Opened 2 years ago

Closed 2 years ago

#8224 closed defect (fixed)

A Double-Free Bug

Reported by: wurongxin Owned by:
Priority: normal Component: avfilter
Version: git-master Keywords:
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
How to reproduce:

% ffmpeg -i input ... output
ffmpeg version
built on ...

Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker.

In the source file libavfilter/vf_nnedi.c, in the function "static int filter_frame", there is a possible double-free bug. Please see the following code snippet. At Line 835, the variable s->second would be alias with src. At Line 860, the variable s->src would be alias with src. Thus, s->second would be alias with s->src. At Line 864 and 865, it would potentially make s->src or s->second freed twice.

  1. second:
  2. if ((s->deint && src->interlaced_frame &&
!ctx->is_disabled)
  1. (!s->deint && !ctx->is_disabled)) {
  2. s->second = src;
  3. }
  4. }

...

  1. s->src = src;
  2. ret = get_frame(ctx, 0);
  3. if (ret < 0) {
  4. av_frame_free(&s->dst);
  5. av_frame_free(&s->src);
  6. av_frame_free(&s->second);
  7. return ret;
  8. }

Change History (3)

comment:1 by Elon Musk, 2 years ago

Resolution: invalid
Status: newclosed

valgrind shows nothing. Also probably is not enough word.
also exact ways for reproduction are missing.

in reply to:  1 comment:2 by wurongxin, 2 years ago

Resolution: invalid
Status: closedreopened

Replying to richardpl:

valgrind shows nothing. Also probably is not enough word.
also exact ways for reproduction are missing.

This bug is detected by static analysis tool. It only happens in certain condition. Valgrind cannot give you anything unless the proper test input is given. Please read the code first and then make the conclusion.

comment:3 by Elon Musk, 2 years ago

Resolution: fixed
Status: reopenedclosed
Note: See TracTickets for help on using tickets.