mmal: Fix picture passing through mmal

Assign the picture pointer to mmal buffers user_data right before passing it
into mmal instead of doing it in mmal_picture_lock. This is necessary, because
the picture pointer used to call mmal_picture_lock points to the original
picture instance, while the picture handed to the plugins from
picture_pool_Get is a clone of the original picture. Assigning the picture in
user_data caused picture_Release to be called on the original instead of the
clone. Since commit 22e61f10 this is fatal as the pf_destroy pointer is not
pointing to picture_pool_ReleasePicture anymore.

Signed-off-by: Julian Scheel <julian@jusst.de>
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

modules/hw/mmal/codec.c

@@ -455,7 +455,6 @@ static int send_output_buffer(decoder_t *dec)
 
     if (sys->output_pool) {
         mmal_buffer_header_reset(buffer);
-        buffer->user_data = picture;
         buffer->alloc_size = sys->output->buffer_size;
         if (buffer_size < sys->output->buffer_size) {
             msg_Err(dec, "Retrieved picture with too small data block (%d < %d)",
@@ -475,6 +474,7 @@ static int send_output_buffer(decoder_t *dec)
         }
         buffer->data = p_sys->buffer->data;
     }
+    buffer->user_data = picture;
     buffer->cmd = 0;
 
     status = mmal_port_send_buffer(sys->output, buffer);

modules/hw/mmal/deinterlace.c

@@ -305,6 +305,7 @@ static int send_output_buffer(filter_t *filter)
     picture->format.i_frame_rate_base = filter->fmt_out.video.i_frame_rate_base;
 
     buffer = picture->p_sys->buffer;
+    buffer->user_data = picture;
     buffer->cmd = 0;
 
     mmal_picture_lock(picture);

modules/hw/mmal/mmal_picture.c

@@ -32,8 +32,6 @@ int mmal_picture_lock(picture_t *picture)
     picture_sys_t *pic_sys = picture->p_sys;
     MMAL_BUFFER_HEADER_T *buffer = pic_sys->buffer;
 
-    buffer->user_data = picture;
-
     int offset = 0;
     picture->p[0].p_pixels = buffer->data;
     for (int i = 1; i < picture->i_planes; i++) {

modules/hw/mmal/vout.c

@@ -572,6 +572,7 @@ static void vd_display(vout_display_t *vd, picture_t *picture,
     if (!pic_sys->displayed || !sys->opaque) {
         buffer->cmd = 0;
         buffer->length = sys->input->buffer_size;
+        buffer->user_data = picture;
 
         status = mmal_port_send_buffer(sys->input, buffer);
         if (status == MMAL_SUCCESS)