Crash: avformat segfaults when reopening a file fails
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
Research direction
Start in producer_avformat.c at get_basic_info() around lines 928–929 and producer_open() around lines 1642–1649, where the second opens are described. Check how each failed open is handled before the subsequent use of its AVFormatContext. Done means both failure paths avoid dereferencing a NULL context.
Written by the indexing model from the issue text.
Description
Describe the bug
producer_avformat.c opens each seekable file a second time in two places and doesn't check whether that second open worked.
If the first open succeeds and the second fails, a NULL AVFormatContext is dereferenced.
This has been observed in the wild if the process is running out of file descriptors (but can happen for a variety of reasons, eg the source media disappearing in-between).
The two affected places:
- get_basic_info(), lines 928–929, the reopen after the seekability test:
self->video_format = NULL;
avformat_open_input(&self->video_format, filename, NULL, NULL);
avformat_find_stream_info(self->video_format, NULL); // NULL → SIGSEGV inside libavformat
- producer_open(), lines 1642–1649, the separate audio context for seekable A/V files:
avformat_open_input(&self->audio_format, filename, NULL, NULL);
apply_properties(self->audio_format, properties, AV_OPT_FLAG_DECODING_PARAM);
if (self->audio_format->iformat && ...) // NULL deref
- Dominant language
- C
- Stars
- 1.9k
- Forks
- 393
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 19
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from mltframework/mlt
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
mltframework/mlt#1333 ·
Maintainers usually reply within 1 day
-
mix transition allocates 9.2 MB per instancePossibly taken @unicorntearsproject claimed this 17 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 72/100
mltframework/mlt#1316 · 5 comments ·
Maintainers usually reply within 1 day
-
confirmed crash workaround
Difficulty 5/5 Over a week Newbie friendliness 35/100
mltframework/mlt#1200 · 6 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
mltframework/mlt#1168 · 3 comments ·
Maintainers usually reply within 1 day
-
There may be an error when disconnecting a filter service from the fieldPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 3/5 1-2 days Newbie friendliness 45/100
mltframework/mlt#1058 · 1 comment ·
Maintainers usually reply within 1 day
All issues in mltframework/mlt
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
AFLplusplus/AFLplusplus#2903 ·
-
category:port-update
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
colbymchenry/codegraph#2634 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 8 days