[FFmpeg-devel] [PATCH 2/2] smvjpeg: fix frame leak

[Michael Niedermayer]

On Fri, Jun 21, 2013 at 09:46:00PM +0200, Hendrik Leppkes wrote:
> On Fri, Jun 21, 2013 at 9:36 PM, Michael Niedermayer <michaelni at gmx.at> wrote:
> > On Fri, Jun 21, 2013 at 07:51:40PM +0200, Hendrik Leppkes wrote:
> >> ---
> >>  libavcodec/smvjpegdec.c | 1 +
> >>  1 file changed, 1 insertion(+)
> >>
> >> diff --git a/libavcodec/smvjpegdec.c b/libavcodec/smvjpegdec.c
> >> index d815ef1..0603e49 100644
> >> --- a/libavcodec/smvjpegdec.c
> >> +++ b/libavcodec/smvjpegdec.c
> >> @@ -177,6 +177,7 @@ static av_cold int smvjpeg_decode_end(AVCodecContext *avctx)
> >>      MJpegDecodeContext *jpg = &s->jpg;
> >>
> >>      jpg->picture_ptr = NULL;
> >> +    av_frame_free(&s->picture[0]);
> >>      av_frame_free(&s->picture[1]);
> >>      ff_codec_close_recursive(s->avctx);
> >>      av_freep(&s->avctx);
> >
> >
> > --- ./tests/ref/fate/smvjpeg    2013-06-19 17:06:55.962610457 +0200
> > +++ tests/data/fate/smvjpeg 2013-06-21 21:35:23.202590216 +0200
> > @@ -1,13 +0,0 @@
> > -#tb 0: 1/1
> > -0,          0,          0,        1,    30720, 0x3a821807
> > -0,          1,          1,        1,    30720, 0x95168e5d
> > -0,          2,          2,        1,    30720, 0xd4d98e45
> > -0,          3,          3,        1,    30720, 0xe340a7ea
> > -0,          4,          4,        1,    30720, 0xb832a22d
> > -0,          5,          5,        1,    30720, 0x1f3eb488
> > -0,          6,          6,        1,    30720, 0x6429ce43
> > -0,          7,          7,        1,    30720, 0x3a3da232
> > -0,          8,          8,        1,    30720, 0x5c02aeff
> > -0,          9,          9,        1,    30720, 0x4c7b1c9a
> > -0,         10,         10,        1,    30720, 0x6f7a8313
> > -0,         11,         11,        1,    30720, 0xaa32fd72
> > Test smvjpeg failed. Look at tests/data/fate/smvjpeg.err for details.
> > make: *** [fate-smvjpeg] Error 139
> >
> 
> Cannot reproduce, fate passes for me.

(with both patches)

==24781== Invalid read of size 8
==24781==    at 0xBAB103: av_buffer_unref (buffer.c:111)
==24781==    by 0xBB2369: av_frame_unref (frame.c:353)
==24781==    by 0x9726DA: avcodec_close (utils.c:2374)
==24781==    by 0x97258A: ff_codec_close_recursive (utils.c:2345)
==24781==    by 0x91CBAA: smvjpeg_decode_end (smvjpegdec.c:182)
==24781==    by 0x972681: avcodec_close (utils.c:2369)
==24781==    by 0x5EE638: avformat_find_stream_info (utils.c:2927)
==24781==    by 0x411F0A: open_input_file (ffmpeg_opt.c:814)
==24781==    by 0x419665: open_files (ffmpeg_opt.c:2483)
==24781==    by 0x419801: ffmpeg_parse_options (ffmpeg_opt.c:2520)
==24781==    by 0x42A8FA: main (ffmpeg.c:3361)
==24781==  Address 0x10345e20 is 0 bytes inside a block of size 24 free'd
==24781==    at 0x4C2B5D9: free (vg_replace_malloc.c:446)
==24781==    by 0xBB880B: av_free (mem.c:210)
==24781==    by 0xBB8830: av_freep (mem.c:217)
==24781==    by 0xBAB115: av_buffer_unref (buffer.c:112)
==24781==    by 0xBB2369: av_frame_unref (frame.c:353)
==24781==    by 0xBB1690: av_frame_free (frame.c:113)
==24781==    by 0x91CB85: smvjpeg_decode_end (smvjpegdec.c:180)
==24781==    by 0x972681: avcodec_close (utils.c:2369)
==24781==    by 0x5EE638: avformat_find_stream_info (utils.c:2927)
==24781==    by 0x411F0A: open_input_file (ffmpeg_opt.c:814)
==24781==    by 0x419665: open_files (ffmpeg_opt.c:2483)
==24781==    by 0x419801: ffmpeg_parse_options (ffmpeg_opt.c:2520)


[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

You can kill me, but you cannot change the truth.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20130621/758b9768/attachment.asc>