media: ffmpeg: Remove AsMut from AvFrame.

This is actually highly unsound since it allows you to write arbitrary
garbage to the buffer pointer fields.

BUG=None
TEST=cargo test -p ffmpeg &&
     cargo test --features "video-decoder,ffmpeg" -p devices video
     + v4l2r test from crosvm book

Change-Id: I77bd32b856afef8538791a99829f7248cd77787e
Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3822433
Tested-by: Tatsuyuki Ishi <ishitatsuyuki@google.com>
Reviewed-by: Alexandre Courbot <acourbot@chromium.org>
Commit-Queue: Tatsuyuki Ishi <ishitatsuyuki@google.com>
This commit is contained in:
Tatsuyuki Ishi 2022-08-10 13:12:01 +09:00 committed by crosvm LUCI
parent 894b15044d
commit 96e98ef882

View file

@ -359,7 +359,7 @@ impl AvCodecContext {
) -> Result<TryReceiveFrameResult, AvError> {
// Safe because the context is valid through the life of this object, and `avframe` is
// guaranteed to contain a properly initialized frame.
match unsafe { ffi::avcodec_receive_frame(self.0, frame.as_mut()) } {
match unsafe { ffi::avcodec_receive_frame(self.0, frame.0) } {
AVERROR_EAGAIN => Ok(TryReceiveFrameResult::TryAgain),
AVERROR_EOF => Ok(TryReceiveFrameResult::FlushCompleted),
ret if ret >= 0 => Ok(TryReceiveFrameResult::Received),
@ -564,13 +564,6 @@ impl AsRef<ffi::AVFrame> for AvFrame {
}
}
impl AsMut<ffi::AVFrame> for AvFrame {
fn as_mut(&mut self) -> &mut ffi::AVFrame {
// Safe because the AVFrame has been properly initialized during construction.
unsafe { &mut *self.0 }
}
}
impl Deref for AvFrame {
type Target = ffi::AVFrame;