Skip to content

demux/lavf: fix stack-use-after-scope in edition titles - #18483

Merged
kasper93 merged 1 commit into
mpv-player:masterfrom
llyyr:fix-stack-use-after-scope
Sep 22, 2026
Merged

demux/lavf: fix stack-use-after-scope in edition titles#18483
kasper93 merged 1 commit into
mpv-player:masterfrom
llyyr:fix-stack-use-after-scope

Conversation

@llyyr

@llyyr llyyr commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

The string returned by mp_tprintf is only valid within its enclosing block, but was assigned to prefix and used after that block in demux_compose_edition_title.

Store the generated title first before using it.

Fixes: 91b6d8f ("demux: enrich edition titles with codec/resolution/bitrate info")

@llyyr

llyyr commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

This was found with UBsan:

==605353==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7affcd5b3940 at pc 0x00000055c25a bp 0x7affd6014a00 >
READ of size 1 at 0x7affcd5b3940 thread T66
AV: 00:01:49 / 00:22:50 (8%) x2.03 A-V:  0.000 Dropped: 1 Cache: 1260s/258MB    #0 0x00000055c259 in demux_compose_edition>
    #1 0x0000005ad979 in build_editions ../demux/demux_lavf.c:1105
    #2 0x0000005c6724 in demux_open_lavf ../demux/demux_lavf.c:1585
    #3 0x00000056528a in open_given_type ../demux/demux.c:3601
    #4 0x000000569d54 in demux_open ../demux/demux.c:3715
    #5 0x000000569d54 in demux_open_url ../demux/demux.c:3777
    #6 0x0000008584c5 in open_demux_thread ../player/loadfile.c:1278
    #7 0x7f0028868296  (/lib64/libasan.so.8+0x68296) (BuildId: cc0832bdf22ab60cc0eae1962d17e8ac7388576a)
    #8 0x7f0024c9eecd in start_thread (/lib64/libc.so.6+0x9eecd) (BuildId: 47195f6690701978d2a63f09fb6c4101a75d3d0a)
    #9 0x7f0024d28ceb in __clone3 (/lib64/libc.so.6+0x128ceb) (BuildId: 47195f6690701978d2a63f09fb6c4101a75d3d0a)
Address 0x7affcd5b3940 is located in stack of thread T66 at offset 64 in frame
    #0 0x0000005acf5f in build_editions ../demux/demux_lavf.c:1034
  This frame has 3 object(s):
    [32, 40) 'end' (line 1095)
    [64, 106) '<unknown>' <== Memory access at offset 64 is inside this variable
    [144, 186) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T66 created by T0 here:
    #0 0x7f0028922e2e in pthread_create (/lib64/libasan.so.8+0x122e2e) (BuildId: cc0832bdf22ab60cc0eae1962d17e8ac7388576a)
    #1 0x000000857a73 in start_open ../player/loadfile.c:1348
    #2 0x0000008993b7 in handle_update_cache ../player/playloop.c:833
    #3 0x0000008a4ab1 in run_playloop ../player/playloop.c:1342
    #4 0x000000879003 in play_current_file ../player/loadfile.c:2089
    #5 0x00000087eae7 in mp_play_files ../player/loadfile.c:2281
    #6 0x0000008833d7 in mpv_main ../player/main.c:467
    #7 0x7f0024c2b53d in __libc_start_call_main (/lib64/libc.so.6+0x2b53d) (BuildId: 47195f6690701978d2a63f09fb6c4101a75d3>
    #8 0x7ffe0f3bd16b  (<unknown module>)
SUMMARY: AddressSanitizer: stack-use-after-scope ../demux/demux.c:1383 in demux_compose_edition_title

cc @kasper93

@llyyr
llyyr force-pushed the fix-stack-use-after-scope branch from af9dbef to 871b225 Compare September 15, 2026 08:21
@github-actions

github-actions Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Download the artifacts for this pull request:

Windows
macOS

kasper93
kasper93 reviewed Sep 21, 2026
View reviewed changes
Comment thread demux/demux_lavf.c Outdated
@llyyr
demux_lavf: fix stack-use-after-scope in edition titles
90ecab7 
The string returned by mp_tprintf is only valid within its enclosing
block, but was assigned to prefix and used after that block in
demux_compose_edition_title.

Allocate own buffer for the generated title first before using it.

Fixes: 91b6d8f ("demux: enrich edition titles with codec/resolution/bitrate info")
@llyyr
llyyr force-pushed the fix-stack-use-after-scope branch from 871b225 to 90ecab7 Compare September 22, 2026 03:43
@kasper93
kasper93 merged commit c646756 into mpv-player:master Sep 22, 2026
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kasper93 kasper93 kasper93 left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@llyyr @kasper93