Data race in mpegvideo.c and mpeg4video.h
|Reported by:||Zu-Ming||Owned by:|
|Blocking:||Reproduced by developer:||no|
|Analyzed by developer:||no|
Note: To prove the data race is real, I set breakpoints before these two access when they are running in the call stacks described below. I find that the breakpoints can be activated simultaneously, and the addresses of race variables are same. I think these result can prove that the race is real.
Summary of the race
./ffmpeg -y -threads 4 -i small.mp4 output.avi
s->dc_val[xy + wrap]
s->dc_val[xy + wrap] = 1024;
Line number: mpegvideo.c, 1916
c = dc_val[-wrap];
Line number: mpeg4video.h, 224
s->dc_val[xy + wrap] in thread 1 and
dc_val[-wrap] in thread 2 are the same variable becasue their memory address are same. Althougth having the same name, the lock
w->mutex in thread 1 is different from the one in thread
My data race fuzzer, conzzer, finds that these 2 accesses can be executed concurrently, and they are protected by different locks, so my fuzzer report this race.