Fix valgrind and asan memory leaks and crashes.

valgrind.txt

Index: valgrind.txt
diff --git a/valgrind.txt b/valgrind.txt
new file mode 100644
index 0000000000000000000000000000000000000000..fbd1837f843a3e7cc2f8aecd7bd2523429bb56b8
--- /dev/null
+++ b/valgrind.txt
@@ -0,0 +1,610 @@
+15:44:14 memcheck_analyze.py [ERROR] FAIL! There were 14 errors:
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/h264.705767.mp4
http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+4 bytes in 1 blocks are definitely lost in loss record 6 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stss (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1598)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#A4116415B732022A#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stss
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/big_dims.ogv

+UninitCondition
+Conditional jump or move depends on uninitialised value(s)
+  vp3_dequant (/out/Debug/../../third_party/ffmpeg/libavcodec/vp3.c:1356)
+  render_slice (/out/Debug/../../third_party/ffmpeg/libavcodec/vp3.c:1575)
+  vp3_decode_frame (/out/Debug/../../third_party/ffmpeg/libavcodec/vp3.c:2033)
+  avcodec_decode_video2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:1255)
+  avcodec_decode_video2 (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:164)
+  media::FFmpegVideoDecoder::Decode(scoped_refptr<media::Buffer> const&, scoped_refptr<media::VideoFrame>*) (/out/Debug/../../media/filters/ffmpeg_video_decoder.cc:313)
+  media::FFmpegVideoDecoder::DoDecodeBuffer(scoped_refptr<media::Buffer> const&) (/out/Debug/../../media/filters/ffmpeg_video_decoder.cc:260)
+Suppression (error hash=#512C63117DEA7511#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Uninitialized
+   fun:vp3_dequant
+   fun:render_slice
+   fun:vp3_decode_frame
+   fun:avcodec_decode_video2
+   fun:avcodec_decode_video2
+   fun:_ZN5media18FFmpegVideoDecoder6DecodeERK13scoped_refptrINS_6BufferEEPS1_INS_10VideoFrameEE
+   fun:_ZN5media18FFmpegVideoDecoder14DoDecodeBufferERK13scoped_refptrINS_6BufferEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/h264.705767.mp4

+40 bytes in 1 blocks are definitely lost in loss record 204 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stsz (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1653)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#171A96A8144F9997#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stsz
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/112670.mp4

+1,196 bytes in 1 blocks are definitely lost in loss record 568 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  av_mallocz (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:186)
+  ff_h264_decode_seq_parameter_set (/out/Debug/../../third_party/ffmpeg/libavcodec/h264_ps.c:334)
+  decode_nal_units (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:3984)
+  ff_h264_decode_extradata (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1103)
+  ff_h264_decode_init (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1177)
+  avcodec_open2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:887)
+  try_decode_frame (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:2121)
+  avformat_find_stream_info (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:2452)
+  avformat_find_stream_info (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:417)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:482)
+Suppression (error hash=#FAE337641B6FC103#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:av_mallocz
+   fun:ff_h264_decode_seq_parameter_set
+   fun:decode_nal_units
+   fun:ff_h264_decode_extradata
+   fun:ff_h264_decode_init
+   fun:avcodec_open2
+   fun:try_decode_frame
+   fun:avformat_find_stream_info
+   fun:avformat_find_stream_info
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/h264.705767.mp4
http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+4 bytes in 1 blocks are definitely lost in loss record 7 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stss (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1598)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_trak (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2029)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#D2A8ECEA1FD43878#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stss
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_trak
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+8 bytes in 1 blocks are definitely lost in loss record 22 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stts (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1705)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#ED771BF6402B1E4C#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stts
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/112670.mp4

+278,601 bytes in 1 blocks are definitely lost in loss record 602 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  ff_fast_malloc (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:79)
+  av_fast_malloc (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:87)
+  ff_h264_decode_nal (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:196)
+  decode_nal_units (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:3838)
+  ff_h264_decode_extradata (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1103)
+  ff_h264_decode_init (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1177)
+  avcodec_open2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:887)
+  try_decode_frame (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:2121)
+  avformat_find_stream_info (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:2452)
+  avformat_find_stream_info (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:417)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:482)
+Suppression (error hash=#B3415629E6728912#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:ff_fast_malloc
+   fun:av_fast_malloc
+   fun:ff_h264_decode_nal
+   fun:decode_nal_units
+   fun:ff_h264_decode_extradata
+   fun:ff_h264_decode_init
+   fun:avcodec_open2
+   fun:try_decode_frame
+   fun:avformat_find_stream_info
+   fun:avformat_find_stream_info
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:14 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/h264.705767.mp4
http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+12 bytes in 1 blocks are definitely lost in loss record 30 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stsc (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1536)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#AC236C0AA9CEE1F1#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stsc
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:15 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost
+1,196 bytes in 1 blocks are definitely lost in loss record 567 of 604

