1465651 - nestegg: detected memory leaks in ne_read_block src/nestegg.c:1559

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.webm

STR:
1) Build with ASan (-fsanitize=address)
2) Run with ASAN_OPTIONS=detect_leaks=1

==18239==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 80 byte(s) in 1 object(s) allocated from:
    #0 0x4b8c10 in calloc (regress+0x4b8c10)
    #1 0x504bab in ne_alloc src/nestegg.c:607:10
    #2 0x504bab in ne_read_block src/nestegg.c:1559
    #3 0x501377 in nestegg_read_packet src/nestegg.c:2807:15
    #4 0x4eddbd in test test/regress.c:205:9
    #5 0x4efcc6 in main test/regress.c:298:5

Indirect leak of 186 byte(s) in 1 object(s) allocated from:
    #0 0x4b8c10 in calloc (regress+0x4b8c10)
    #1 0x50571d in ne_alloc src/nestegg.c:607:10
    #2 0x50571d in ne_read_block src/nestegg.c:1652
    #3 0x501377 in nestegg_read_packet src/nestegg.c:2807:15
    #4 0x4eddbd in test test/regress.c:205:9
    #5 0x4efcc6 in main test/regress.c:298:5

Indirect leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x4b8c10 in calloc (regress+0x4b8c10)
    #1 0x504db8 in ne_alloc src/nestegg.c:607:10
    #2 0x504db8 in ne_alloc_frame src/nestegg.c:1372
    #3 0x504db8 in ne_read_block src/nestegg.c:1575
    #4 0x501377 in nestegg_read_packet src/nestegg.c:2807:15
    #5 0x4eddbd in test test/regress.c:205:9
    #6 0x4efcc6 in main test/regress.c:298:5

SUMMARY: AddressSanitizer: 298 byte(s) leaked in 3 allocation(s).

Comment 1

[Matthew Gregan [:kinetik]]

Like bug 1465652, this is in the BlockGroup handling so should be fairly rare (only unusual or possibly malformed files), but in this case we're relying on the spec, which says "Basic container of information containing a single Block or BlockVirtual, and information specific to that Block/VirtualBlock", except we encounter multiple Blocks and leak all but the last one.

Elsewhere, the spec says "There can be many Blocks in a BlockGroup provided they all have the same timecode. It is used with different parts of a frame with different priorities", so we should handle this either way.

nestegg_read_packet calls ne_read_block twice from within the nested loop handling ID_BLOCK_GROUP.  The second call to ne_read_block doesn't handle the fact read_block is already true (and *pkt is non-NULL), reads another block, and leaks the first block.

Comment 2

[Matthew Gregan [:kinetik]]

https://github.com/kinetiknz/nestegg/pull/58

Comment 3

[Matthew Gregan [:kinetik]]

Fixed via bug 1480003.