Skip to content
GitLab
Closed
Issue created by Farid Abdelnour@frdbr🎥Reporter

Sanitizer: heap-use-after-free on address 0x6110003bda28

I think if you try to render with track effects hidden this happens:

Project: video-extra.kdenlive Full: sanitizer.txt

=================================================================
==32652==ERROR: AddressSanitizer: at pc 0x560ae82c96fb bp 0x7ffee3babb30 sp 0x7ffee3babb28
READ of size 1 at 0x6110003bda28 thread T0
    #0 0x560ae82c96fa in TimelineController::setModel(std::shared_ptr)::$_1::operator()(int) const /home/farid/kdenlive/src/timeline2/view/timelinecontroller.cpp:109:13
    #1 0x560ae82c93a7 in QtPrivate::FunctorCall, QtPrivate::List, void, TimelineController::setModel(std::shared_ptr)::$_1>::call(TimelineController::setModel(std::shared_ptr)::$_1&, void**) /usr/include/qt/QtCore/qobjectdefs_impl.h:146:13
    #2 0x560ae82c9220 in void QtPrivate::Functor)::$_1, 1>::call, void>(TimelineController::setModel(std::shared_ptr)::$_1&, void*, void**) /usr/include/qt/QtCore/qobjectdefs_impl.h:256:13
    #3 0x560ae82c91cb in QtPrivate::QFunctorSlotObject)::$_1, 1, QtPrivate::List, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/qt/QtCore/qobjectdefs_impl.h:443:17
    #4 0x7f1ca1727905  (/usr/lib/libQt5Core.so.5+0x2e9905)
    #5 0x560ae712c2d7 in TimelineModel::checkItemDeletion(int) /home/farid/kdenlive/build/src/kdenliveLib_autogen/GGT3SG7UAR/moc_timelinemodel.cpp:551:5
    #6 0x560ae808be1a in TimelineModel::deregisterClip_lambda(int)::$_137::operator()() const /home/farid/kdenlive/src/timeline2/model/timelinemodel.cpp:2702:14
    #7 0x560ae808bc0c in bool std::__invoke_impl(std::__invoke_other, TimelineModel::deregisterClip_lambda(int)::$_137&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/invoke.h:60:14
    #8 0x560ae808bbac in std::enable_if<__and_ >, std::is_convertible::type, bool> >::value, bool>::type std::__invoke_r(TimelineModel::deregisterClip_lambda(int)::$_137&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/invoke.h:141:14
    #9 0x560ae808ba5c in std::_Function_handler::_M_invoke(std::_Any_data const&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/std_function.h:291:9
    #10 0x560ae71be000 in std::function::operator()() const /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.1.0/../../../../include/c++/10.1.0/bits/std_function.h:622:14
    #11 0x560ae7fddd2d in TimelineModel::requestClipDeletion(int, std::function&, std::function&) /home/farid/kdenlive/src/timeline2/model/timelinemodel.cpp:1345:9
    #12 0x560ae7fdc372 in TimelineModel::requestItemDeletion(int, std::function&, std::function&) /home/farid/kdenlive/src/timeline2/model/timelinemodel.cpp:1293:16
    #13 0x560ae75bb350 in ProjectClip::selfSoftDelete(std::function&, std::function&) /home/farid/kdenlive/src/bin/projectclip.cpp:1465:23
    #14 0x560ae745bce7 in AbstractProjectItem::selfSoftDelete(std::function&, std::function&) /home/farid/kdenlive/src/bin/abstractprojectitem.cpp:289:74
    #15 0x560ae76143ab in ProjectItemModel::requestBinClipDeletion(std::shared_ptr const&, std::function&, std::function&) /home/farid/kdenlive/src/bin/projectitemmodel.cpp:573:11
    #16 0x560ae7613891 in ProjectItemModel::clean() /home/farid/kdenlive/src/bin/projectitemmodel.cpp:488:9
    #17 0x560ae747f7ed in Bin::~Bin() /home/farid/kdenlive/src/bin/bin.cpp:1194:18
    #18 0x560ae747ff5b in Bin::~Bin() /home/farid/kdenlive/src/bin/bin.cpp:1187:1
    #19 0x7f1ca171ac3d in QObjectPrivate::deleteChildren() (/usr/lib/libQt5Core.so.5+0x2dcc3d)
    #20 0x7f1ca5bda1dd in QWidget::~QWidget() (/usr/lib/libQt5Widgets.so.5+0x1991dd)
    #21 0x7f1ca5cbadd9 in QDockWidget::~QDockWidget() (/usr/lib/libQt5Widgets.so.5+0x279dd9)
    #22 0x7f1ca171ac3d in QObjectPrivate::deleteChildren() (/usr/lib/libQt5Core.so.5+0x2dcc3d)
    #23 0x7f1ca5bda1dd in QWidget::~QWidget() (/usr/lib/libQt5Widgets.so.5+0x1991dd)
    #24 0x560ae85e025c in MainWindow::~MainWindow() /home/farid/kdenlive/src/mainwindow.cpp:845:1
    #25 0x560ae85e0292 in MainWindow::~MainWindow() /home/farid/kdenlive/src/mainwindow.cpp:827:1
    #26 0x560ae85e03ab in MainWindow::~MainWindow() /home/farid/kdenlive/src/mainwindow.cpp:827:1
    #27 0x7f1ca171ce6f in QObject::event(QEvent*) (/usr/lib/libQt5Core.so.5+0x2dee6f)
    #28 0x7f1ca702eb29 in KXmlGuiWindow::event(QEvent*) (/usr/lib/libKF5XmlGui.so.5+0x91b29)
    #29 0x7f1ca5b9d701 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/libQt5Widgets.so.5+0x15c701)
    #30 0x7f1ca16f0699 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/libQt5Core.so.5+0x2b2699)
    #31 0x7f1ca16f3182 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/libQt5Core.so.5+0x2b5182)
    #32 0x7f1ca16f74bc in QCoreApplication::exec() (/usr/lib/libQt5Core.so.5+0x2b94bc)
    #33 0x560ae706ecc4 in main /home/farid/kdenlive/src/main.cpp:266:18
    #34 0x7f1ca0f23001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
    #35 0x560ae6f8dcbd in _start (/usr/bin/kdenlive+0x364cbd)

