From fb4e9bc9a2a4490436270a4a6b1056e927250340 Mon Sep 17 00:00:00 2001
From: Aaron Golden <aegolden@google.com>
Date: Fri, 4 Jan 2019 12:03:31 -0800
Subject: [PATCH] Add a missing NULL check before releasing a texture ref.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This causes a crash if the NV12 texture cache attempts to upload textures
for a frame with a NULL backing CVPixelBufferRef.

Bug: webrtc:10175
Change-Id: I6866dcde5ace745cbd95b762254294aa8406c2a5
Reviewed-on: https://webrtc-review.googlesource.com/c/115430
Commit-Queue: Chuck Hays <haysc@webrtc.org>
Reviewed-by: Kári Helgason <kthelgason@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#26140}
---
 sdk/BUILD.gn                                  |  2 +
 .../renderer/opengl/RTCNV12TextureCache.m     |  6 ++-
 .../unittests/RTCNV12TextureCache_xctest.m    | 53 +++++++++++++++++++
 3 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 sdk/objc/unittests/RTCNV12TextureCache_xctest.m

diff --git a/sdk/BUILD.gn b/sdk/BUILD.gn
index 2498bb700a..1b47ba21ab 100644
--- a/sdk/BUILD.gn
+++ b/sdk/BUILD.gn
@@ -1036,6 +1036,7 @@ if (is_ios || is_mac) {
             "objc/unittests/RTCCallbackLogger_xctest.m",
             "objc/unittests/RTCFileVideoCapturer_xctest.mm",
             "objc/unittests/RTCH264ProfileLevelId_xctest.m",
+            "objc/unittests/RTCNV12TextureCache_xctest.m",
             "objc/unittests/RTCPeerConnectionFactory_xctest.m",
             "objc/unittests/frame_buffer_helpers.h",
             "objc/unittests/frame_buffer_helpers.mm",
@@ -1062,6 +1063,7 @@ if (is_ios || is_mac) {
             ":native_api_audio_device_module",
             ":native_video",
             ":peerconnectionfactory_base_objc",
+            ":video_objc",
             ":video_toolbox_cc",
             ":videocapture_objc",
             ":videocodec_objc",
diff --git a/sdk/objc/components/renderer/opengl/RTCNV12TextureCache.m b/sdk/objc/components/renderer/opengl/RTCNV12TextureCache.m
index 19213e548e..aab62d4363 100644
--- a/sdk/objc/components/renderer/opengl/RTCNV12TextureCache.m
+++ b/sdk/objc/components/renderer/opengl/RTCNV12TextureCache.m
@@ -60,8 +60,10 @@
       kCFAllocatorDefault, _textureCache, pixelBuffer, NULL, GL_TEXTURE_2D, pixelFormat, width,
       height, pixelFormat, GL_UNSIGNED_BYTE, planeIndex, textureOut);
   if (ret != kCVReturnSuccess) {
-    CFRelease(*textureOut);
-    *textureOut = nil;
+    if (*textureOut) {
+      CFRelease(*textureOut);
+      *textureOut = nil;
+    }
     return NO;
   }
   NSAssert(CVOpenGLESTextureGetTarget(*textureOut) == GL_TEXTURE_2D,
diff --git a/sdk/objc/unittests/RTCNV12TextureCache_xctest.m b/sdk/objc/unittests/RTCNV12TextureCache_xctest.m
new file mode 100644
index 0000000000..d5fa65b173
--- /dev/null
+++ b/sdk/objc/unittests/RTCNV12TextureCache_xctest.m
@@ -0,0 +1,53 @@
+/*
+ *  Copyright 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#import <CoreVideo/CoreVideo.h>
+#import <Foundation/Foundation.h>
+#import <GLKit/GLKit.h>
+#import <XCTest/XCTest.h>
+
+#import "base/RTCVideoFrame.h"
+#import "base/RTCVideoFrameBuffer.h"
+#import "components/renderer/opengl/RTCNV12TextureCache.h"
+#import "components/video_frame_buffer/RTCCVPixelBuffer.h"
+
+@interface RTCNV12TextureCacheTests : XCTestCase
+@end
+
+@implementation RTCNV12TextureCacheTests {
+  EAGLContext *_glContext;
+  RTCNV12TextureCache *_nv12TextureCache;
+}
+
+- (void)setUp {
+  [super setUp];
+  _glContext = [[EAGLContext alloc] initWithAPI:kEAGLRenderingAPIOpenGLES3];
+  if (!_glContext) {
+    _glContext = [[EAGLContext alloc] initWithAPI:kEAGLRenderingAPIOpenGLES2];
+  }
+  _nv12TextureCache = [[RTCNV12TextureCache alloc] initWithContext:_glContext];
+}
+
+- (void)tearDown {
+  _nv12TextureCache = nil;
+  _glContext = nil;
+  [super tearDown];
+}
+
+- (void)testNV12TextureCacheDoesNotCrashOnEmptyFrame {
+  CVPixelBufferRef nullPixelBuffer = NULL;
+  RTCCVPixelBuffer *badFrameBuffer = [[RTCCVPixelBuffer alloc] initWithPixelBuffer:nullPixelBuffer];
+  RTCVideoFrame *badFrame = [[RTCVideoFrame alloc] initWithBuffer:badFrameBuffer
+                                                         rotation:RTCVideoRotation_0
+                                                      timeStampNs:0];
+  [_nv12TextureCache uploadFrameToTextures:badFrame];
+}
+
+@end