Skip to content
GitLab
Open
Issue created by Tim-Philipp Müller@tpm🐠Owner

netclientclock: use after free

This is from a failed valgrind-core job on the CI:

## test_functioning.valgrind:

==32906== Memcheck, a memory error detector
==32906== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==32906== Using Valgrind-3.16.0 and LibVEX; rerun with -h for copyright info
==32906== Command: /builds/jcarrete5/gstreamer/gst-build/build/subprojects/gstreamer/tests/check/libs_gstnetclientclock
==32906== Parent PID: 29076
==32906== 
==33140== Thread 3:
==33140== Invalid read of size 8
==33140==    at 0x4A2DBE1: g_type_check_instance (gtype.c:4132)
==33140==    by 0x4A244ED: g_signal_emit_valist (gsignal.c:3182)
==33140==    by 0x4A259D2: g_signal_emit (gsignal.c:3453)
==33140==    by 0x4A0AC61: g_cclosure_marshal_VOID__BOOLEANv (gmarshal.c:272)
==33140==    by 0x4A08995: _g_closure_invoke_va (gclosure.c:873)
==33140==    by 0x4A25227: g_signal_emit_valist (gsignal.c:3306)
==33140==    by 0x4A259D2: g_signal_emit (gsignal.c:3453)
==33140==    by 0x49C339E: gst_net_client_internal_clock_observe_times (gstnetclientclock.c:577)
==33140==    by 0x49C4335: gst_net_client_internal_clock_thread (gstnetclientclock.c:803)
==33140==    by 0x4ACE011: g_thread_proxy (gthread.c:805)
==33140==    by 0x4F5B4E1: start_thread (pthread_create.c:479)
==33140==    by 0x4C7C6C2: clone (clone.S:95)
==33140==  Address 0x7010e30 is 288 bytes inside a block of size 504 free'd
==33140==    at 0x483EA0C: free (vg_replace_malloc.c:538)
==33140==    by 0x4AAA49C: g_free (gmem.c:192)
==33140==    by 0x4AC30E3: g_slice_free1 (gslice.c:1135)
==33140==    by 0x4A2C3F5: g_type_free_instance (gtype.c:1939)
==33140==    by 0x40189F: test_functioning (gstnetclientclock.c:115)
==33140==    by 0x49AE954: tcase_run_tfun_fork (check_run.c:465)
==33140==    by 0x49AE954: srunner_iterate_tcase_tfuns (check_run.c:237)
==33140==    by 0x49AE954: srunner_run_tcase (check_run.c:377)
==33140==    by 0x49AE954: srunner_iterate_suites (check_run.c:205)
==33140==    by 0x49AE954: srunner_run_tagged (check_run.c:740)
==33140==    by 0x49A2EEE: gst_check_run_suite (gstcheck.c:1086)
==33140==    by 0x401264: main (gstnetclientclock.c:136)
==33140==  Block was alloc'd at
==33140==    at 0x483D80B: malloc (vg_replace_malloc.c:307)
==33140==    by 0x4AAA3A8: g_malloc (gmem.c:99)
==33140==    by 0x4AC29D5: g_slice_alloc (gslice.c:1024)
==33140==    by 0x4AC2FFD: g_slice_alloc0 (gslice.c:1050)
==33140==    by 0x4A2C029: g_type_create_instance (gtype.c:1839)
==33140==    by 0x4A0E3F4: g_object_new_internal (gobject.c:1827)
==33140==    by 0x4A10337: g_object_new_valist (gobject.c:2152)
==33140==    by 0x4A1068C: g_object_new (gobject.c:1670)
==33140==    by 0x49C617D: gst_net_client_clock_new (gstnetclientclock.c:1437)
==33140==    by 0x4014FC: test_functioning (gstnetclientclock.c:72)
==33140==    by 0x49AE954: tcase_run_tfun_fork (check_run.c:465)
==33140==    by 0x49AE954: srunner_iterate_tcase_tfuns (check_run.c:237)
==33140==    by 0x49AE954: srunner_run_tcase (check_run.c:377)
==33140==    by 0x49AE954: srunner_iterate_suites (check_run.c:205)
==33140==    by 0x49AE954: srunner_run_tagged (check_run.c:740)
==33140==    by 0x49A2EEE: gst_check_run_suite (gstcheck.c:1086)
==33140==    by 0x401264: main (gstnetclientclock.c:136)
==33140== 
{
   <insert_a_suppression_name_here>
   Memcheck:Addr8
   fun:g_type_check_instance
   fun:g_signal_emit_valist
   fun:g_signal_emit
   fun:g_cclosure_marshal_VOID__BOOLEANv
   fun:_g_closure_invoke_va
   fun:g_signal_emit_valist
   fun:g_signal_emit
   fun:gst_net_client_internal_clock_observe_times
   fun:gst_net_client_internal_clock_thread
   fun:g_thread_proxy
   fun:start_thread
   fun:clone
}
==33140== Warning: invalid file descriptor -1 in syscall close()
==33140== Warning: invalid file descriptor -1 in syscall close()