Skip to content

Test suite fails due to use-after-free

FAIL: test_libvlc_media
=======================

[000060e000000040] main libvlc warning: cannot read /home/remi/videolan/vlc/build/src/.libs/vlc/plugins/plugins.dat: No such file or directory
=================================================================
==151684==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200002b4f4 at pc 0x7f7a265a7857 bp 0x7f7a222f8180 sp 0x7f7a222f8178
READ of size 1 at 0x60200002b4f4 thread T7
    #0 0x7f7a265a7856 in libvlc_media_get_stat ../../lib/media.c:871
    #1 0x564efd4405af in subitem_added ../../test/libvlc/media.c:245
    #2 0x7f7a2659fafe in libvlc_event_send ../../lib/event.c:117
    #3 0x7f7a265a19ad in input_item_add_subitem ../../lib/media.c:182
    #4 0x7f7a265a1f92 in input_item_add_subnode ../../lib/media.c:240
    #5 0x7f7a265a26d9 in libvlc_media_add_subtree ../../lib/media.c:288
    #6 0x7f7a265a2608 in input_item_subtree_added ../../lib/media.c:283
    #7 0x7f7a26c913bf in OnParserSubtreeAdded ../../src/preparser/preparser.c:165
    #8 0x7f7a26caa00d in input_item_parser_InputEvent ../../src/input/item.c:1367
    #9 0x7f7a26cf54e3 in input_SendEvent ../../src/input/event.h:35
    #10 0x7f7a26cf756c in input_SendEventParsing ../../src/input/event.h:255
    #11 0x7f7a26d2c8bc in EsOutVaControlLocked ../../src/input/es_out.c:3612
    #12 0x7f7a26d34132 in EsOutControl ../../src/input/es_out.c:3990
    #13 0x7f7a26d3e9d9 in es_out_in_vaControl ../../src/input/es_out_timeshift.c:513
    #14 0x7f7a26d41667 in ControlLocked ../../src/input/es_out_timeshift.c:743
    #15 0x7f7a26d41b52 in Control ../../src/input/es_out_timeshift.c:772
    #16 0x7f7a26cebc38 in es_out_vaControl ../../include/vlc_es_out.h:166
    #17 0x7f7a26cebd6e in es_out_Control ../../include/vlc_es_out.h:175
    #18 0x7f7a26cee049 in demux_Demux ../../src/input/demux.c:225
    #19 0x7f7a26d5ec2d in MainLoopDemux ../../src/input/input.c:543
    #20 0x7f7a26d61110 in MainLoop ../../src/input/input.c:690
    #21 0x7f7a26d5e6c9 in Preparse ../../src/input/input.c:497
    #22 0x7f7a26509ea6 in start_thread nptl/pthread_create.c:477
    #23 0x7f7a26439dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)

0x60200002b4f4 is located 4 bytes inside of 5-byte region [0x60200002b4f0,0x60200002b4f5)
freed by thread T7 here:
    #0 0x7f7a281cfb6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
    #1 0x7f7a265a77e6 in libvlc_media_get_stat ../../lib/media.c:869
    #2 0x564efd4405af in subitem_added ../../test/libvlc/media.c:245
    #3 0x7f7a2659fafe in libvlc_event_send ../../lib/event.c:117
    #4 0x7f7a265a19ad in input_item_add_subitem ../../lib/media.c:182
    #5 0x7f7a265a1f92 in input_item_add_subnode ../../lib/media.c:240
    #6 0x7f7a265a26d9 in libvlc_media_add_subtree ../../lib/media.c:288
    #7 0x7f7a265a2608 in input_item_subtree_added ../../lib/media.c:283
    #8 0x7f7a26c913bf in OnParserSubtreeAdded ../../src/preparser/preparser.c:165
    #9 0x7f7a26caa00d in input_item_parser_InputEvent ../../src/input/item.c:1367
    #10 0x7f7a26cf54e3 in input_SendEvent ../../src/input/event.h:35
    #11 0x7f7a26cf756c in input_SendEventParsing ../../src/input/event.h:255
    #12 0x7f7a26d2c8bc in EsOutVaControlLocked ../../src/input/es_out.c:3612
    #13 0x7f7a26d34132 in EsOutControl ../../src/input/es_out.c:3990
    #14 0x7f7a26d3e9d9 in es_out_in_vaControl ../../src/input/es_out_timeshift.c:513
    #15 0x7f7a26d41667 in ControlLocked ../../src/input/es_out_timeshift.c:743
    #16 0x7f7a26d41b52 in Control ../../src/input/es_out_timeshift.c:772
    #17 0x7f7a26cebc38 in es_out_vaControl ../../include/vlc_es_out.h:166
    #18 0x7f7a26cebd6e in es_out_Control ../../include/vlc_es_out.h:175
    #19 0x7f7a26cee049 in demux_Demux ../../src/input/demux.c:225
    #20 0x7f7a26d5ec2d in MainLoopDemux ../../src/input/input.c:543
    #21 0x7f7a26d61110 in MainLoop ../../src/input/input.c:690
    #22 0x7f7a26d5e6c9 in Preparse ../../src/input/input.c:497
    #23 0x7f7a26509ea6 in start_thread nptl/pthread_create.c:477

