
Recherche avancée
Autres articles (111)
-
Script d’installation automatique de MediaSPIP
25 avril 2011, parAfin de palier aux difficultés d’installation dues principalement aux dépendances logicielles coté serveur, un script d’installation "tout en un" en bash a été créé afin de faciliter cette étape sur un serveur doté d’une distribution Linux compatible.
Vous devez bénéficier d’un accès SSH à votre serveur et d’un compte "root" afin de l’utiliser, ce qui permettra d’installer les dépendances. Contactez votre hébergeur si vous ne disposez pas de cela.
La documentation de l’utilisation du script d’installation (...) -
Ajouter des informations spécifiques aux utilisateurs et autres modifications de comportement liées aux auteurs
12 avril 2011, parLa manière la plus simple d’ajouter des informations aux auteurs est d’installer le plugin Inscription3. Il permet également de modifier certains comportements liés aux utilisateurs (référez-vous à sa documentation pour plus d’informations).
Il est également possible d’ajouter des champs aux auteurs en installant les plugins champs extras 2 et Interface pour champs extras. -
Automated installation script of MediaSPIP
25 avril 2011, parTo overcome the difficulties mainly due to the installation of server side software dependencies, an "all-in-one" installation script written in bash was created to facilitate this step on a server with a compatible Linux distribution.
You must have access to your server via SSH and a root account to use it, which will install the dependencies. Contact your provider if you do not have that.
The documentation of the use of this installation script is available here.
The code of this (...)
Sur d’autres sites (13159)
-
Organic Traffic : What It Is and How to Increase It
19 septembre 2023, par Erin — Analytics Tips -
`free() : invalid next size (normal)` after loading some frames of some videos using ffmpeg libs
17 septembre 2024, par rakivohere is the function :


uint8_t *load_first_frame(const char *file_path, AVFrame **frame)
{
 int ret;
 AVFormatContext *format_ctx = NULL;
 if ((ret = avformat_open_input(&format_ctx, file_path, NULL, NULL)) < 0) {
 eprintf("could not open input file\n");
 return NULL;
 }

 if ((ret = avformat_find_stream_info(format_ctx, NULL)) < 0) {
 eprintf("could not find stream info\n");
 avformat_close_input(&format_ctx);
 return NULL;
 }

 int stream_idx = -1;
 for (unsigned int i = 0; i < format_ctx->nb_streams; i++) {
 if (format_ctx->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
 stream_idx = i;
 break;
 }
 }

 if (stream_idx == -1) {
 eprintf("could not find video stream\n");
 avformat_close_input(&format_ctx);
 return NULL;
 }

 AVCodecParameters *codec_par = format_ctx->streams[stream_idx]->codecpar;
 const AVCodec *codec = avcodec_find_decoder(codec_par->codec_id);
 if (!codec) {
 eprintf("could not find decoder\n");
 avformat_close_input(&format_ctx);
 return NULL;
 }

 AVCodecContext *codec_ctx = avcodec_alloc_context3(codec);
 if ((ret = avcodec_parameters_to_context(codec_ctx, codec_par)) < 0) {
 eprintf("could not copy codec parameters to context\n");
 avformat_close_input(&format_ctx);
 avcodec_free_context(&codec_ctx);
 return NULL;
 }

 if ((ret = avcodec_open2(codec_ctx, codec, NULL)) < 0) {
 eprintf("could not open codec\n");
 avformat_close_input(&format_ctx);
 avcodec_free_context(&codec_ctx);
 return NULL;
 }

 AVPacket *packet = av_packet_alloc();
 uint8_t *rgb_buffer = NULL;
 while (av_read_frame(format_ctx, packet) >= 0) {
 if (packet->stream_index != stream_idx) {
 av_packet_unref(packet);
 continue;
 }

 if (avcodec_send_packet(codec_ctx, packet) != 0) {
 av_packet_unref(packet);
 continue;
 }

 ret = avcodec_receive_frame(codec_ctx, *frame);
 if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF) {
 av_packet_unref(packet);
 continue;
 } else if (ret < 0) {
 eprintf("error receiving frame: %d\n", ret);
 av_packet_unref(packet);
 av_packet_free(&packet);
 avformat_close_input(&format_ctx);
 avcodec_free_context(&codec_ctx);
 return NULL;
 }

 struct SwsContext *sws_ctx = sws_getContext(
 (*frame)->width, (*frame)->height, codec_ctx->pix_fmt,
 (*frame)->width, (*frame)->height, AV_PIX_FMT_RGB24,
 SWS_BILINEAR, NULL, NULL, NULL
 );

