diff --git a/media-tv/kodi/Manifest b/media-tv/kodi/Manifest index 5807395..d6ba95b 100644 --- a/media-tv/kodi/Manifest +++ b/media-tv/kodi/Manifest @@ -6,6 +6,7 @@ AUX kodi-20.5-ffmpeg6.patch 24798 BLAKE2B d9ed0a7e8d0d873f46ffe95e84eefb94ca4f53 AUX kodi-20.5-fix-crash-in-avcodec_parameters_from_context.patch 1351 BLAKE2B 0c1739fbda97c0e5a8064c0242a2d1d2e5db499bf336abc8d0119398aef156128a114f1f8616cee235f09e39752df156d99f3049fd2f13693246526593c5e08f SHA512 34da97b3803b585f90f2e5fced64bc0c7447c36df73384df29f539348bc8d230bbb9fcdfa7a12baf2794d0d0e1493248723e012ebe3ac0862e1d4add06f64b94 AUX kodi-20.5-smart_ptr-and-custom-destructor-for-AVCodecParameters.patch 2113 BLAKE2B 4e6e3401c8b25297f633ff88457eda364de639e915b210d71a5905877c309bc81cf7d6e748307e76e8b9badca76024e313e7d32d88bba626642d4daa91e63357 SHA512 2b1a50e6f7f5eec62f2dc13cf3afb126cb0a05a5db7c87a5dfc9a4962b45c93c12ea71cb77fa007b4fab2a98109c08b1890a78cc5a85c99b658ac7e9648d0bcd AUX kodi-20.5-swig-4.2.patch 446 BLAKE2B 6b11113506dce61aa951a3b8c533fa2478a6c686f309c79187dc681fa9ea7e813ac6c902f613b68293e6ce28ce81a30dd5f2705fdc58ab25984bf387a6d9b37c SHA512 8e570d10eff512f45ea926b3cf0af8167cab2ae5097d0e8602634d6948eb064e5196bc60d8a4d6b7a6145bea8a2dd295df0731b9d5e1081879f628520225e336 +AUX kodi-21.0-fix-head-use-after-free.patch 32519 BLAKE2B f5f9d4005da38381bd156307789253c358b32df3284e1eb84848f68d9c9e2b9b854c3801a5e4076ba172801dcd2e655505f446ceee89f5040e129003f85d7f84 SHA512 f654300c5d1d3d0bd49388430b843da4768c7fe225dd50f9908e0494375d22aadb3dc1251fb77af47796971769a872ee6d13ede5dc0b0aaeea07c49bc7e0b940 DIST apache-groovy-binary-4.0.16.zip 29793704 BLAKE2B 30f77c6400c85821cf78f6ba1070da1e68644531f85f71cf7695443b13b81393cc89d4103eb869d1523f0a22a6e1c3428dcabf4f79c8a2c6eb2a6dea74e84e8f SHA512 743698979c801f3cfb36545888b5303e1e25dae5692bb45cab7ebbe102a6eda31f09abc6978349ad90ecaf630416fc87eacba7781244855e7e771a3c44041fa0 DIST commons-lang3-3.14.0-bin.tar.gz 9442785 BLAKE2B 2ecdd06f97ac2688220055a08f67da9b859bed3ab00ff41800d5d9a1cebda599db2e816425c10c265dd6827a0ef79fc3dd094a8b3c9b9ae4ceae8f5750a59cf2 SHA512 8e7e62418a49ba810512c13a640a8bf35f878fcd54af32fdaab1111e37817f58b21b475980ba663fba4887e45ef8d88af8ff17796f20d202e929e8e2574546dc DIST commons-text-1.11.0-bin.tar.gz 3018564 BLAKE2B c32e41c6b8c90dea876caf4c2cedc9358d5e49506bfee7aee42ac6b92dbe8505d5e5d81c860a739bb06214b832cc29e91ddb95f3cfc24515c970302a519a5e43 SHA512 2e94877000dd270b69e2e8cbf49f258a90b4c628b6b6b0814e300a2f0e9c391f0816dceb0707e596ae3b7c9532f93e7a4917df47c77f44b3a810e14042ce5f3f @@ -17,4 +18,4 @@ DIST libdvdcss-1.4.3-Next-Nexus-Alpha2-2.tar.gz 102124 BLAKE2B 2f503d3ab76709495 DIST libdvdnav-6.1.1-Next-Nexus-Alpha2-2.tar.gz 128547 BLAKE2B db4d05836d8fbb3637ae50bdbfc0e4b612ee6b3be24addfea94ce772c3bf28d58b63a3f252d6f9f016f72f8cbb841cc1820b091226b136f4c4664385a32da73c SHA512 51e6fc033121241354a5f0b3fc9a430577ae3ff6bb7f31445aa548ef4893037fb80eea3b2c6774c81e9ebaf9c45e9b490c98c2c65eb38f9f7daba84b236f7e1d DIST libdvdread-6.1.3-Next-Nexus-Alpha2-2.tar.gz 110513 BLAKE2B