| 1 | ==9828==ERROR: AddressSanitizer: heap-use-after-free on address 0x6090001171d8 at pc 0x00000224dc16 bp 0x7ffc5d02d1e0 sp 0x7ffc5d02d1d8
|
|---|
| 2 | WRITE of size 8 at 0x6090001171d8 thread T0
|
|---|
| 3 | #0 0x224dc15 in mpeg_mux_write_packet ffmpeg/libavformat/mpegenc.c:1187:30
|
|---|
| 4 | #1 0x23195b3 in write_packet ffmpeg/libavformat/mux.c:747:15
|
|---|
| 5 | #2 0x2326f0b in av_interleaved_write_frame ffmpeg/libavformat/mux.c:1238:15
|
|---|
| 6 | #3 0x63bffe in write_packet ffmpeg/fftools/ffmpeg.c:815:11
|
|---|
| 7 | #4 0x61420f in do_streamcopy ffmpeg/fftools/ffmpeg.c
|
|---|
| 8 | #5 0x61420f in process_input_packet ffmpeg/fftools/ffmpeg.c:2746
|
|---|
| 9 | #6 0x64abf7 in process_input ffmpeg/fftools/ffmpeg.c:4518:5
|
|---|
| 10 | #7 0x5e71e7 in transcode_step ffmpeg/fftools/ffmpeg.c:4638:11
|
|---|
| 11 | #8 0x5e71e7 in transcode ffmpeg/fftools/ffmpeg.c:4692
|
|---|
| 12 | #9 0x5db6eb in main ffmpeg/fftools/ffmpeg.c:4894:9
|
|---|
| 13 | #10 0x7f1c05bccb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
|
|---|
| 14 | #11 0x41df89 in _start (ffmpeg/ffmpeg_g+0x41df89)
|
|---|
| 15 |
|
|---|
| 16 | 0x6090001171d8 is located 24 bytes inside of 32-byte region [0x6090001171c0,0x6090001171e0)
|
|---|
| 17 | freed by thread T0 here:
|
|---|
| 18 | #0 0x4ddc70 in __interceptor_free.localalias.0 (ffmpeg/ffmpeg_g+0x4ddc70)
|
|---|
| 19 | #1 0x225409e in remove_decoded_packets ffmpeg/libavformat/mpegenc.c:994:13
|
|---|
| 20 | #2 0x2252e7c in output_packet ffmpeg/libavformat/mpegenc.c:1141:9
|
|---|
| 21 |
|
|---|
| 22 | previously allocated by thread T0 here:
|
|---|
| 23 | #0 0x4dea78 in posix_memalign (ffmpeg/ffmpeg_g+0x4dea78)
|
|---|
| 24 | #1 0x8530d88 in av_malloc ffmpeg/libavutil/mem.c:87:9
|
|---|
| 25 | #2 0x8530d88 in av_mallocz ffmpeg/libavutil/mem.c:238
|
|---|
| 26 | #3 0x224c71b in mpeg_mux_write_packet ffmpeg/libavformat/mpegenc.c:1188:32
|
|---|
| 27 |
|
|---|
| 28 | SUMMARY: AddressSanitizer: heap-use-after-free ffmpeg/libavformat/mpegenc.c:1187:30 in mpeg_mux_write_packet
|
|---|
| 29 | Shadow bytes around the buggy address:
|
|---|
| 30 | 0x0c128001ade0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 31 | 0x0c128001adf0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 32 | 0x0c128001ae00: fa fa fa fa fa fa fa fa fd fd fd fa fa fa fa fa
|
|---|
| 33 | 0x0c128001ae10: fa fa fa fa fa fa fa fa fd fd fd fa fa fa fa fa
|
|---|
| 34 | 0x0c128001ae20: fa fa fa fa fa fa fa fa fd fd fd fa fa fa fa fa
|
|---|
| 35 | =>0x0c128001ae30: fa fa fa fa fa fa fa fa fd fd fd[fd]fa fa fa fa
|
|---|
| 36 | 0x0c128001ae40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 37 | 0x0c128001ae50: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 38 | 0x0c128001ae60: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 39 | 0x0c128001ae70: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 40 | 0x0c128001ae80: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 41 | Shadow byte legend (one shadow byte represents 8 application bytes):
|
|---|
| 42 | Addressable: 00
|
|---|
| 43 | Partially addressable: 01 02 03 04 05 06 07
|
|---|
| 44 | Heap left redzone: fa
|
|---|
| 45 | Freed heap region: fd
|
|---|
| 46 | Stack left redzone: f1
|
|---|
| 47 | Stack mid redzone: f2
|
|---|
| 48 | Stack right redzone: f3
|
|---|
| 49 | Stack after return: f5
|
|---|
| 50 | Stack use after scope: f8
|
|---|
| 51 | Global redzone: f9
|
|---|
| 52 | Global init order: f6
|
|---|
| 53 | Poisoned by user: f7
|
|---|
| 54 | Container overflow: fc
|
|---|
| 55 | Array cookie: ac
|
|---|
| 56 | Intra object redzone: bb
|
|---|
| 57 | ASan internal: fe
|
|---|
| 58 | Left alloca redzone: ca
|
|---|
| 59 | Right alloca redzone: cb
|
|---|
| 60 | ==9828==ABORTING
|
|---|
