Fix valgrind and asan memory leaks and crashes.

libavcodec/pthread.c

 /*
  * Copyright (c) 2004 Roman Shaposhnik
  * Copyright (c) 2008 Alexander Strange (astrange@ithinksw.com)
  *
  * Many thanks to Steven M. Schultz for providing clever ideas and
  * to Michael Niedermayer <michaelni@gmx.at> for writing initial
  * implementation.
  *
  * This file is part of FFmpeg.
  *
@@ skipping 592 matching lines @@
 {
     FrameThreadContext *fctx = avctx->thread_opaque;
     int finished = fctx->next_finished;
     PerThreadContext *p;
     int err;
 
     /*
      * Submit a packet to the next decoding thread.
      */
 
+    if (fctx->next_decoding >= avctx->thread_count) return err;

[DaleCurtis, 2012/02/09 22:43:26]

Proper fix is likely related to acolwell's threading fixes, this prevents the
crash for now.

[rbultje1, 2012/02/09 23:28:46]

This looks really evil, I'm OK with the workaround but where do I find this
file? I'd like to have a look at it to see if there's a better fix.

[DaleCurtis, 2012/02/10 00:04:01]

I've commented on valgrind.txt to link each test file with each report.

http://xorax.sea/ffmpeg-security/111342.ogm

     p = &fctx->threads[fctx->next_decoding];
     err = update_context_from_user(p->avctx, avctx);
     if (err) return err;
     err = submit_packet(p, avpkt);
     if (err) return err;
 
     /*
      * If we're still receiving the initial packets, don't return a frame.
      */
 
@@ skipping 439 matching lines @@
     return 0;
 }
 
 void ff_thread_free(AVCodecContext *avctx)
 {
     if (avctx->active_thread_type&FF_THREAD_FRAME)
         frame_thread_free(avctx, avctx->thread_count);
     else
         thread_free(avctx);
 }