libheif
libheif copied to clipboard
AddressSanitizer alloc-dealloc-mismatch on ColorProfile_nclx::~ColorProfile_nclx
Hey,
I just found the following ASAN hit on libheif. The destructor of ColorProfile_nclx doesn't use the correct function to destroy its members:
https://github.com/strukturag/libheif/blob/64d9ab99ce7ea8876700c034b19bbc8dd773ae0b/libheif/heif_cxx.h#L787-L795
==51910==ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete) on 0x6060000f3e00
#0 0x55c03cdabd19 in operator delete(void*) (/home/amalia/krita/build/plugins/impex/heif/tests/KisHeifTest+0x11ad19)
#1 0x7f7fca79d226 in heif::ColorProfile_nclx::~ColorProfile_nclx() /usr/include/libheif/heif_cxx.h:798:5
#2 0x7f7fca79d226 in HeifExport::convert(KisDocument*, QIODevice*, KisPinnedSharedPtr<KisPropertiesConfiguration>) /home/amalia/krita/src/plugins/impex/heif/HeifExport.cpp:451:9
#3 0x7f7fdf7666bb in KisImportExportManager::doExportImpl(QString const&, QSharedPointer<KisImportExportFilter>, KisPinnedSharedPtr<KisPropertiesConfiguration>) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:733:47
#4 0x7f7fdf763e26 in KisImportExportManager::doExport(QString const&, QSharedPointer<KisImportExportFilter>, KisPinnedSharedPtr<KisPropertiesConfiguration>, bool) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:677:13
#5 0x7f7fdf74e48d in KisImportExportManager::convert(KisImportExportManager::Direction, QString const&, QString const&, QString const&, bool, KisPinnedSharedPtr<KisPropertiesConfiguration>, bool, bool) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:441:22
#6 0x7f7fdf75286e in KisImportExportManager::exportDocument(QString const&, QString const&, QByteArray const&, bool, KisPinnedSharedPtr<KisPropertiesConfiguration>, bool) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:137:31
#7 0x7f7fdf703c7b in KisDocument::exportDocumentSync(QString const&, QByteArray const&, KisPinnedSharedPtr<KisPropertiesConfiguration>) /home/amalia/krita/src/libs/ui/KisDocument.cpp:1199:13
#8 0x55c03cdd0158 in KisHeifTest::testSaveHDR() /home/amalia/krita/src/plugins/impex/heif/tests/KisHeifTest.cpp:243:14
#9 0x55c03cdae23c in KisHeifTest::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/amalia/krita/build/plugins/impex/heif/tests/KisHeifTest_autogen/EWIEGA46WW/moc_KisHeifTest.cpp:111:21
#10 0x7f7fd904623d in QMetaMethod::invoke(QObject*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) const (/usr/lib/libQt5Core.so.5+0x29c23d)
#11 0x7f7fde225a6b in QTest::qRun() (/usr/lib/libQt5Test.so.5+0x1ba6b)
#12 0x7f7fde226c40 in QTest::qExec(QObject*, int, char**) (/usr/lib/libQt5Test.so.5+0x1cc40)
#13 0x55c03cde7b21 in main /home/amalia/krita/src/plugins/impex/heif/tests/KisHeifTest.cpp:531:1
#14 0x7f7fd888728f (/usr/lib/libc.so.6+0x2928f)
#15 0x7f7fd8887349 in __libc_start_main (/usr/lib/libc.so.6+0x29349)
#16 0x55c03ccc6d44 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115
0x6060000f3e00 is located 0 bytes inside of 52-byte region [0x6060000f3e00,0x6060000f3e34)
allocated by thread T0 here:
#0 0x55c03cd719c9 in malloc (/home/amalia/krita/build/plugins/impex/heif/tests/KisHeifTest+0xe09c9)
#1 0x7f7fcd9b99a2 in heif_nclx_color_profile_alloc (/usr/lib/libheif.so.1+0x409a2)
#2 0x7f7fdf7666bb in KisImportExportManager::doExportImpl(QString const&, QSharedPointer<KisImportExportFilter>, KisPinnedSharedPtr<KisPropertiesConfiguration>) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:733:47
#3 0x7f7fdf763e26 in KisImportExportManager::doExport(QString const&, QSharedPointer<KisImportExportFilter>, KisPinnedSharedPtr<KisPropertiesConfiguration>, bool) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:677:13
#4 0x7f7fdf74e48d in KisImportExportManager::convert(KisImportExportManager::Direction, QString const&, QString const&, QString const&, bool, KisPinnedSharedPtr<KisPropertiesConfiguration>, bool, bool) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:441:22
#5 0x7f7fdf75286e in KisImportExportManager::exportDocument(QString const&, QString const&, QByteArray const&, bool, KisPinnedSharedPtr<KisPropertiesConfiguration>, bool) /home/amalia/krita/src/libs/ui/KisImportExportManager.cpp:137:31
#6 0x7f7fdf703c7b in KisDocument::exportDocumentSync(QString const&, QByteArray const&, KisPinnedSharedPtr<KisPropertiesConfiguration>) /home/amalia/krita/src/libs/ui/KisDocument.cpp:1199:13
#7 0x55c03cdd0158 in KisHeifTest::testSaveHDR() /home/amalia/krita/src/plugins/impex/heif/tests/KisHeifTest.cpp:243:14
#8 0x55c03cdae23c in KisHeifTest::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/amalia/krita/build/plugins/impex/heif/tests/KisHeifTest_autogen/EWIEGA46WW/moc_KisHeifTest.cpp:111:21
#9 0x7f7fd904623d in QMetaMethod::invoke(QObject*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) const (/usr/lib/libQt5Core.so.5+0x29c23d)
#10 0x7f7fde225a6b in QTest::qRun() (/usr/lib/libQt5Test.so.5+0x1ba6b)
#11 0x7f7fde226c40 in QTest::qExec(QObject*, int, char**) (/usr/lib/libQt5Test.so.5+0x1cc40)
#12 0x7f7fd888728f (/usr/lib/libc.so.6+0x2928f)
Should use heif_nclx_color_profile_free instead of the delete:
https://github.com/strukturag/libheif/blob/64d9ab99ce7ea8876700c034b19bbc8dd773ae0b/libheif/heif.h#L836