 if (!sws_ctx) {
 eprintf("failed to create SwsContext\n");
 av_packet_unref(packet);
 av_packet_free(&packet);
 av_frame_free(frame);
 avformat_close_input(&format_ctx);
 avcodec_free_context(&codec_ctx);
 return NULL;
 }

 int rgb_buffer_size = av_image_get_buffer_size(AV_PIX_FMT_RGB24, (*frame)->width, (*frame)->height, 1);
 if (rgb_buffer_size < 0) {
 eprintf("could not get buffer size\n");
 sws_freeContext(sws_ctx);
 av_packet_unref(packet);
 av_packet_free(&packet);
 av_frame_free(frame);
 avformat_close_input(&format_ctx);
 avcodec_free_context(&codec_ctx);
 return NULL;
 }

 rgb_buffer = (uint8_t *) malloc(rgb_buffer_size);
 if (rgb_buffer == NULL) {
 eprintf("failed to allocate RGB buffer\n");
 sws_freeContext(sws_ctx);
 av_packet_unref(packet);
 av_packet_free(&packet);
 avformat_close_input(&format_ctx);
 av_frame_free(frame);
 avcodec_free_context(&codec_ctx);
 return NULL;
 }

 uint8_t *dst[4] = {rgb_buffer, NULL, NULL, NULL};
 int dst_linesize[4] = {0};
 av_image_fill_linesizes(dst_linesize, AV_PIX_FMT_RGB24, (*frame)->width);

 sws_scale(sws_ctx,
 (const uint8_t *const *)(*frame)->data,
 (*frame)->linesize,
 0,
 (*frame)->height,
 dst,
 dst_linesize);

 sws_freeContext(sws_ctx);
 av_packet_unref(packet);
 break;
 }

 av_packet_unref(packet);
 av_packet_free(&packet);
 avformat_close_input(&format_ctx);
 avcodec_free_context(&codec_ctx);

 return rgb_buffer;
}



It loads up first frames of mp4s. The problem is that it works only first 7 times, and then, on 8th call of the showed function
malloc(): corrupted top size
happens. Specifically when callavcodec_send_packet
in thewhile
loop. Executing program usingvalgrind
outputs that :

==21777== Invalid write of size 8
==21777== at 0x7426956: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777== by 0x18497CBF: ???
==21777== by 0x35E3AD3F: ???
==21777== Address 0x37f563f0 is 0 bytes after a block of size 2,194,560 alloc'd
==21777== at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777== by 0x1113CB: load_first_frame (main.c:503)
==21777== by 0x111995: draw_preview (main.c:605)
==21777== by 0x111E7F: render_files (main.c:672)
==21777== by 0x11209E: main (main.c:704)
==21777==
==21777== Invalid write of size 8
==21777== at 0x742695B: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777== by 0x18497CBF: ???
==21777== by 0x35E3AD3F: ???
==21777== Address 0x37f563f8 is 8 bytes after a block of size 2,194,560 alloc'd
==21777== at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777== by 0x1113CB: load_first_frame (main.c:503)
==21777== by 0x111995: draw_preview (main.c:605)
==21777== by 0x111E7F: render_files (main.c:672)
==21777== by 0x11209E: main (main.c:704)
==21777==
==21777== Invalid write of size 8
==21777== at 0x7426956: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777== by 0x183FE37F: ???
==21777== by 0x185D16FF: ???
==21777== Address 0x389b94e0 is 0 bytes after a block of size 943,200 alloc'd
==21777== at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777== by 0x1113CB: load_first_frame (main.c:503)
==21777== by 0x111995: draw_preview (main.c:605)
==21777== by 0x111E7F: render_files (main.c:672)
==21777== by 0x11209E: main (main.c:704)



The 503th line is :
rgb_buffer = (uint8_t *) malloc(rgb_buffer_size);
.

Apparently, I double freed something somewhere, but I can't see where exactly.
AVFrame **frame
that is passed to the function is allocated and freed properly every time usingav_frame_alloc
andav_frame_free
. The mp4 file fromfile_path
is always just a normal video, and it always exists.

I've tried loading up different mp4 files, the crash happens every time exactly on 8th call of the function


-
avcodec/wmalosslessdec : Check channels after setting them
31 mars 2022, par Michael Niedermayeravcodec/wmalosslessdec : Check channels after setting them
Fixes : 46194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-580292873827123
Fixes : stack-buffer-overflow on address 0x7ffc0ce69b30 at pc 0x00000062fb03 bp 0x7ffc0ce69af0 sp 0x7ffc0ce69ae8
Fixes : 46205/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5354894996930560
Fixes : 47861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4817404984688640Found-by : continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>