.rgnAttr.fmt = PIX_FMT_BGRA;
569+
set_text(&osdTime, &osdTime.rgnAttr, osd.time_format,
572570
osd.pos_time_x, osd.pos_time_y, osd.time_rotation);
573-
IMP_OSD_SetRgnAttr(osdTime.imp_rgn, &rgnAttr);
571+
IMP_OSD_SetRgnAttr(osdTime.imp_rgn, &osdTime.rgnAttr);
574572

575573
IMPOSDGrpRgnAttr grpRgnAttr;
576574
memset(&grpRgnAttr, 0, sizeof(IMPOSDGrpRgnAttr));
@@ -603,13 +601,12 @@ void OSD::init()
603601
IMP_OSD_RegisterRgn(osdUser.imp_rgn, osdGrp, nullptr);
604602
osd.regions.user = osdUser.imp_rgn;
605603

606-
IMPOSDRgnAttr rgnAttr;
607-
memset(&rgnAttr, 0, sizeof(IMPOSDRgnAttr));
608-
rgnAttr.type = OSD_REG_PIC;
609-
rgnAttr.fmt = PIX_FMT_BGRA;
610-
set_text(&osdUser, &rgnAttr, osd.user_text_format,
604+
memset(&osdUser.rgnAttr, 0, sizeof(IMPOSDRgnAttr));
605+
osdUser.rgnAttr.type = OSD_REG_PIC;
606+
osdUser.rgnAttr.fmt = PIX_FMT_BGRA;
607+
set_text(&osdUser, &osdUser.rgnAttr, osd.user_text_format,
611608
osd.pos_user_text_x, osd.pos_user_text_y, osd.user_text_rotation);
612-
IMP_OSD_SetRgnAttr(osdUser.imp_rgn, &rgnAttr);
609+
IMP_OSD_SetRgnAttr(osdUser.imp_rgn, &osdUser.rgnAttr);
613610

614611
IMPOSDGrpRgnAttr grpRgnAttr;
615612
memset(&grpRgnAttr, 0, sizeof(IMPOSDGrpRgnAttr));
@@ -639,13 +636,12 @@ void OSD::init()
639636
IMP_OSD_RegisterRgn(osdUptm.imp_rgn, osdGrp, nullptr);
640637
osd.regions.uptime = osdUptm.imp_rgn;
641638

642-
IMPOSDRgnAttr rgnAttr;
643-
memset(&rgnAttr, 0, sizeof(IMPOSDRgnAttr));
644-
rgnAttr.type = OSD_REG_PIC;
645-
rgnAttr.fmt = PIX_FMT_BGRA;
646-
set_text(&osdUptm, &rgnAttr, osd.uptime_format,
639+
memset(&osdUptm.rgnAttr, 0, sizeof(IMPOSDRgnAttr));
640+
osdUptm.rgnAttr.type = OSD_REG_PIC;
641+
osdUptm.rgnAttr.fmt = PIX_FMT_BGRA;
642+
set_text(&osdUptm, &osdUptm.rgnAttr, osd.uptime_format,
647643
osd.pos_uptime_x, osd.pos_uptime_y, osd.uptime_rotation);
648-
IMP_OSD_SetRgnAttr(osdUptm.imp_rgn, &rgnAttr);
644+
IMP_OSD_SetRgnAttr(osdUptm.imp_rgn, &osdUptm.rgnAttr);
649645

650646
IMPOSDGrpRgnAttr grpRgnAttr;
651647
memset(&grpRgnAttr, 0, sizeof(IMPOSDGrpRgnAttr));
@@ -678,28 +674,27 @@ void OSD::init()
678674
IMP_OSD_RegisterRgn(osdLogo.imp_rgn, osdGrp, nullptr);
679675
osd.regions.logo = osdLogo.imp_rgn;
680676

681-
IMPOSDRgnAttr rgnAttr;
682-
memset(&rgnAttr, 0, sizeof(IMPOSDRgnAttr));
677+
memset(&osdLogo.rgnAttr, 0, sizeof(IMPOSDRgnAttr));
683678

684679
// Verify OSD logo size vs dimensions
685680
if ((osd.logo_width * osd.logo_height * 4) == (int)imageSize)
686681
{
687-
rgnAttr.type = OSD_REG_PIC;
688-
rgnAttr.fmt = PIX_FMT_BGRA;
689-
rgnAttr.data.picData.pData = imageData;
682+
osdLogo.rgnAttr.type = OSD_REG_PIC;
683+
osdLogo.rgnAttr.fmt = PIX_FMT_BGRA;
684+
osdLogo.rgnAttr.data.picData.pData = imageData;
690685

691686
// Logo rotation
692687
uint16_t logo_width = osd.logo_width;
693688
uint16_t logo_height = osd.logo_height;
694689
if (osd.logo_rotation)
695690
{
696-
uint8_t *imageData = static_cast<uint8_t *>(rgnAttr.data.picData.pData);
691+
uint8_t *imageData = static_cast<uint8_t *>(osdLogo.rgnAttr.data.picData.pData);
697692
rotateBGRAImage(imageData, logo_width,
698693
logo_height, osd.logo_rotation, false);
699-
rgnAttr.data.picData.pData = imageData;
694+
osdLogo.rgnAttr.data.picData.pData = imageData;
700695
}
701696

702-
set_pos(&rgnAttr, osd.pos_logo_x,
697+
set_pos(&osdLogo.rgnAttr, osd.pos_logo_x,
703698
osd.pos_logo_y, logo_width, logo_height, stream_width, stream_height);
704699
}
705700
else
@@ -708,7 +703,7 @@ void OSD::init()
708703
LOG_ERROR("Invalid OSD logo dimensions. Imagesize=" << imageSize << ", " << osd.logo_width
709704
<< "*" << osd.logo_height << "*4=" << (osd.logo_width * osd.logo_height * 4));
710705
}
711-
IMP_OSD_SetRgnAttr(osdLogo.imp_rgn, &rgnAttr);
706+
IMP_OSD_SetRgnAttr(osdLogo.imp_rgn, &osdLogo.rgnAttr);
712707

713708
IMPOSDGrpRgnAttr grpRgnAttr;
714709
memset(&grpRgnAttr, 0, sizeof(IMPOSDGrpRgnAttr));

‎src/OSD.hpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ struct OSDItem
2323
uint8_t *data;
2424
uint16_t width;
2525
uint16_t height;
26+
IMPOSDRgnAttr rgnAttr;
2627
IMPOSDRgnAttrData *rgnAttrData;
2728
};
2829

0 commit comments

Comments
 (0)