0x6110003bda28 is located 168 bytes inside of 216-byte region [0x6110003bd980,0x6110003bda58)
freed by thread T0 here:
    #0 0x560ae7066ca9 in operator delete(void*) (/usr/bin/kdenlive+0x43dca9)
    #1 0x560ae8273357 in TimelineController::~TimelineController() /home/farid/kdenlive/src/timeline2/view/timelinecontroller.cpp:86:1
    #2 0x560ae830a828 in TimelineWidget::~TimelineWidget() /home/farid/kdenlive/src/timeline2/view/timelinewidget.cpp:82:5
    #3 0x560ae830a89b in TimelineWidget::~TimelineWidget() /home/farid/kdenlive/src/timeline2/view/timelinewidget.cpp:81:1
    #4 0x7f1ca171ac3d in QObjectPrivate::deleteChildren() (/usr/lib/libQt5Core.so.5+0x2dcc3d)

previously allocated by thread T0 here:
    #0 0x560ae7066289 in operator new(unsigned long) (/usr/bin/kdenlive+0x43d289)
    #1 0x560ae8309b80 in TimelineWidget::TimelineWidget(QWidget*) /home/farid/kdenlive/src/timeline2/view/timelinewidget.cpp:66:15
    #2 0x560ae82fa2de in TimelineTabs::TimelineTabs(QWidget*) /home/farid/kdenlive/src/timeline2/view/timelinetabs.cpp:44:26
    #3 0x560ae8592e7e in MainWindow::init() /home/farid/kdenlive/src/mainwindow.cpp:298:26
    #4 0x560ae8503139 in Core::initGUI(QUrl const&, QString const&) /home/farid/kdenlive/src/core.cpp:203:19
    #5 0x560ae706ecbf in main /home/farid/kdenlive/src/main.cpp:265:12
    #6 0x7f1ca0f23001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)

SUMMARY: AddressSanitizer: heap-use-after-free /home/farid/kdenlive/src/timeline2/view/timelinecontroller.cpp:109:13 in TimelineController::setModel(std::shared_ptr)::$_1::operator()(int) const
Shadow bytes around the buggy address:
  0x0c228006faf0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c228006fb00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c228006fb10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228006fb20: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c228006fb30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c228006fb40: fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa fa
  0x0c228006fb50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c228006fb60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228006fb70: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x0c228006fb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228006fb90: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==32652==ABORTING
Edited by Farid Abdelnour