Skip to content

use-after-free in DeleteOne test

During the asab/ubsan test: https://code.videolan.org/videolan/medialibrary/-/jobs/643294

Hopefully that might be the same defect that sometimes causes the windows tests to fail on this specific case

363/583 medialibrary:unittest+RemovalNotifier / RemovalNotifier.DeleteOne              FAIL           2.90s (exit status 1)

--- command ---
04:12:26 /builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests DeleteOne
--- stdout ---
Test DeleteOne failed: Invalid comparison at ../test/unittest/RemovalNotifierTests.cpp at line 125
( hasTimedout ) != false
	Actual values: 1 != 0
=================================================================
==103473==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000000460 at pc 0x7f709a6a3761 bp 0x7f70925cd2a0 sp 0x7f70925cd298
READ of size 8 at 0x60b000000460 thread T1
    #0 0x7f709a6a3760 in void medialibrary::ModificationNotifier::notify<medialibrary::IMedia, void (medialibrary::IMediaLibraryCb::*)(std::vector<std::shared_ptr<medialibrary::IMedia>, std::allocator<std::shared_ptr<medialibrary::IMedia> > >), void (medialibrary::IMediaLibraryCb::*)(std::set<long, std::less<long>, std::allocator<long> >), void (medialibrary::IMediaLibraryCb::*)(std::set<long, std::less<long>, std::allocator<long> >)>(medialibrary::ModificationNotifier::Queue<medialibrary::IMedia, void>&&, void (medialibrary::IMediaLibraryCb::*)(std::vector<std::shared_ptr<medialibrary::IMedia>, std::allocator<std::shared_ptr<medialibrary::IMedia> > >), void (medialibrary::IMediaLibraryCb::*)(std::set<long, std::less<long>, std::allocator<long> >), void (medialibrary::IMediaLibraryCb::*)(std::set<long, std::less<long>, std::allocator<long> >)) (/builds/videolan/medialibrary/build/test/unittest/../../src/libmedialibrary.so.0+0x2c6b760)
    #1 0x7f709a6978c4 in medialibrary::ModificationNotifier::run() ../src/utils/ModificationsNotifier.cpp:237
    #2 0x7f709a6c5f6b in void std::__invoke_impl<void, void (medialibrary::ModificationNotifier::*)(), medialibrary::ModificationNotifier*>(std::__invoke_memfun_deref, void (medialibrary::ModificationNotifier::*&&)(), medialibrary::ModificationNotifier*&&) (/builds/videolan/medialibrary/build/test/unittest/../../src/libmedialibrary.so.0+0x2c8df6b)
    #3 0x7f709a6c5a17 in std::__invoke_result<void (medialibrary::ModificationNotifier::*)(), medialibrary::ModificationNotifier*>::type std::__invoke<void (medialibrary::ModificationNotifier::*)(), medialibrary::ModificationNotifier*>(void (medialibrary::ModificationNotifier::*&&)(), medialibrary::ModificationNotifier*&&) (/builds/videolan/medialibrary/build/test/unittest/../../src/libmedialibrary.so.0+0x2c8da17)
    #4 0x7f709a6c5823 in void std::thread::_Invoker<std::tuple<void (medialibrary::ModificationNotifier::*)(), medialibrary::ModificationNotifier*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (/builds/videolan/medialibrary/build/test/unittest/../../src/libmedialibrary.so.0+0x2c8d823)
    #5 0x7f709a6c56bc in std::thread::_Invoker<std::tuple<void (medialibrary::ModificationNotifier::*)(), medialibrary::ModificationNotifier*> >::operator()() (/builds/videolan/medialibrary/build/test/unittest/../../src/libmedialibrary.so.0+0x2c8d6bc)
    #6 0x7f709a6c5678 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (medialibrary::ModificationNotifier::*)(), medialibrary::ModificationNotifier*> > >::_M_run() (/builds/videolan/medialibrary/build/test/unittest/../../src/libmedialibrary.so.0+0x2c8d678)
    #7 0x7f70977f6ecf  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xceecf)
    #8 0x7f7096d88ea6 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8ea6)
    #9 0x7f7096cb8dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)

0x60b000000460 is located 0 bytes inside of 104-byte region [0x60b000000460,0x60b0000004c8)
freed by thread T0 here:
    #0 0x7f709d4e1467 in operator delete(void*, unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:172
    #1 0x55dc4535c6b4 in MockCallback::~MockCallback() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1cc6b4)
    #2 0x55dc4535c875 in std::default_delete<MockCallback>::operator()(MockCallback*) const (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1cc875)
    #3 0x55dc45358269 in std::unique_ptr<MockCallback, std::default_delete<MockCallback> >::~unique_ptr() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c8269)
    #4 0x55dc453510c6 in UnitTests<MockCallback>::~UnitTests() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c10c6)
    #5 0x55dc45358814 in RemovalNotifierTests::~RemovalNotifierTests() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c8814)
    #6 0x55dc45358833 in RemovalNotifierTests::~RemovalNotifierTests() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c8833)
    #7 0x55dc45358a05 in std::default_delete<RemovalNotifierTests>::operator()(RemovalNotifierTests*) const (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c8a05)
    #8 0x55dc453514b1 in std::unique_ptr<RemovalNotifierTests, std::default_delete<RemovalNotifierTests> >::~unique_ptr() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c14b1)
    #9 0x55dc4533e2b6 in main ../test/unittest/RemovalNotifierTests.cpp:173
    #10 0x7f7096be1d09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26d09)

previously allocated by thread T0 here:
    #0 0x7f709d4e0647 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x55dc45351ec0 in UnitTests<MockCallback>::SetUp(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c1ec0)
    #2 0x55dc4533d579 in main ../test/unittest/RemovalNotifierTests.cpp:175
    #3 0x7f7096be1d09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26d09)

Thread T1 created by T0 here:
    #0 0x7f709d48a2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
    #1 0x7f70977f7144 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xcf144)
    #2 0x7f709a693c60 in medialibrary::ModificationNotifier::start() ../src/utils/ModificationsNotifier.cpp:58
    #3 0x7f709a1b5180 in medialibrary::MediaLibrary::startDeletionNotifier() ../src/MediaLibrary.cpp:1158
    #4 0x55dc4534070c in MediaLibraryWithNotifier::startDeletionNotifier() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1b070c)
    #5 0x7f709a1a7d55 in medialibrary::MediaLibrary::initialize(medialibrary::IMediaLibraryCb*) ../src/MediaLibrary.cpp:573
    #6 0x55dc45359cef in UnitTests<MockCallback>::Initialize() (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c9cef)
    #7 0x55dc45352b0c in UnitTests<MockCallback>::SetUp(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/builds/videolan/medialibrary/build/test/unittest/removal_notifier_tests+0x1c2b0c)
    #8 0x55dc4533d579 in main ../test/unittest/RemovalNotifierTests.cpp:175
    #9 0x7f7096be1d09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26d09)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

VideoLAN code repository instance