Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in / Register
  • VLC VLC
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 3,414
    • Issues 3,414
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 162
    • Merge requests 162
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • VideoLAN
  • VLCVLC
  • Issues
  • #22240

Closed
Open
Created Apr 29, 2019 by François Cartegnie@fcartegnie🤞Developer

avcodec picture copy heap-buffer-overflow

https://wowzaec2demo.streamlock.net/vod-multitrack/_definst_/smil:ElephantsDream/elephantsdream2.smil/playlist.m3u

=================================================================
==6610==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63000034f74f at pc 0x7f669c45ebe7 bp 0x7f6660706630 sp 0x7f6660705dd8
READ of size 384 at 0x63000034f74f thread T53
    [#0](https://code.videolan.org/videolan/vlc/-/issues/0) 0x7f669c45ebe6  (/lib64/libasan.so.5+0x40be6)
    [#1](https://code.videolan.org/videolan/vlc/-/issues/1) 0x7f66630ed2e8 in lavc_CopyPicture codec/avcodec/video.c:435
    [#2](https://code.videolan.org/videolan/vlc/-/issues/2) 0x7f66630fc01b in DecodeBlock codec/avcodec/video.c:1259
    [#3](https://code.videolan.org/videolan/vlc/-/issues/3) 0x7f66630fd56b in DecodeVideo codec/avcodec/video.c:1356
    [#4](https://code.videolan.org/videolan/vlc/-/issues/4) 0x7f669b685009 in DecoderDecode input/decoder.c:1307
    [#5](https://code.videolan.org/videolan/vlc/-/issues/5) 0x7f669b68605d in DecoderProcess input/decoder.c:1430
    [#6](https://code.videolan.org/videolan/vlc/-/issues/6) 0x7f669b6893ac in DecoderThread input/decoder.c:1690
    [#7](https://code.videolan.org/videolan/vlc/-/issues/7) 0x7f669a1d858d in start_thread (/lib64/libpthread.so.0+0x858d)
    [#8](https://code.videolan.org/videolan/vlc/-/issues/8) 0x7f669a107682 in clone (/lib64/libc.so.6+0xfd682)

0x63000034f74f is located 0 bytes to the right of 62287-byte region [0x630000340400,0x63000034f74f)
allocated by thread T49 here:
    [#0](https://code.videolan.org/videolan/vlc/-/issues/0) 0x7f669c50ea20 in __interceptor_posix_memalign (/lib64/libasan.so.5+0xf0a20)
    [#1](https://code.videolan.org/videolan/vlc/-/issues/1) 0x7f6663a4b116 in av_malloc libavutil/mem.c:87

