[FFmpeg-trac] #2489(avformat:open): 'segmentation fault' / 'double free pointer' when concatenating segments with subtitles

[FFmpeg]

#2489: 'segmentation fault' / 'double free pointer' when concatenating segments
with subtitles
------------------------------------+------------------------------------
             Reporter:  ronny1982   |                    Owner:
                 Type:  defect      |                   Status:  open
             Priority:  important   |                Component:  avformat
              Version:  git-master  |               Resolution:
             Keywords:              |               Blocked By:
             Blocking:              |  Reproduced by developer:  1
Analyzed by developer:  0           |
------------------------------------+------------------------------------
Changes (by cehoyos):

 * priority:  minor => important
 * status:  new => open
 * component:  FFmpeg => avformat
 * reproduced:  0 => 1


Comment:

 {{{
 $ valgrind ffmpeg_g -f concat -i numbers.concat -c copy out.mkv
 ==31540== Memcheck, a memory error detector
 ==31540== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
 ==31540== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright
 info
 ==31540== Command: ffmpeg_g -f concat -i numbers.concat -c copy out.mkv
 ==31540==
 ffmpeg version N-52364-g4ac2da3 Copyright (c) 2000-2013 the FFmpeg
 developers
   built on Apr 21 2013 22:10:46 with gcc 4.7 (SUSE Linux)
   configuration: --enable-gpl --disable-indev=jack
   libavutil      52. 27.100 / 52. 27.100
   libavcodec     55.  5.100 / 55.  5.100
   libavformat    55.  3.100 / 55.  3.100
   libavdevice    55.  0.100 / 55.  0.100
   libavfilter     3. 60.100 /  3. 60.100
   libswscale      2.  2.100 /  2.  2.100
   libswresample   0. 17.102 /  0. 17.102
   libpostproc    52.  3.100 / 52.  3.100
 Input #0, concat, from 'numbers.concat':
   Duration: N/A, start: 0.000000, bitrate: N/A
     Stream #0:0: Video: h264 (Main), yuv420p, 640x360 [SAR 1:1 DAR 16:9],
 25 fps, 25 tbr, 1k tbn, 50 tbc
     Stream #0:1: Subtitle: subrip
 Output #0, matroska, to 'out.mkv':
   Metadata:
     encoder         : Lavf55.3.100
     Stream #0:0: Video: h264 (H264 / 0x34363248), yuv420p, 640x360 [SAR
 1:1 DAR 16:9], q=2-31, 25 fps, 1k tbn, 1k tbc
     Stream #0:1: Subtitle: subrip
 Stream mapping:
   Stream #0:0 -> #0:0 (copy)
   Stream #0:1 -> #0:1 (copy)
 Press [q] to stop, [?] for help
 ==31540== Invalid free() / delete / delete[] / realloc()
 ==31540==    at 0x4C29D4E: free (in /usr/lib64/valgrind
 /vgpreload_memcheck-amd64-linux.so)
 ==31540==    by 0xBD74FB: av_freep (mem.c:194)
 ==31540==    by 0x5B1D19: ff_free_stream (utils.c:3282)
 ==31540==    by 0x5B1E1B: avformat_free_context (utils.c:3303)
 ==31540==    by 0x5B204C: avformat_close_input (utils.c:3345)
 ==31540==    by 0x4F36D7: open_file (concatdec.c:133)
 ==31540==    by 0x4F381F: concat_read_packet (concatdec.c:265)
 ==31540==    by 0x5AA901: ff_read_packet (utils.c:793)
 ==31540==    by 0x5AC7EF: read_frame_internal (utils.c:1438)
 ==31540==    by 0x5AD5A5: av_read_frame (utils.c:1539)
 ==31540==    by 0x460D2C: process_input (ffmpeg.c:2825)
 ==31540==    by 0x44FF0F: main (ffmpeg.c:3132)
 ==31540==  Address 0x65fc780 is 0 bytes inside a block of size 390 free'd
 ==31540==    at 0x4C29D4E: free (in /usr/lib64/valgrind
 /vgpreload_memcheck-amd64-linux.so)
 ==31540==    by 0xBD74FB: av_freep (mem.c:194)
 ==31540==    by 0x9B0ED6: avcodec_open2 (utils.c:1115)
 ==31540==    by 0x5AF782: avformat_find_stream_info (utils.c:2798)
 ==31540==    by 0x4571F8: open_input_file (ffmpeg_opt.c:814)
 ==31540==    by 0x451D81: open_files.isra.7 (ffmpeg_opt.c:2477)
 ==31540==    by 0x458588: ffmpeg_parse_options (ffmpeg_opt.c:2514)
 ==31540==    by 0x44F8D7: main (ffmpeg.c:3339)
 ==31540==
 frame=  100 fps=0.0 q=-1.0 Lsize=      65kB time=00:00:03.92 bitrate=
 135.9kbits/s
 video:63kB audio:0kB subtitle:0 global headers:0kB muxing overhead
 2.442476%
 ==31540==
 ==31540== HEAP SUMMARY:
 ==31540==     in use at exit: 0 bytes in 0 blocks
 ==31540==   total heap usage: 1,986 allocs, 1,987 frees, 6,568,332 bytes
 allocated
 ==31540==
 ==31540== All heap blocks were freed -- no leaks are possible
 ==31540==
 ==31540== For counts of detected and suppressed errors, rerun with: -v
 ==31540== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 2 from 2)
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/2489#comment:1>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker