libavfilter/filtfmts-test crashes with dynamically allocated input pads

[Timothy Gu]

Summary of bug

Some filters like fieldmatch does not have statically alloc'd input pads (i.e. AVFilter.inputs = NULL), and they dynamically add input pads in AVFilter.init(). libavfilter/filtfmts-test chokes on that.

I found this bug while trying to add FATE test for fieldmatch.

How to reproduce

timothy_gu@ubuntu-lenovo:~/ffmpeg$ libavfilter/filtfmts-test fieldmatch
detected 4 logical cores
Segmentation fault (core dumped)

GDB output

timothy_gu@ubuntu-lenovo:~/ffmpeg$ gdb libavfilter/filtfmts-test
GNU gdb (GDB) 7.6.1-ubuntu
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/timothy_gu/ffmpeg/libavfilter/filtfmts-test...done.
(gdb) r fieldmatch
Starting program: /home/timothy_gu/ffmpeg/libavfilter/filtfmts-test fieldmatch
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
detected 4 logical cores
[New Thread 0x7ffff6cad700 (LWP 5875)]
[New Thread 0x7ffff64ac700 (LWP 5876)]
[New Thread 0x7ffff5cab700 (LWP 5877)]
[New Thread 0x7ffff54aa700 (LWP 5878)]
[New Thread 0x7ffff4ca9700 (LWP 5879)]

Program received signal SIGSEGV, Segmentation fault.
0x000000000045f228 in main (argc=<optimized out>, argv=<optimized out>)
    at libavfilter/filtfmts.c:116
116	        link->type = filter_ctx->filter->inputs[i].type;
(gdb) p filter_ctx->filter->inputs
$1 = (const AVFilterPad *) 0x0
(gdb) p i
$2 = 1
(gdb) p filter_ctx->filter->inputs[i]
Cannot access memory at address 0x68
(gdb) bt
#0  0x000000000045f228 in main (argc=<optimized out>, argv=<optimized out>)
    at libavfilter/filtfmts.c:116

Valgrind output (not really useful)

timothy_gu@ubuntu-lenovo:~/ffmpeg$ valgrind libavfilter/filtfmts-test fieldmatch 
==5977== Memcheck, a memory error detector
==5977== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==5977== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==5977== Command: libavfilter/filtfmts-test fieldmatch
==5977== 
detected 4 logical cores
==5977== Invalid read of size 4
==5977==    at 0x45F228: main (filtfmts.c:116)
==5977==  Address 0x8 is not stack'd, malloc'd or (recently) free'd
==5977== 
==5977== 
==5977== Process terminating with default action of signal 11 (SIGSEGV)
==5977==  Access not within mapped region at address 0x8
==5977==    at 0x45F228: main (filtfmts.c:116)
==5977==  If you believe this happened as a result of a stack
==5977==  overflow in your program's main thread (unlikely but
==5977==  possible), you can try to increase the size of the
==5977==  main thread stack using the --main-stacksize= flag.
==5977==  The main thread stack size used in this run was 8388608.
==5977== 
==5977== HEAP SUMMARY:
==5977==     in use at exit: 2,664 bytes in 20 blocks
==5977==   total heap usage: 20 allocs, 0 frees, 2,664 bytes allocated
==5977== 
==5977== LEAK SUMMARY:
==5977==    definitely lost: 232 bytes in 1 blocks
==5977==    indirectly lost: 0 bytes in 0 blocks
==5977==      possibly lost: 1,360 bytes in 5 blocks
==5977==    still reachable: 1,072 bytes in 14 blocks
==5977==         suppressed: 0 bytes in 0 blocks
==5977== Rerun with --leak-check=full to see details of leaked memory
==5977== 
==5977== For counts of detected and suppressed errors, rerun with: -v
==5977== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 2 from 2)
Killed

[Carl Eugen Hoyos]

Not a regression.

[Michael Niedermayer]

Fixed in 59c7615d58b5b7ea9caff2c8c774677973eb4f1c