[Bug 777503] New: mxfdemux: use after free in gst_mini_object_unref / gst_tag_list_unref / gst_mxf_demux_update_essence_tracks
GStreamer (GNOME Bugzilla)
bugzilla at gnome.org
Thu Jan 19 17:50:44 UTC 2017
https://bugzilla.gnome.org/show_bug.cgi?id=777503
Bug ID: 777503
Summary: mxfdemux: use after free in gst_mini_object_unref /
gst_tag_list_unref /
gst_mxf_demux_update_essence_tracks
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-bad
Assignee: gstreamer-bugs at lists.freedesktop.org
Reporter: hanno at hboeck.de
QA Contact: gstreamer-bugs at lists.freedesktop.org
GNOME version: ---
File:
https://samples.mplayerhq.hu/ffmpeg-bugs/roundup/issue591/02785736.mxf
Needs env var G_SLICE=always-malloc set to show up with asan.
asan error:
==28913==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000014d88
at pc 0x7f0975f7b2b0 bp 0x7f0968ab9280 sp 0x7f0968ab9278
READ of size 4 at 0x607000014d88 thread T2 (mxfdemux0:sink)
#0 0x7f0975f7b2af in gst_mini_object_unref
/f/gstreamer/gstreamer/gst/gstminiobject.c:432:3
#1 0x7f0968db06c9 in gst_tag_list_unref
/usr/include/gstreamer-1.0/gst/gsttaglist.h:407:3
#2 0x7f0968db06c9 in gst_mxf_demux_update_essence_tracks
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:873
#3 0x7f0968db06c9 in gst_mxf_demux_update_tracks
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:915
#4 0x7f0968da563e in gst_mxf_demux_handle_klv_packet
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2484:16
#5 0x7f0968dc79c7 in gst_mxf_demux_pull_and_handle_klv_packet
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2925:9
#6 0x7f0968dc79c7 in gst_mxf_demux_loop
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:3030
#7 0x7f0976067883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#8 0x7f0975264b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#9 0x7f0975264154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#10 0x7f0974ce2453 in start_thread (/lib64/libpthread.so.0+0x7453)
#11 0x7f09748125dc in clone (/lib64/libc.so.6+0xe75dc)
0x607000014d88 is located 8 bytes inside of 80-byte region
[0x607000014d80,0x607000014dd0)
freed by thread T2 (mxfdemux0:sink) here:
#0 0x4cba00 in __interceptor_cfree.localalias.1
(/usr/bin/gst-discoverer-1.0+0x4cba00)
#1 0x7f0976061ce9 in __gst_tag_list_free
/f/gstreamer/gstreamer/gst/gsttaglist.c:717:3
#2 0x7f0975f7b238 in gst_mini_object_unref
/f/gstreamer/gstreamer/gst/gstminiobject.c:456:9
#3 0x7f0968db05e1 in gst_tag_list_unref
/usr/include/gstreamer-1.0/gst/gsttaglist.h:407:3
#4 0x7f0968db05e1 in gst_mxf_demux_update_essence_tracks
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:837
#5 0x7f0968db05e1 in gst_mxf_demux_update_tracks
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:915
#6 0x7f0968da563e in gst_mxf_demux_handle_klv_packet
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2484:16
#7 0x7f0968dc79c7 in gst_mxf_demux_pull_and_handle_klv_packet
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2925:9
#8 0x7f0968dc79c7 in gst_mxf_demux_loop
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:3030
#9 0x7f0976067883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#10 0x7f0975264b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#11 0x7f0975264154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#12 0x7f0974ce2453 in start_thread (/lib64/libpthread.so.0+0x7453)
#13 0x7f09748125dc in clone (/lib64/libc.so.6+0xe75dc)
previously allocated by thread T2 (mxfdemux0:sink) here:
#0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
#1 0x7f0975242768 in g_malloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94
#2 0x7f097525a4d2 in g_slice_alloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gslice.c:1025
#3 0x7f09760565cc in gst_tag_list_new_internal
/f/gstreamer/gstreamer/gst/gsttaglist.c:690:29
#4 0x7f09760565cc in gst_tag_list_new_empty
/f/gstreamer/gstreamer/gst/gsttaglist.c:748
#5 0x7f0968dd84a9 in mxf_bwf_create_caps
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfaes-bwf.c:1339:13
#6 0x7f0968dd84a9 in mxf_aes_bwf_create_caps
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfaes-bwf.c:1457
#7 0x7f0968dafb82 in gst_mxf_demux_update_essence_tracks
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:826:13
#8 0x7f0968dafb82 in gst_mxf_demux_update_tracks
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:915
#9 0x7f0968da563e in gst_mxf_demux_handle_klv_packet
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2484:16
#10 0x7f0968dc79c7 in gst_mxf_demux_pull_and_handle_klv_packet
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2925:9
#11 0x7f0968dc79c7 in gst_mxf_demux_loop
/f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:3030
#12 0x7f0976067883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#13 0x7f0975264b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#14 0x7f0975264154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#15 0x7f0974ce2453 in start_thread (/lib64/libpthread.so.0+0x7453)
#16 0x7f09748125dc in clone (/lib64/libc.so.6+0xe75dc)
Thread T2 (mxfdemux0:sink) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f09752811bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170
Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f09752811bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170
SUMMARY: AddressSanitizer: heap-use-after-free
/f/gstreamer/gstreamer/gst/gstminiobject.c:432:3 in gst_mini_object_unref
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
More information about the gstreamer-bugs
mailing list