[FFmpeg-trac] #3468(avfilter:new): libavfilter/filtfmts-test crashes with dynamically allocated input pads

[FFmpeg]

#3468: libavfilter/filtfmts-test crashes with dynamically allocated input pads
--------------------------------------+----------------------------------
               Reporter:  Timothy_Gu  |                  Owner:
                   Type:  defect      |                 Status:  new
               Priority:  important   |              Component:  avfilter
                Version:  git-master  |               Keywords:
             Blocked By:              |               Blocking:
Reproduced by developer:  0           |  Analyzed by developer:  0
--------------------------------------+----------------------------------
 == Summary of bug ==

 Some filters like fieldmatch does not have statically alloc'd input pads
 (i.e. `AVFilter.inputs = NULL`), and they dynamically add input pads in
 `AVFilter.init()`. `libavfilter/filtfmts-test` chokes on that.

 I found this bug while trying to add FATE test for fieldmatch.

 == How to reproduce ==
 {{{
 timothy_gu at ubuntu-lenovo:~/ffmpeg$ libavfilter/filtfmts-test fieldmatch
 detected 4 logical cores
 Segmentation fault (core dumped)
 }}}

 == GDB output ==

 {{{
 timothy_gu at ubuntu-lenovo:~/ffmpeg$ gdb libavfilter/filtfmts-test
 GNU gdb (GDB) 7.6.1-ubuntu
 Copyright (C) 2013 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later
 <http://gnu.org/licenses/gpl.html>
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 and "show warranty" for details.
 This GDB was configured as "x86_64-linux-gnu".
 For bug reporting instructions, please see:
 <http://www.gnu.org/software/gdb/bugs/>...
 Reading symbols from /home/timothy_gu/ffmpeg/libavfilter/filtfmts-
 test...done.
 (gdb) r fieldmatch
 Starting program: /home/timothy_gu/ffmpeg/libavfilter/filtfmts-test
 fieldmatch
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 detected 4 logical cores
 [New Thread 0x7ffff6cad700 (LWP 5875)]
 [New Thread 0x7ffff64ac700 (LWP 5876)]
 [New Thread 0x7ffff5cab700 (LWP 5877)]
 [New Thread 0x7ffff54aa700 (LWP 5878)]
 [New Thread 0x7ffff4ca9700 (LWP 5879)]

 Program received signal SIGSEGV, Segmentation fault.
 0x000000000045f228 in main (argc=<optimized out>, argv=<optimized out>)
     at libavfilter/filtfmts.c:116
 116             link->type = filter_ctx->filter->inputs[i].type;
 (gdb) p filter_ctx->filter->inputs
 $1 = (const AVFilterPad *) 0x0
 (gdb) p i
 $2 = 1
 (gdb) p filter_ctx->filter->inputs[i]
 Cannot access memory at address 0x68
 (gdb) bt
 #0  0x000000000045f228 in main (argc=<optimized out>, argv=<optimized
 out>)
     at libavfilter/filtfmts.c:116
 }}}

 == Valgrind output (not really useful) ==

 {{{
 timothy_gu at ubuntu-lenovo:~/ffmpeg$ valgrind libavfilter/filtfmts-test
 fieldmatch
 ==5977== Memcheck, a memory error detector
 ==5977== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
 ==5977== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
 ==5977== Command: libavfilter/filtfmts-test fieldmatch
 ==5977==
 detected 4 logical cores
 ==5977== Invalid read of size 4
 ==5977==    at 0x45F228: main (filtfmts.c:116)
 ==5977==  Address 0x8 is not stack'd, malloc'd or (recently) free'd
 ==5977==
 ==5977==
 ==5977== Process terminating with default action of signal 11 (SIGSEGV)
 ==5977==  Access not within mapped region at address 0x8
 ==5977==    at 0x45F228: main (filtfmts.c:116)
 ==5977==  If you believe this happened as a result of a stack
 ==5977==  overflow in your program's main thread (unlikely but
 ==5977==  possible), you can try to increase the size of the
 ==5977==  main thread stack using the --main-stacksize= flag.
 ==5977==  The main thread stack size used in this run was 8388608.
 ==5977==
 ==5977== HEAP SUMMARY:
 ==5977==     in use at exit: 2,664 bytes in 20 blocks
 ==5977==   total heap usage: 20 allocs, 0 frees, 2,664 bytes allocated
 ==5977==
 ==5977== LEAK SUMMARY:
 ==5977==    definitely lost: 232 bytes in 1 blocks
 ==5977==    indirectly lost: 0 bytes in 0 blocks
 ==5977==      possibly lost: 1,360 bytes in 5 blocks
 ==5977==    still reachable: 1,072 bytes in 14 blocks
 ==5977==         suppressed: 0 bytes in 0 blocks
 ==5977== Rerun with --leak-check=full to see details of leaked memory
 ==5977==
 ==5977== For counts of detected and suppressed errors, rerun with: -v
 ==5977== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 2 from 2)
 Killed
 }}}

--
Ticket URL: <https://trac.ffmpeg.org/ticket/3468>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker