1465652 - nestegg: detected memory leaks in ne_read_block_additions src/nestegg.c:1775

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.webm

STR:
1) Build with ASan (-fsanitize=address)
2) Run with ASAN_OPTIONS=detect_leaks=1

==17222==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x4b8c10 in calloc (regress+0x4b8c10)
    #1 0x501262 in ne_alloc src/nestegg.c:607:10
    #2 0x501262 in ne_read_block_additions src/nestegg.c:1775
    #3 0x501262 in nestegg_read_packet src/nestegg.c:2866
    #4 0x4eddbd in test test/regress.c:205:9
    #5 0x4efcc6 in main test/regress.c:298:5

Direct leak of 3 byte(s) in 1 object(s) allocated from:
    #0 0x4b8c10 in calloc (regress+0x4b8c10)
    #1 0x500e91 in ne_alloc src/nestegg.c:607:10
    #2 0x500e91 in ne_read_block_additions src/nestegg.c:1747
    #3 0x500e91 in nestegg_read_packet src/nestegg.c:2866
    #4 0x4eddbd in test test/regress.c:205:9
    #5 0x4efcc6 in main test/regress.c:298:5

Indirect leak of 3 byte(s) in 1 object(s) allocated from:
    #0 0x4b8c10 in calloc (regress+0x4b8c10)
    #1 0x500e91 in ne_alloc src/nestegg.c:607:10
    #2 0x500e91 in ne_read_block_additions src/nestegg.c:1747
    #3 0x500e91 in nestegg_read_packet src/nestegg.c:2866
    #4 0x4eddbd in test test/regress.c:205:9
    #5 0x4efcc6 in main test/regress.c:298:5

SUMMARY: AddressSanitizer: 38 byte(s) leaked in 3 allocation(s).

Comment 1

[Matthew Gregan [:kinetik]]

Dumb bug: we free block_additional on a bunch of error paths, but block_additional is a linked list.  The entire list should be freed like it is in nestegg_free_packet.

This would be uncommon in the wild.  It requires a WebM using BlockGroups (rare) that include multiple BlockAdditions (rarer).  The BlockGroup handling stuff really only exists for handling videos with an extra alpha stream, and well-formed WebMs of that type probably wouldn't trigger this.

https://github.com/kinetiknz/nestegg/pull/56

Comment 2

[Matthew Gregan [:kinetik]]

Fixed via bug 1480003.