Thread T53 created by T12 here:
    [#0](https://code.videolan.org/videolan/vlc/-/issues/0) 0x7f669c470f63 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52f63)
    [#1](https://code.videolan.org/videolan/vlc/-/issues/1) 0x7f669b90f35f in vlc_clone_attr posix/thread.c:421
    [#2](https://code.videolan.org/videolan/vlc/-/issues/2) 0x7f669b90f54a in vlc_clone posix/thread.c:433
    [#3](https://code.videolan.org/videolan/vlc/-/issues/3) 0x7f669b68ecb8 in decoder_New input/decoder.c:2069
    [#4](https://code.videolan.org/videolan/vlc/-/issues/4) 0x7f669b68ee23 in input_DecoderNew input/decoder.c:2091
    [#5](https://code.videolan.org/videolan/vlc/-/issues/5) 0x7f669b6bf1c7 in EsOutCreateDecoder input/es_out.c:1824
    [#6](https://code.videolan.org/videolan/vlc/-/issues/6) 0x7f669b6c0d3e in EsOutSelectEs input/es_out.c:1937
    [#7](https://code.videolan.org/videolan/vlc/-/issues/7) 0x7f669b6c42a0 in EsOutSelect input/es_out.c:2169
    [#8](https://code.videolan.org/videolan/vlc/-/issues/8) 0x7f669b6ca166 in EsOutVaControlLocked input/es_out.c:2528
    [#9](https://code.videolan.org/videolan/vlc/-/issues/9) 0x7f669b6d5112 in EsOutControl input/es_out.c:3196
    [#10](https://code.videolan.org/videolan/vlc/-/issues/10) 0x7f669b6dc7d1 in es_out_vaControl ../include/vlc_es_out.h:158
    [#11](https://code.videolan.org/videolan/vlc/-/issues/11) 0x7f669b6dc8f1 in es_out_Control ../include/vlc_es_out.h:167
    [#12](https://code.videolan.org/videolan/vlc/-/issues/12) 0x7f669b6f0835 in CmdExecuteControl input/es_out_timeshift.c:1556
    [#13](https://code.videolan.org/videolan/vlc/-/issues/13) 0x7f669b6e16dd in ControlLocked input/es_out_timeshift.c:638
    [#14](https://code.videolan.org/videolan/vlc/-/issues/14) 0x7f669b6e3865 in Control input/es_out_timeshift.c:764
    [#15](https://code.videolan.org/videolan/vlc/-/issues/15) 0x7f669b6f461e in es_out_vaControl ../include/vlc_es_out.h:158
    [#16](https://code.videolan.org/videolan/vlc/-/issues/16) 0x7f669b6f473e in es_out_Control ../include/vlc_es_out.h:167
    [#17](https://code.videolan.org/videolan/vlc/-/issues/17) 0x7f669b6f8351 in es_out_SetMode input/es_out.h:97
    [#18](https://code.videolan.org/videolan/vlc/-/issues/18) 0x7f669b7082cd in InitPrograms input/input.c:1335
    [#19](https://code.videolan.org/videolan/vlc/-/issues/19) 0x7f669b7091f4 in Init input/input.c:1416
    [#20](https://code.videolan.org/videolan/vlc/-/issues/20) 0x7f669b6fdcc7 in Run input/input.c:563
    [#21](https://code.videolan.org/videolan/vlc/-/issues/21) 0x7f669a1d858d in start_thread (/lib64/libpthread.so.0+0x858d)

Thread T12 created by T0 here:
    [#0](https://code.videolan.org/videolan/vlc/-/issues/0) 0x7f669c470f63 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52f63)
    [#1](https://code.videolan.org/videolan/vlc/-/issues/1) 0x7f669b90f35f in vlc_clone_attr posix/thread.c:421
    [#2](https://code.videolan.org/videolan/vlc/-/issues/2) 0x7f669b90f54a in vlc_clone posix/thread.c:433
    [#3](https://code.videolan.org/videolan/vlc/-/issues/3) 0x7f669b6f9140 in input_Start input/input.c:200
    [#4](https://code.videolan.org/videolan/vlc/-/issues/4) 0x7f669b72cc4f in vlc_player_input_Start input/player.c:703
    [#5](https://code.videolan.org/videolan/vlc/-/issues/5) 0x7f669b74c8cc in vlc_player_Start input/player.c:2207
    [#6](https://code.videolan.org/videolan/vlc/-/issues/6) 0x7f669b622411 in vlc_playlist_Start playlist/player.c:164
    [#7](https://code.videolan.org/videolan/vlc/-/issues/7) 0x7f669b5e983c in libvlc_InternalPlay interface/interface.c:269
    [#8](https://code.videolan.org/videolan/vlc/-/issues/8) 0x7f669c332beb in libvlc_playlist_play /home/fcartegn/vlcsource/vlc/lib/playlist.c:38
    [#9](https://code.videolan.org/videolan/vlc/-/issues/9) 0x40333e in main /home/fcartegn/vlcsource/vlc/bin/vlc.c:248
    [#10](https://code.videolan.org/videolan/vlc/-/issues/10) 0x7f669a02e412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Thread T49 created by T12 here:
    [#0](https://code.videolan.org/videolan/vlc/-/issues/0) 0x7f669c470f63 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52f63)
    [#1](https://code.videolan.org/videolan/vlc/-/issues/1) 0x7f66633c1db1 in ff_frame_thread_init libavcodec/pthread_frame.c:828

SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x40be6) 
Shadow bytes around the buggy address:
  0x0c6080061e90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c6080061ea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c6080061eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c6080061ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c6080061ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c6080061ee0: 00 00 00 00 00 00 00 00 00[07]fa fa fa fa fa fa
  0x0c6080061ef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c6080061f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c6080061f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c6080061f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c6080061f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==6610==ABORTING
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking

VideoLAN code repository instance