Skip to content

[oss-fuzz 4605658287898624] KaxEncoding leak in matroska_segment_c::ParseTrackEntry()

Ref.

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1667725313
INFO: Loaded 1 modules   (75326 inline 8-bit counters): 75326 [0x569b4f1c6aa8, 0x569b4f1d90e6),
INFO: Loaded 1 PC tables (75326 PCs): 75326 [0x569b4f1d90e8,0x569b4f2ff4c8),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_vlc_8f98ce4aa4498db36bdafd2ab37989a4592ed90c/revisions/vlc-demux-dec-libfuzzer: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/leak-50a32494fbb28d6be21b3d89fe257930825e374d

=================================================================
==249==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x569b4e8c2dad in operator new(unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:109:35
    #1 0x569b4ec157be in KaxContentCompSettings_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:481:43
    #2 0x569b4ec157be in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentCompSettings_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:479:9
    #3 0x569b4ec1550d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #4 0x569b4ec1550d in KaxContentCompression_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:464:24
    #5 0x569b4ec1550d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentCompression_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:457:9
    #6 0x569b4ec1528d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #7 0x569b4ec1528d in KaxContentEncoding_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:441:24
    #8 0x569b4ec1528d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentEncoding_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:436:9
    #9 0x569b4ec1512d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #10 0x569b4ec1512d in KaxContentEncodings_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:433:24
    #11 0x569b4ec1512d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentEncodings_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:422:9
    #12 0x569b4ec0d74d in iterate<std::__1::__wrap_iter<libebml::EbmlElement *const *> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #13 0x569b4ec0d74d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:1074:36
    #14 0x569b4ec0f53d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #15 0x569b4ec0f53d in mkv::matroska_segment_c::ParseTracks(libmatroska::KaxTracks*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:1160:33
    #16 0x569b4ebf1de8 in mkv::matroska_segment_c::Preload() /src/vlc/modules/demux/mkv/matroska_segment.cpp:594:17
    #17 0x569b4ec48b31 in mkv::demux_sys_t::AnalyseAllSegmentsFound(stream_t*, mkv::matroska_stream_c*) /src/vlc/modules/demux/mkv/demux.cpp:117:25
    #18 0x569b4ebcd980 in mkv::OpenInternal(stream_t*, bool) /src/vlc/modules/demux/mkv/mkv.cpp:145:17
    #19 0x569b4eda107a in demux_Probe /src/vlc/src/input/demux.c:112:15
    #20 0x569b4ed5c310 in vlc_module_load /src/vlc/src/modules/modules.c:230:15
    #21 0x569b4eda076d in demux_NewAdvanced /src/vlc/src/input/demux.c:196:20
    #22 0x569b4ed9fe0f in demux_New /src/vlc/src/input/demux.c:77:12
    #23 0x569b4e8c45f9 in demux_process_stream /src/vlc/test/src/input/demux-run.c:300:22
    #24 0x569b4e8c42af in LLVMFuzzerTestOneInput /src/vlc/test/vlc-demux-libfuzzer.c:63:5
    #25 0x569b4e761a7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #26 0x569b4e74c7f2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #27 0x569b4e7526c0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #28 0x569b4e77e1f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #29 0x79dfd1555082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16

================================================================================
The following leaks are not necessarily related to the first leak.


Indirect leak of 2 byte(s) in 1 object(s) allocated from:
    #0 0x569b4e8803d4 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
    #1 0x569b4ec7f82f in libebml::EbmlBinary::EbmlBinary(libebml::EbmlBinary const&) /src/vlc/contrib/contrib-build/ebml/src/EbmlBinary.cpp:55:34
    #2 0x569b4ec1550d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #3 0x569b4ec1550d in KaxContentCompression_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:464:24
    #4 0x569b4ec1550d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentCompression_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:457:9
    #5 0x569b4ec1528d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #6 0x569b4ec1528d in KaxContentEncoding_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:441:24
    #7 0x569b4ec1528d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentEncoding_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:436:9
    #8 0x569b4ec1512d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #9 0x569b4ec1512d in KaxContentEncodings_handler /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:433:24
    #10 0x569b4ec1512d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*)::MetaDataHandlers::KaxContentEncodings_callback(libebml::EbmlElement*, void*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:422:9
    #11 0x569b4ec0d74d in iterate<std::__1::__wrap_iter<libebml::EbmlElement *const *> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #12 0x569b4ec0d74d in mkv::matroska_segment_c::ParseTrackEntry(libmatroska::KaxTrackEntry const*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:1074:36
    #13 0x569b4ec0f53d in iterate<std::__1::__wrap_iter<libebml::EbmlElement **> > /src/vlc/modules/demux/mkv/dispatcher.hpp:45:50
    #14 0x569b4ec0f53d in mkv::matroska_segment_c::ParseTracks(libmatroska::KaxTracks*) /src/vlc/modules/demux/mkv/matroska_segment_parse.cpp:1160:33
    #15 0x569b4ebf1de8 in mkv::matroska_segment_c::Preload() /src/vlc/modules/demux/mkv/matroska_segment.cpp:594:17
    #16 0x569b4ec48b31 in mkv::demux_sys_t::AnalyseAllSegmentsFound(stream_t*, mkv::matroska_stream_c*) /src/vlc/modules/demux/mkv/demux.cpp:117:25
    #17 0x569b4ebcd980 in mkv::OpenInternal(stream_t*, bool) /src/vlc/modules/demux/mkv/mkv.cpp:145:17
    #18 0x569b4eda107a in demux_Probe /src/vlc/src/input/demux.c:112:15
    #19 0x569b4ed5c310 in vlc_module_load /src/vlc/src/modules/modules.c:230:15
    #20 0x569b4eda076d in demux_NewAdvanced /src/vlc/src/input/demux.c:196:20
    #21 0x569b4ed9fe0f in demux_New /src/vlc/src/input/demux.c:77:12
    #22 0x569b4e8c45f9 in demux_process_stream /src/vlc/test/src/input/demux-run.c:300:22
    #23 0x569b4e8c42af in LLVMFuzzerTestOneInput /src/vlc/test/vlc-demux-libfuzzer.c:63:5
    #24 0x569b4e761a7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #25 0x569b4e74c7f2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #26 0x569b4e7526c0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #27 0x569b4e77e1f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #28 0x79dfd1555082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: 66 byte(s) leaked in 2 allocation(s).

INFO: a leak has been found in the initial corpus.

INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.

Sample:

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information