A potential Use-After-Free bug

[wurongxin]

Summary of the bug:
How to reproduce:

% ffmpeg -i input ... output
ffmpeg version
built on ...

Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker.

In the source file libavfilter/af_afftfilt.c, in the function "static int config_input", there is a potential use after free bug. Please see the following code snippet.

At Line 174, the variable arg will be assigned with a substring separated by "|". If inlink->channels is 1, last_expr will point to the same memory location of args.

At Line 185, "args" will be freed, and it indicates that last_expr is also freed.

At Line 192, again "arg" is assigned with the substring of args separated by "|". If "arg" is null, then "last_expr" at Line 194 is used after free.

173. for (ch = 0; ch < inlink->channels; ch++) {
174. char *arg = av_strtok(ch == 0 ? args : NULL, "|", &saveptr);

175.

176. ret = av_expr_parse(&s->real[ch], arg ? arg : last_expr, var_names,
177. NULL, NULL, func2_names, func2, 0, ctx);
178. if (ret < 0)
179. break;
180. if (arg)
181. last_expr = arg;
182. s->nb_exprs++;
183. }

184.

185. av_free(args);

186.

187. args = av_strdup(s->img_str ? s->img_str : s->real_str);
188. if (!args)
189. return AVERROR(ENOMEM);

190.

191. for (ch = 0; ch < inlink->channels; ch++) {
192. char *arg = av_strtok(ch == 0 ? args : NULL, "|", &saveptr);

193.

194. ret = av_expr_parse(&s->imag[ch], arg ? arg : last_expr, var_names,
195. NULL, NULL, func2_names, func2, 0, ctx);
196. if (ret < 0)
197. break;
198. if (arg)
199. last_expr = arg;
200. }

[Elon Musk]

last_expr is never freed.
Also valgrind shows nothing.

[wurongxin]

Replying to richardpl:

last_expr is never freed.
Also valgrind shows nothing.

It is possible that last_expr points to the same memory location of arg (See Line 138). When the loop from Line 130--140 only is executed once, last_expr will still point to arg. Since arg can be the memory same location as args, when free args (Line 142), last_expr can be freed. Can you double check this?

[Elon Musk]

Fixed in 0c4137bcb742bccc29f87145615a120bc5988c24