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/112670.mp4

+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  av_mallocz (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:186)
+  ff_h264_decode_seq_parameter_set (/out/Debug/../../third_party/ffmpeg/libavcodec/h264_ps.c:334)
+  decode_nal_units (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:3984)
+  ff_h264_decode_extradata (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1103)
+  ff_h264_decode_init (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1177)
+  avcodec_open2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:887)
+  avformat_find_stream_info (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:2293)
+  avformat_find_stream_info (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:417)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:482)
+Suppression (error hash=#DE180F58BF89E862#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:av_mallocz
+   fun:ff_h264_decode_seq_parameter_set
+   fun:decode_nal_units
+   fun:ff_h264_decode_extradata
+   fun:ff_h264_decode_init
+   fun:avcodec_open2
+   fun:avformat_find_stream_info
+   fun:avformat_find_stream_info
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:15 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+8 bytes in 1 blocks are definitely lost in loss record 24 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stts (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1705)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_trak (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2029)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#D5C902144AF634F8#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stts
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_trak
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:15 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/h264.705767.mp4

+8 bytes in 1 blocks are definitely lost in loss record 23 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stco (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1090)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#85F0C1F2A5FD2FC1#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stco
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:15 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/h264.705767.mp4
http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+12 bytes in 1 blocks are definitely lost in loss record 31 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  mov_read_stsc (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:1536)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_trak (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2029)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#5241A2AB14993ED0#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:mov_read_stsc
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_trak
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:15 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/smclockmp4aac_1_0.mp4

+120 bytes in 1 blocks are definitely lost in loss record 452 of 604
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  av_mallocz (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:186)
+  mov_read_dref (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:387)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_trak (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2029)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_moov (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:710)
+  mov_read_default (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:352)
+  mov_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/mov.c:2744)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:598)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Suppression (error hash=#8F8411984B3C4147#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:av_mallocz
+   fun:mov_read_dref
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_default
+   fun:mov_read_trak
+   fun:mov_read_default
+   fun:mov_read_moov
+   fun:mov_read_default
+   fun:mov_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+15:44:15 memcheck_analyze.py [ERROR] Command:
+Leak_DefinitelyLost
+278,601 bytes in 1 blocks are definitely lost in loss record 601 of 604

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/112670.mp4

+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  ff_fast_malloc (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:79)
+  av_fast_malloc (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:87)
+  ff_h264_decode_nal (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:196)
+  decode_nal_units (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:3838)
+  ff_h264_decode_extradata (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1103)
+  ff_h264_decode_init (/out/Debug/../../third_party/ffmpeg/libavcodec/h264.c:1177)
+  avcodec_open2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:887)
+  avformat_find_stream_info (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:2293)
+  avformat_find_stream_info (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:417)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:482)
+Suppression (error hash=#5D5B9DC34AAF42FA#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:ff_fast_malloc
+   fun:av_fast_malloc
+   fun:ff_h264_decode_nal
+   fun:decode_nal_units
+   fun:ff_h264_decode_extradata
+   fun:ff_h264_decode_init
+   fun:avcodec_open2
+   fun:avformat_find_stream_info
+   fun:avformat_find_stream_info
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+//----------- security/100464.webm crash.

[DaleCurtis, 2012/02/09 22:43:26]

Fixed in pthread.c

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/100464.webm

+
+13:20:20 memcheck_analyze.py [ERROR] FAIL! There were 2 errors:
+13:20:20 memcheck_analyze.py [ERROR] Command:
+InvalidWrite
+Invalid write of size 4
+  update_context_from_user (/out/Debug/../../third_party/ffmpeg/libavcodec/pthread.c:469)
+  ff_thread_decode_frame (/out/Debug/../../third_party/ffmpeg/libavcodec/pthread.c:614)
+  avcodec_decode_video2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:1252)
+  avcodec_decode_video2 (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:164)
+  media::FFmpegVideoDecoder::Decode(scoped_refptr<media::Buffer> const&, scoped_refptr<media::VideoFrame>*) (/out/Debug/../../media/filters/ffmpeg_video_decoder.cc:313)
+  media::FFmpegVideoDecoder::DoDecodeBuffer(scoped_refptr<media::Buffer> const&) (/out/Debug/../../media/filters/ffmpeg_video_decoder.cc:260)
+Address 0x10 is not stack'd, malloc'd or (recently) free'd
+Suppression (error hash=#E9A4E42320AFCBA2#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Unaddressable
+   fun:update_context_from_user
+   fun:ff_thread_decode_frame
+   fun:avcodec_decode_video2
+   fun:avcodec_decode_video2
+   fun:_ZN5media18FFmpegVideoDecoder6DecodeERK13scoped_refptrINS_6BufferEEPS1_INS_10VideoFrameEE
+   fun:_ZN5media18FFmpegVideoDecoder14DoDecodeBufferERK13scoped_refptrINS_6BufferEE
+}
+
+13:20:20 memcheck_analyze.py [ERROR] Command:

