Fix SwitchChannel() heap-use-after-free #186
Conversation
==25873==ERROR: AddressSanitizer: heap-use-after-free on address 0xb4b79e80 at pc 0xc1027fe7 bp 0xb0bcb968 sp 0xb0bcb96c
READ of size 2108 at 0xb4b79e80 thread T26
#0 0xc1027fe4 in kodi::addon::CStructHdl<kodi::addon::PVRChannel, PVR_CHANNEL>::operator=(kodi::addon::CStructHdl<kodi::addon::PVRChannel, PVR_CHANNEL> const&) pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/InputstreamDemux.cpp:285
kodi-pvr#1 0xc1027fe4 in kodi::addon::PVRChannel::operator=(kodi::addon::PVRChannel const&) /usr/local/include/kodi/addon-instance/pvr/Channels.h:38
kodi-pvr#2 0xc1027fe4 in cVNSIDemux::SwitchChannel(kodi::addon::PVRChannel const&) pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/InputstreamDemux.cpp:315
kodi-pvr#3 0xc0eb6158 in CVNSIClientInstance::OpenLiveStream(kodi::addon::PVRChannel const&) pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/ClientInstance.cpp:1517
kodi-pvr#4 0xc0f1aad2 in kodi::addon::CInstancePVRClient::ADDON_OpenLiveStream(AddonInstance_PVR const*, PVR_CHANNEL const*) (/usr/local/lib/kodi/addons/pvr.vdr.vnsi/pvr.vdr.vnsi.so.19.0.5+0x1daad2)
kodi-pvr#5 0x1753f0e in operator() xbmc-Matrix-11fcf3089436c701b86b98658d646730cf35136d/xbmc/pvr/addons/PVRClient.cpp:1425
|
================================================================= 0xb4b79e80 is located 0 bytes inside of 2108-byte region [0xb4b79e80,0xb4b7a6bc) previously allocated by thread T26 here: Thread T26 created by T0 here: SUMMARY: AddressSanitizer: heap-use-after-free pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/InputstreamDemux.cpp:285 in kodi::addon::CStructHdl<kodi::addon::PVRChannel, PVR_CHANNEL>::operator=(kodi::addon::CStructHdl<kodi::addon::PVRChannel, PVR_CHANNEL> const&)
|
|
Sorry but it’s impossible to follow any reasoning for this change. Can you move the logs to paste site links and then explain why this change is required? |
|
This was detected by the gcc sanitizer, the issue is related to the operator "=" defined for this specific object which deletes the data of the right member, and this specific problem is triggered when we try to use "=" with the right object equals to the left one. Anyway, this class seems to be unable to handle the case when the right and left object are the same of the operator "=". |
Then, this class should be fixed and your workaround should not be needed. |
|
Using a class to process the line below is absurd; We should check that the object is not identical. |
That is not the point being made. The code that results in the original problem still exists and should be refactored out if your fix is the right thing to do. Otherwise it can happen again. |
|
I think that writing "A = A,;" should remain invalid. Anyway, maybe adding to "const CStructHdl& operator=(const CStructHdl& right)" something like "assert(!m_owner || (m_owner && m_cStructure != right.m_cStructure));" could help to debug this kind of issue. This needs to be tested. |
|
shouldn‘t this be some kind of self assignment guard like |
|
@howie-f yes, exactly. |
No, this is valid, but the operator= should handle it correctly, like @howie-f suggested. |
|
@repojohnray would you like to open a respective pr? |
This change fixes the issue described here: kodi-pvr/pvr.vdr.vnsi#186
|
The PR is created: xbmc/xbmc#21627 Note: This commit should be added to Matrix as well. |
|
This is inline code and although it is located in the xbmc repo, the addon needs to be recompiled after the xbmc PR was merged to actually get the fix. |
This change fixes the issue described here: kodi-pvr/pvr.vdr.vnsi#186
This change fixes the issue described here: kodi-pvr/pvr.vdr.vnsi#186
|
xbmc/xbmc#21627 fixes this issue. |
This change fixes the issue described here: kodi-pvr/pvr.vdr.vnsi#186
This change fixes the issue described here: kodi-pvr/pvr.vdr.vnsi#186
==25873==ERROR: AddressSanitizer: heap-use-after-free on address 0xb4b79e80 at pc 0xc1027fe7 bp 0xb0bcb968 sp 0xb0bcb96c
READ of size 2108 at 0xb4b79e80 thread T26
#0 0xc1027fe4 in kodi::addon::CStructHdl<kodi::addon::PVRChannel, PVR_CHANNEL>::operator=(kodi::addon::CStructHdl<kodi::addon::PVRChannel, PVR_CHANNEL> const&) pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/InputstreamDemux.cpp:285
#1 0xc1027fe4 in kodi::addon::PVRChannel::operator=(kodi::addon::PVRChannel const&) /usr/local/include/kodi/addon-instance/pvr/Channels.h:38
#2 0xc1027fe4 in cVNSIDemux::SwitchChannel(kodi::addon::PVRChannel const&) pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/InputstreamDemux.cpp:315
#3 0xc0eb6158 in CVNSIClientInstance::OpenLiveStream(kodi::addon::PVRChannel const&) pvr-vdr-vnsi-Matrix-c4c9a5c4edd212462af4465246183ef2fc9993a9/src/ClientInstance.cpp:1517
#4 0xc0f1aad2 in kodi::addon::CInstancePVRClient::ADDON_OpenLiveStream(AddonInstance_PVR const*, PVR_CHANNEL const*) (/usr/local/lib/kodi/addons/pvr.vdr.vnsi/pvr.vdr.vnsi.so.19.0.5+0x1daad2)
#5 0x1753f0e in operator() xbmc-Matrix-11fcf3089436c701b86b98658d646730cf35136d/xbmc/pvr/addons/PVRClient.cpp:1425