A Double-Free Bug

[wurongxin]

Summary of the bug:
How to reproduce:

% ffmpeg -i input ... output
ffmpeg version
built on ...

Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker.

In the source file libavfilter/vf_nnedi.c, in the function "static int filter_frame", there is a possible double-free bug. Please see the following code snippet. At Line 835, the variable s->second would be alias with src. At Line 860, the variable s->src would be alias with src. Thus, s->second would be alias with s->src. At Line 864 and 865, it would potentially make s->src or s->second freed twice.

831. second:
832. if ((s->deint && src->interlaced_frame &&

!ctx->is_disabled)

834. (!s->deint && !ctx->is_disabled)) {
835. s->second = src;
836. }
837. }

...

860. s->src = src;
861. ret = get_frame(ctx, 0);
862. if (ret < 0) {
863. av_frame_free(&s->dst);
864. av_frame_free(&s->src);
865. av_frame_free(&s->second);
866. return ret;
867. }

[Elon Musk]

valgrind shows nothing. Also probably is not enough word.
also exact ways for reproduction are missing.

[wurongxin]

Replying to richardpl:

valgrind shows nothing. Also probably is not enough word.
also exact ways for reproduction are missing.

This bug is detected by static analysis tool. It only happens in certain condition. Valgrind cannot give you anything unless the proper test input is given. Please read the code first and then make the conclusion.