Hi

56d9ca69d7f229dccee6ad47c67a37f558196fb7 introduces a "use after free"

with a srt file as input like this:
1
00:00:00,000 --> 00:00:01,000
Test

valgrind ./ffmpeg_g  -i test.srt  -f hls t.m3u8

you get this in about 50% of the runs

I noticed this issue when debuging the format string issue submited by Sarthak 
Munshi

==3961210== Thread 2:
==3961210== Invalid read of size 1
==3961210==    at 0x4853DF0: __memcpy_chk (in 
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3961210==    by 0x324297: enc_open (in ffmpeg/ffmpeg_g)
==3961210==    by 0x325F59: encoder_thread (in ffmpeg/ffmpeg_g)
==3961210==    by 0x33E9AF: task_wrapper (in ffmpeg/ffmpeg_g)
==3961210==    by 0x740BAA3: start_thread (pthread_create.c:447)
==3961210==    by 0x7498A63: clone (clone.S:100)
==3961210==  Address 0xca93ac4 is 580 bytes inside a block of size 582 free'd
==3961210==    at 0x484988F: free (in 
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3961210==    by 0x29824A: ff_codec_close (in ffmpeg/ffmpeg_g)
==3961210==    by 0xD101FC: avcodec_free_context (in ffmpeg/ffmpeg_g)
==3961210==    by 0x31C768: decoder_thread (in ffmpeg/ffmpeg_g)
==3961210==    by 0x33E9AF: task_wrapper (in ffmpeg/ffmpeg_g)
==3961210==    by 0x740BAA3: start_thread (pthread_create.c:447)
==3961210==    by 0x7498A63: clone (clone.S:100)
==3961210==  Block was alloc'd at
==3961210==    at 0x484E366: posix_memalign (in 
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3961210==    by 0x1871164: av_malloc (in ffmpeg/ffmpeg_g)
==3961210==    by 0x184E70A: av_asprintf (in ffmpeg/ffmpeg_g)
==3961210==    by 0x1301482: ff_ass_subtitle_header_full (in ffmpeg/ffmpeg_g)
==3961210==    by 0x13014FA: ff_ass_subtitle_header (in ffmpeg/ffmpeg_g)
==3961210==    by 0x130152B: ff_ass_subtitle_header_default (in ffmpeg/ffmpeg_g)
==3961210==    by 0x9464B6: avcodec_open2 (in ffmpeg/ffmpeg_g)
==3961210==    by 0x31B996: dec_open (in ffmpeg/ffmpeg_g)
==3961210==    by 0x31E23F: dec_init (in ffmpeg/ffmpeg_g)
==3961210==    by 0x3212D5: ist_use (in ffmpeg/ffmpeg_g)
==3961210==    by 0x331FAC: ost_add (in ffmpeg/ffmpeg_g)
==3961210==    by 0x333E40: map_auto_subtitle (in ffmpeg/ffmpeg_g)
==3961210==
==3961210== Invalid read of size 1
==3961210==    at 0x4853DFD: __memcpy_chk (in 
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3961210==    by 0x324297: enc_open (in ffmpeg/ffmpeg_g)
==3961210==    by 0x325F59: encoder_thread (in ffmpeg/ffmpeg_g)
==3961210==    by 0x33E9AF: task_wrapper (in ffmpeg/ffmpeg_g)
==3961210==    by 0x740BAA3: start_thread (pthread_create.c:447)
==3961210==    by 0x7498A63: clone (clone.S:100)
==3961210==  Address 0xca93ac2 is 578 bytes inside a block of size 582 free'd
==3961210==    at 0x484988F: free (in 
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3961210==    by 0x29824A: ff_codec_close (in ffmpeg/ffmpeg_g)
==3961210==    by 0xD101FC: avcodec_free_context (in ffmpeg/ffmpeg_g)
==3961210==    by 0x31C768: decoder_thread (in ffmpeg/ffmpeg_g)
==3961210==    by 0x33E9AF: task_wrapper (in ffmpeg/ffmpeg_g)
==3961210==    by 0x740BAA3: start_thread (pthread_create.c:447)
==3961210==    by 0x7498A63: clone (clone.S:100)
==3961210==  Block was alloc'd at
==3961210==    at 0x484E366: posix_memalign (in 
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3961210==    by 0x1871164: av_malloc (in ffmpeg/ffmpeg_g)
==3961210==    by 0x184E70A: av_asprintf (in ffmpeg/ffmpeg_g)
==3961210==    by 0x1301482: ff_ass_subtitle_header_full (in ffmpeg/ffmpeg_g)
==3961210==    by 0x13014FA: ff_ass_subtitle_header (in ffmpeg/ffmpeg_g)
==3961210==    by 0x130152B: ff_ass_subtitle_header_default (in ffmpeg/ffmpeg_g)
==3961210==    by 0x9464B6: avcodec_open2 (in ffmpeg/ffmpeg_g)
==3961210==    by 0x31B996: dec_open (in ffmpeg/ffmpeg_g)
==3961210==    by 0x31E23F: dec_init (in ffmpeg/ffmpeg_g)
==3961210==    by 0x3212D5: ist_use (in ffmpeg/ffmpeg_g)
==3961210==    by 0x331FAC: ost_add (in ffmpeg/ffmpeg_g)
==3961210==    by 0x333E40: map_auto_subtitle (in ffmpeg/ffmpeg_g)



[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.

Attachment: signature.asc
Description: PGP signature

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to