| 1 | [Thread debugging using libthread_db enabled]
|
|---|
| 2 | Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
|
|---|
| 3 | [New Thread 0x7ffff1725700 (LWP 19057)]
|
|---|
| 4 | [New Thread 0x7ffff0f24700 (LWP 19062)]
|
|---|
| 5 | [Thread 0x7ffff0f24700 (LWP 19062) exited]
|
|---|
| 6 | [Thread 0x7ffff1725700 (LWP 19057) exited]
|
|---|
| 7 | [New Thread 0x7ffff1725700 (LWP 19069)]
|
|---|
| 8 | [Thread 0x7ffff1725700 (LWP 19069) exited]
|
|---|
| 9 | [New Thread 0x7ffff1725700 (LWP 19083)]
|
|---|
| 10 | =================================================================
|
|---|
| 11 | ==18825==ERROR: AddressSanitizer: heap-use-after-free on address 0x6090001f0b50 at pc 0x0000022ba732 bp 0x7fffffffa470 sp 0x7fffffffa468
|
|---|
| 12 | READ of size 4 at 0x6090001f0b50 thread T0
|
|---|
| 13 | #0 0x22ba731 in get_nb_frames ffmpeg/libavformat/mpegenc.c:626:23
|
|---|
| 14 | #1 0x22ba731 in flush_packet ffmpeg/libavformat/mpegenc.c:836
|
|---|
| 15 | #2 0x22afe3a in output_packet ffmpeg/libavformat/mpegenc.c:1106:19
|
|---|
| 16 | #3 0x22ac0e3 in mpeg_mux_write_packet ffmpeg/libavformat/mpegenc.c:1229:19
|
|---|
| 17 | #4 0x2378743 in write_packet ffmpeg/libavformat/mux.c:747:15
|
|---|
| 18 | #5 0x238609b in av_interleaved_write_frame ffmpeg/libavformat/mux.c:1238:15
|
|---|
| 19 | #6 0x63bb0e in write_packet ffmpeg/fftools/ffmpeg.c:815:11
|
|---|
| 20 | #7 0x6140b4 in do_streamcopy ffmpeg/fftools/ffmpeg.c
|
|---|
| 21 | #8 0x6140b4 in process_input_packet ffmpeg/fftools/ffmpeg.c:2736
|
|---|
| 22 | #9 0x64a707 in process_input ffmpeg/fftools/ffmpeg.c:4508:5
|
|---|
| 23 | #10 0x5e7157 in transcode_step ffmpeg/fftools/ffmpeg.c:4628:11
|
|---|
| 24 | #11 0x5e7157 in transcode ffmpeg/fftools/ffmpeg.c:4682
|
|---|
| 25 | #12 0x5db65b in main ffmpeg/fftools/ffmpeg.c:4884:9
|
|---|
| 26 | #13 0x7ffff5c93b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
|
|---|
| 27 | #14 0x41def9 in _start (ffmpeg_asan+0x41def9)
|
|---|
| 28 |
|
|---|
| 29 | 0x6090001f0b50 is located 16 bytes inside of 32-byte region [0x6090001f0b40,0x6090001f0b60)
|
|---|
| 30 | freed by thread T0 here:
|
|---|
| 31 | #0 0x4ddbe0 in __interceptor_free.localalias.0 (ffmpeg_asan+0x4ddbe0)
|
|---|
| 32 | #1 0x22b30be in remove_decoded_packets ffmpeg/libavformat/mpegenc.c:994:13
|
|---|
| 33 | #2 0x22ade08 in output_packet ffmpeg/libavformat/mpegenc.c:1071:17
|
|---|
| 34 |
|
|---|
| 35 | previously allocated by thread T0 here:
|
|---|
| 36 | #0 0x4de9e8 in posix_memalign (ffmpeg_asan+0x4de9e8)
|
|---|
| 37 | #1 0x8599368 in av_malloc ffmpeg/libavutil/mem.c:87:9
|
|---|
| 38 | #2 0x8599368 in av_mallocz ffmpeg/libavutil/mem.c:238
|
|---|
| 39 | #3 0x22ab73b in mpeg_mux_write_packet ffmpeg/libavformat/mpegenc.c:1188:32
|
|---|
| 40 |
|
|---|
| 41 | SUMMARY: AddressSanitizer: heap-use-after-free ffmpeg/libavformat/mpegenc.c:626:23 in get_nb_frames
|
|---|
| 42 | Shadow bytes around the buggy address:
|
|---|
| 43 | 0x0c1280036110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 44 | 0x0c1280036120: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 45 | 0x0c1280036130: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 46 | 0x0c1280036140: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 47 | 0x0c1280036150: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 48 | =>0x0c1280036160: fa fa fa fa fa fa fa fa fd fd[fd]fd fa fa fa fa
|
|---|
| 49 | 0x0c1280036170: fa fa fa fa fa fa fa fa fd fd fd fd fa fa fa fa
|
|---|
| 50 | 0x0c1280036180: fa fa fa fa fa fa fa fa fd fd fd fd fa fa fa fa
|
|---|
| 51 | 0x0c1280036190: fa fa fa fa fa fa fa fa fd fd fd fd fa fa fa fa
|
|---|
| 52 | 0x0c12800361a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 53 | 0x0c12800361b0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 54 | Shadow byte legend (one shadow byte represents 8 application bytes):
|
|---|
| 55 | Addressable: 00
|
|---|
| 56 | Partially addressable: 01 02 03 04 05 06 07
|
|---|
| 57 | Heap left redzone: fa
|
|---|
| 58 | Freed heap region: fd
|
|---|
| 59 | Stack left redzone: f1
|
|---|
| 60 | Stack mid redzone: f2
|
|---|
| 61 | Stack right redzone: f3
|
|---|
| 62 | Stack after return: f5
|
|---|
| 63 | Stack use after scope: f8
|
|---|
| 64 | Global redzone: f9
|
|---|
| 65 | Global init order: f6
|
|---|
| 66 | Poisoned by user: f7
|
|---|
| 67 | Container overflow: fc
|
|---|
| 68 | Array cookie: ac
|
|---|
| 69 | Intra object redzone: bb
|
|---|
| 70 | ASan internal: fe
|
|---|
| 71 | Left alloca redzone: ca
|
|---|
| 72 | Right alloca redzone: cb
|
|---|
| 73 | ==18825==ABORTING
|
|---|
| 74 | [Thread 0x7ffff1725700 (LWP 19083) exited]
|
|---|
| 75 | [Inferior 1 (process 18825) exited with code 01]
|
|---|
| 76 |
|
|---|
