Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in
  • VLC VLC
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 3,716
    • Issues 3,716
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 225
    • Merge requests 225
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • VideoLANVideoLAN
  • VLCVLC
  • Issues
  • #27766
Closed
Open
Issue created Jan 24, 2023 by Alexandre Janniaux@alexandre-janniauxDeveloper

vlc_thumbnailer regression: use-after-free

Found when fixing the picture_Export issues with vlc_thumbnailer and libvlc usage, 100% reproductible, but my code is a bit modified to have the picture_Export issue fixed:

=================================================================
==548719==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000029c4 at pc 0x7fe05446cd87 bp 0x7ffc6542b6a0 sp 0x7ffc6542b690
READ of size 4 at 0x60f0000029c4 thread T0
    #0 0x7fe05446cd86 in vlc_mutex_trylock ../../src/misc/threads.c:132
    #1 0x7fe05446cec2 in vlc_mutex_lock ../../src/misc/threads.c:113
    #2 0x7fe054342ff8 in Interrupt ../../src/input/thumbnailer.c:251
    #3 0x7fe054342ff8 in vlc_thumbnailer_Cancel ../../src/input/thumbnailer.c:312
    #4 0x7fe0553b209e in libvlc_media_thumbnail_request_destroy ../../lib/media.c:1087
    #5 0x558583ca7c08 in test_media_thumbnail ../../test/libvlc/media.c:384
    #6 0x558583ca5b4f in main ../../test/libvlc/media.c:449
    #7 0x7fe05323c28f  (/usr/lib/libc.so.6+0x2328f)
    #8 0x7fe05323c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
    #9 0x558583ca5eb4 in _start (/home/janniaux/Projects/videolabs/vlc/build-asan/test/test_libvlc_media+0x6eb4)

0x60f0000029c4 is located 68 bytes inside of 168-byte region [0x60f000002980,0x60f000002a28)
freed by thread T1 (vlc-exec-runner) here:
    #0 0x7fe054cbe672 in __interceptor_free /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7fe05443bcc2 in ThreadRun ../../src/misc/executor.c:134
    #2 0x7fe05329f8fc  (/usr/lib/libc.so.6+0x868fc)

previously allocated by thread T0 here:
    #0 0x7fe054cbfa89 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7fe054342776 in TaskNew ../../src/input/thumbnailer.c:95
    #2 0x7fe054342776 in RequestCommon ../../src/input/thumbnailer.c:263
    #3 0x7fe054342776 in vlc_thumbnailer_RequestByPos ../../src/input/thumbnailer.c:304
    #4 0x7fe0553b1b93 in libvlc_media_thumbnail_request_by_pos ../../lib/media.c:1060
    #5 0x558583ca7bf5 in test_media_thumbnail ../../test/libvlc/media.c:379
    #6 0x558583ca5b4f in main ../../test/libvlc/media.c:449
    #7 0x7fe05323c28f  (/usr/lib/libc.so.6+0x2328f)

Thread T1 (vlc-exec-runner) created by T0 here:
    #0 0x7fe054c64207 in __interceptor_pthread_create /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_interceptors.cpp:207
    #1 0x7fe0544de51f in vlc_clone_attr ../../src/posix/thread.c:179
    #2 0x7fe0544de51f in vlc_clone ../../src/posix/thread.c:190
    #3 0x7fe05443b4c0 in SpawnThread ../../src/misc/executor.c:164
    #4 0x7fe05443c53b in vlc_executor_New ../../src/misc/executor.c:199
    #5 0x7fe05434311f in vlc_thumbnailer_Create ../../src/input/thumbnailer.c:321
    #6 0x7fe05413d710 in libvlc_InternalInit ../../src/libvlc.c:220
    #7 0x7fe0553975c5 in libvlc_new ../../lib/core.c:68
    #8 0x558583ca5771 in main ../../test/libvlc/media.c:394
    #9 0x7fe05323c28f  (/usr/lib/libc.so.6+0x2328f)

SUMMARY: AddressSanitizer: heap-use-after-free ../../src/misc/threads.c:132 in vlc_mutex_trylock
Shadow bytes around the buggy address:1

The task is deleted in ThreadRun since 962e1153 but the client might expects to cancel or remove the request (which is the same task object) through vlc_thumbnailer_Cancel.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking

VideoLAN code repository instance