vlc_thumbnailer regression: use-after-free
Found when fixing the picture_Export
issues with vlc_thumbnailer and libvlc usage, 100% reproductible, but my code is a bit modified to have the picture_Export
issue fixed:
=================================================================
==548719==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000029c4 at pc 0x7fe05446cd87 bp 0x7ffc6542b6a0 sp 0x7ffc6542b690
READ of size 4 at 0x60f0000029c4 thread T0
#0 0x7fe05446cd86 in vlc_mutex_trylock ../../src/misc/threads.c:132
#1 0x7fe05446cec2 in vlc_mutex_lock ../../src/misc/threads.c:113
#2 0x7fe054342ff8 in Interrupt ../../src/input/thumbnailer.c:251
#3 0x7fe054342ff8 in vlc_thumbnailer_Cancel ../../src/input/thumbnailer.c:312
#4 0x7fe0553b209e in libvlc_media_thumbnail_request_destroy ../../lib/media.c:1087
#5 0x558583ca7c08 in test_media_thumbnail ../../test/libvlc/media.c:384
#6 0x558583ca5b4f in main ../../test/libvlc/media.c:449
#7 0x7fe05323c28f (/usr/lib/libc.so.6+0x2328f)
#8 0x7fe05323c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
#9 0x558583ca5eb4 in _start (/home/janniaux/Projects/videolabs/vlc/build-asan/test/test_libvlc_media+0x6eb4)
0x60f0000029c4 is located 68 bytes inside of 168-byte region [0x60f000002980,0x60f000002a28)
freed by thread T1 (vlc-exec-runner) here:
#0 0x7fe054cbe672 in __interceptor_free /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x7fe05443bcc2 in ThreadRun ../../src/misc/executor.c:134
#2 0x7fe05329f8fc (/usr/lib/libc.so.6+0x868fc)
previously allocated by thread T0 here:
#0 0x7fe054cbfa89 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x7fe054342776 in TaskNew ../../src/input/thumbnailer.c:95
#2 0x7fe054342776 in RequestCommon ../../src/input/thumbnailer.c:263
#3 0x7fe054342776 in vlc_thumbnailer_RequestByPos ../../src/input/thumbnailer.c:304
#4 0x7fe0553b1b93 in libvlc_media_thumbnail_request_by_pos ../../lib/media.c:1060
#5 0x558583ca7bf5 in test_media_thumbnail ../../test/libvlc/media.c:379
#6 0x558583ca5b4f in main ../../test/libvlc/media.c:449
#7 0x7fe05323c28f (/usr/lib/libc.so.6+0x2328f)
Thread T1 (vlc-exec-runner) created by T0 here:
#0 0x7fe054c64207 in __interceptor_pthread_create /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x7fe0544de51f in vlc_clone_attr ../../src/posix/thread.c:179
#2 0x7fe0544de51f in vlc_clone ../../src/posix/thread.c:190
#3 0x7fe05443b4c0 in SpawnThread ../../src/misc/executor.c:164
#4 0x7fe05443c53b in vlc_executor_New ../../src/misc/executor.c:199
#5 0x7fe05434311f in vlc_thumbnailer_Create ../../src/input/thumbnailer.c:321
#6 0x7fe05413d710 in libvlc_InternalInit ../../src/libvlc.c:220
#7 0x7fe0553975c5 in libvlc_new ../../lib/core.c:68
#8 0x558583ca5771 in main ../../test/libvlc/media.c:394
#9 0x7fe05323c28f (/usr/lib/libc.so.6+0x2328f)
SUMMARY: AddressSanitizer: heap-use-after-free ../../src/misc/threads.c:132 in vlc_mutex_trylock
Shadow bytes around the buggy address:1
The task is deleted in ThreadRun
since 962e1153 but the client might expects to cancel or remove the request (which is the same task object) through vlc_thumbnailer_Cancel
.