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/111342.ogm

+InvalidRead
+Invalid read of size 8
+  ff_thread_decode_frame (/out/Debug/../../third_party/ffmpeg/libavcodec/pthread.c:614)
+  avcodec_decode_video2 (/out/Debug/../../third_party/ffmpeg/libavcodec/utils.c:1252)
+  avcodec_decode_video2 (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:164)
+  media::FFmpegVideoDecoder::Decode(scoped_refptr<media::Buffer> const&, scoped_refptr<media::VideoFrame>*) (/out/Debug/../../media/filters/ffmpeg_video_decoder.cc:313)
+  media::FFmpegVideoDecoder::DoDecodeBuffer(scoped_refptr<media::Buffer> const&) (/out/Debug/../../media/filters/ffmpeg_video_decoder.cc:260)
+Address 0xf707548 is not stack'd, malloc'd or (recently) free'd
+Suppression (error hash=#FDDF1647E61BE943#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Unaddressable
+   fun:ff_thread_decode_frame
+   fun:avcodec_decode_video2
+   fun:avcodec_decode_video2
+   fun:_ZN5media18FFmpegVideoDecoder6DecodeERK13scoped_refptrINS_6BufferEEPS1_INS_10VideoFrameEE
+   fun:_ZN5media18FFmpegVideoDecoder14DoDecodeBufferERK13scoped_refptrINS_6BufferEE
+}
+
+13:20:20 valgrind_test.py [INFO] Please see http://dev.chromium.org/developers/how-tos/using-valgrind for the info on Memcheck/Valgrind
+
+/// --------- security/wav.711.ogv crash.

[DaleCurtis, 2012/02/09 22:43:26]

Fixed in oggparsetheora.c

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/wav.711.ogv

+InvalidRead
+Invalid read of size 4
+  theora_gptopts (/out/Debug/../../third_party/ffmpeg/libavformat/oggparsetheora.c:133)
+  ogg_gptopts (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.h:138)
+  skeleton_header (/out/Debug/../../third_party/ffmpeg/libavformat/oggparseskeleton.c:78)
+  ogg_packet (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.c:393)
+  ogg_get_headers (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.c:460)
+  ogg_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.c:519)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:599)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:468)
+Address 0x0 is not stack'd, malloc'd or (recently) free'd
+Suppression (error hash=#E1CFCBF972DF2F68#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Unaddressable
+   fun:theora_gptopts
+   fun:ogg_gptopts
+   fun:skeleton_header
+   fun:ogg_packet
+   fun:ogg_get_headers
+   fun:ogg_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}
+
+/// --------- noticed after fix for above crash:

[DaleCurtis, 2012/02/09 22:43:26]

Couldn't find a way to stop this leak, it's a small one though. Unsure if caused
by my crash fix or just tangential.

[DaleCurtis, 2012/02/10 00:04:01]

http://xorax.sea/ffmpeg-security/wav.711.ogv

[DaleCurtis, 2012/02/10 23:04:35]

New patch set has a fix for this in ogg_read_close.

On 2012/02/10 00:04:01, DaleCurtis wrote:

+Leak_DefinitelyLost
+30 bytes in 1 blocks are definitely lost in loss record 999 of 2,935
+  posix_memalign (m_replacemalloc/vg_replace_malloc.c:1093)
+  av_malloc (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:94)
+  av_mallocz (/out/Debug/../../third_party/ffmpeg/libavutil/mem.c:186)
+  vorbis_header (/out/Debug/../../third_party/ffmpeg/libavformat/oggparsevorbis.c:221)
+  ogg_packet (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.c:393)
+  ogg_get_headers (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.c:460)
+  ogg_read_header (/out/Debug/../../third_party/ffmpeg/libavformat/oggdec.c:519)
+  avformat_open_input (/out/Debug/../../third_party/ffmpeg/libavformat/utils.c:599)
+  avformat_open_input (/out/Debug/obj/third_party/ffmpeg/ffmpeg.gen/ffmpeg_stubs.cc:425)
+  media::FFmpegDemuxer::InitializeTask(media::DataSource*, base::Callback<void ()(media::PipelineStatus)> const&) (/out/Debug/../../media/filters/ffmpeg_demuxer.cc:469)
+Suppression (error hash=#AE9AA9274836BD48#):
+  For more info on using suppressions see http://dev.chromium.org/developers/tree-sheriffs/sheriff-details-chromium/memory-sheriff#TOC-Suppressing-memory-reports
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:posix_memalign
+   fun:av_malloc
+   fun:av_mallocz
+   fun:vorbis_header
+   fun:ogg_packet
+   fun:ogg_get_headers
+   fun:ogg_read_header
+   fun:avformat_open_input
+   fun:avformat_open_input
+   fun:_ZN5media13FFmpegDemuxer14InitializeTaskEPNS_10DataSourceERKN4base8CallbackIFvNS_14PipelineStatusEEEE
+}