From 7d7c9ce06837f20d5585f1bc28a47701d12cf8ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Sun, 1 Mar 2026 10:53:21 +0200
Subject: [PATCH] glcolorconvert: Fix NULL pointer dereference on buffers
 without video meta

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4935
---
 .../gst-libs/gst/gl/gstglcolorconvert.c            | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/gst-libs/gst/gl/gstglcolorconvert.c b/gst-libs/gst/gl/gstglcolorconvert.c
index f2dc2dc7bbb..c13b4df69de 100644
--- a/gst-libs/gst/gl/gstglcolorconvert.c
+++ b/gst-libs/gst/gl/gstglcolorconvert.c
@@ -3428,10 +3428,12 @@ _init_convert (GstGLColorConvert * convert)
   }
 
   GstVideoMeta *v_meta = gst_buffer_get_video_meta (convert->inbuf);
-  if (v_meta->width != convert->priv->padded_width
-      || v_meta->height != convert->priv->padded_height) {
-    gdouble padded_width = v_meta->width;
-    gdouble padded_height = v_meta->height;
+  if ((v_meta && (v_meta->width != convert->priv->padded_width
+              || v_meta->height != convert->priv->padded_height)) ||
+      (!v_meta && (convert->in_info.width != convert->priv->padded_width ||
+              convert->in_info.height != convert->priv->padded_height))) {
+    gdouble padded_width = v_meta ? v_meta->width : convert->in_info.width;
+    gdouble padded_height = v_meta ? v_meta->height : convert->in_info.height;
     gdouble display_width = GST_VIDEO_INFO_WIDTH (&convert->in_info);
     gdouble display_height = GST_VIDEO_INFO_HEIGHT (&convert->in_info);
 
@@ -3449,8 +3451,8 @@ _init_convert (GstGLColorConvert * convert)
         crop_vertices, GL_STATIC_DRAW);
     gl->BindBuffer (GL_ARRAY_BUFFER, 0);
 
-    convert->priv->padded_width = v_meta->width;
-    convert->priv->padded_height = v_meta->height;
+    convert->priv->padded_width = padded_width;
+    convert->priv->padded_height = padded_height;
   }
 
   gl->BindTexture (GL_TEXTURE_2D, 0);
-- 
GitLab