previously allocated by thread T7 here:
    #0 0x7f7a2817d817 in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:452
    #1 0x7f7a26c9fac7 in input_item_GetInfo ../../src/input/item.c:706
    #2 0x7f7a265a7784 in libvlc_media_get_stat ../../lib/media.c:863
    #3 0x564efd4405af in subitem_added ../../test/libvlc/media.c:245
    #4 0x7f7a2659fafe in libvlc_event_send ../../lib/event.c:117
    #5 0x7f7a265a19ad in input_item_add_subitem ../../lib/media.c:182
    #6 0x7f7a265a1f92 in input_item_add_subnode ../../lib/media.c:240
    #7 0x7f7a265a26d9 in libvlc_media_add_subtree ../../lib/media.c:288
    #8 0x7f7a265a2608 in input_item_subtree_added ../../lib/media.c:283
    #9 0x7f7a26c913bf in OnParserSubtreeAdded ../../src/preparser/preparser.c:165
    #10 0x7f7a26caa00d in input_item_parser_InputEvent ../../src/input/item.c:1367
    #11 0x7f7a26cf54e3 in input_SendEvent ../../src/input/event.h:35
    #12 0x7f7a26cf756c in input_SendEventParsing ../../src/input/event.h:255
    #13 0x7f7a26d2c8bc in EsOutVaControlLocked ../../src/input/es_out.c:3612
    #14 0x7f7a26d34132 in EsOutControl ../../src/input/es_out.c:3990
    #15 0x7f7a26d3e9d9 in es_out_in_vaControl ../../src/input/es_out_timeshift.c:513
    #16 0x7f7a26d41667 in ControlLocked ../../src/input/es_out_timeshift.c:743
    #17 0x7f7a26d41b52 in Control ../../src/input/es_out_timeshift.c:772
    #18 0x7f7a26cebc38 in es_out_vaControl ../../include/vlc_es_out.h:166
    #19 0x7f7a26cebd6e in es_out_Control ../../include/vlc_es_out.h:175
    #20 0x7f7a26cee049 in demux_Demux ../../src/input/demux.c:225
    #21 0x7f7a26d5ec2d in MainLoopDemux ../../src/input/input.c:543
    #22 0x7f7a26d61110 in MainLoop ../../src/input/input.c:690
    #23 0x7f7a26d5e6c9 in Preparse ../../src/input/input.c:497
    #24 0x7f7a26509ea6 in start_thread nptl/pthread_create.c:477

Thread T7 created by T2 here:
    #0 0x7f7a2817b2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
    #1 0x7f7a26f98d4f in vlc_clone_attr ../../src/posix/thread.c:179
    #2 0x7f7a26f98f49 in vlc_clone ../../src/posix/thread.c:192
    #3 0x7f7a26d5aad7 in input_Start ../../src/input/input.c:177
    #4 0x7f7a26caa31e in input_item_Parse ../../src/input/item.c:1389
    #5 0x7f7a26c9163b in Parse ../../src/preparser/preparser.c:192
    #6 0x7f7a26c92290 in RunnableRun ../../src/preparser/preparser.c:244
    #7 0x7f7a26eff644 in ThreadRun ../../src/misc/executor.c:132
    #8 0x7f7a26509ea6 in start_thread nptl/pthread_create.c:477

Thread T2 created by T0 here:
    #0 0x7f7a2817b2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
    #1 0x7f7a26f98d4f in vlc_clone_attr ../../src/posix/thread.c:179
    #2 0x7f7a26f98f49 in vlc_clone ../../src/posix/thread.c:192
    #3 0x7f7a26effc20 in SpawnThread ../../src/misc/executor.c:160
    #4 0x7f7a26f00194 in vlc_executor_New ../../src/misc/executor.c:195
    #5 0x7f7a26c92bcc in input_preparser_New ../../src/preparser/preparser.c:284
    #6 0x7f7a26beba28 in libvlc_InternalInit ../../src/libvlc.c:229
    #7 0x7f7a2658db10 in libvlc_new ../../lib/core.c:56
    #8 0x564efd441379 in main ../../test/libvlc/media.c:360
    #9 0x7f7a26362d09 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free ../../lib/media.c:871 in libvlc_media_get_stat
Shadow bytes around the buggy address:
  0x0c047fffd640: fa fa 00 03 fa fa 05 fa fa fa 02 fa fa fa fd fa
  0x0c047fffd650: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa fd fd
  0x0c047fffd660: fa fa fd fa fa fa 02 fa fa fa 00 00 fa fa 06 fa
  0x0c047fffd670: fa fa 00 fa fa fa 06 fa fa fa 00 03 fa fa 05 fa
  0x0c047fffd680: fa fa 02 fa fa fa fd fa fa fa fd fa fa fa 00 00
=>0x0c047fffd690: fa fa 00 00 fa fa 00 00 fa fa 00 fa fa fa[fd]fa
  0x0c047fffd6a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd6b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==151684==ABORTING
FAIL test_libvlc_media (exit status: 1)

Most likely because of the file stat stuff.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information