c94feb5a03a12efa5b7767965118d2500a088299ea36f3b82e46d157e45893e6b04503cb50f179ca681bac914457607fab26acfa6e304752b355c407578572d1 SHA512 629a41157d07b8ec0ea1fe89ae5ec48f63047472a862782b805c531ae31a0376fc4dc15175f8280c3ef91d7fa977bacebb1b51232640034a34bab2293210fc5e EBUILD kodi-20.5.ebuild 12607 BLAKE2B bcf5ac4df923c3c789a56bdb5d93997d3e52b63c480717d18ccd0dd1d6dfa92e309e0e2da79febba946b685295aea9791766bd20fb3ad86055aa93ba96419659 SHA512 d58c5693c42dd1ba6d41d4e8bd0986ae35edb80b63c79619659d51fac5f617bd3cb97631ecd8626d974b75d611fe88c4d53e0ed185c5b11612db9e5bd53b978e -EBUILD kodi-21.0.ebuild 12944 BLAKE2B d0fab3c7e5878c5c5a84361ded0ba8e69b07ffd91af6e076abc69290f8b77d1425c3d2b6a74302a310ce293538c3733890ca90cf4f2c038036e94de441f94103 SHA512 f4b5a1de67713964034e2c5fe6b4a652941660e3b5090edab63710cf6f98a1e7b3830941e46ed072b1983177559cad6a4b256344b5bf628910c894f750d83ab3 +EBUILD kodi-21.0.ebuild 12985 BLAKE2B 1f92981dbf88468dd487878635faa413606d1f23dc4f39b2feb2fabaaeb3ac93c68efd291ddbb67b80bb10fefc3fc0507862d5892d6b1c082cd319b64f845cc0 SHA512 0b5c839b0d0a82fff064ccf818141a343f01377e0644922d15a2b70710923d316f056706b3a5f25f440fa3b7519ceef2996321518e4a552f510dae8c0900b015 diff --git a/media-tv/kodi/files/kodi-21.0-fix-head-use-after-free.patch b/media-tv/kodi/files/kodi-21.0-fix-head-use-after-free.patch new file mode 100644 index 0000000..6d22f42 --- /dev/null +++ b/media-tv/kodi/files/kodi-21.0-fix-head-use-after-free.patch @@ -0,0 +1,333 @@ +From 02e6b6f9003aaf3984ccb83b91df4bf4cd183c6f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Markus=20H=C3=A4rer?= +Date: Mon, 1 Apr 2024 19:15:07 +0200 +Subject: [PATCH 1/2] [GUIIncludes] Fix heap-use-after-free + +Only remove the child if the node is actually a child. + +==51989==ERROR: AddressSanitizer: heap-use-after-free on address 0x511003b69210 at pc 0x5ce4b249275e bp 0x7fff43e1d430 sp 0x7fff43e1d428 +READ of size 8 at 0x511003b69210 thread T0 + #0 0x5ce4b249275d in TiXmlAttributeSet::First() /usr/include/tinyxml.h:915:50 + #1 0x5ce4b2492098 in TiXmlElement::FirstAttribute() /usr/include/tinyxml.h:1087:61 + #2 0x5ce4b2bb091e in CGUIIncludes::ResolveParametersForNode(TiXmlElement*, std::map, std::allocator>, std::__cxx11::basic_string, std::allocator>, std::less, std::allocator>>, std::allocator, std::allocator> const, std::__cxx11::basic_string, std::allocator>>>> const&) xbmc/guilib/GUIIncludes.cpp:586:37 + #3 0x5ce4b2bae9bb in CGUIIncludes::ResolveIncludes(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/guilib/GUIIncludes.cpp:485:9 + #4 0x5ce4b2ba8eaf in CGUIIncludes::Resolve(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/guilib/GUIIncludes.cpp:312:3 + #5 0x5ce4b2ba8fce in CGUIIncludes::Resolve(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/guilib/GUIIncludes.cpp:318:5 + #6 0x5ce4b3e808d3 in ADDON::CSkinInfo::ResolveIncludes(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/addons/Skin.cpp:307:14 + #7 0x5ce4b2e00084 in CGUIWindow::Prepare(std::unique_ptr> const&) xbmc/guilib/GUIWindow.cpp:168:15 + #8 0x5ce4b2dff45e in CGUIWindow::LoadXML(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&) xbmc/guilib/GUIWindow.cpp:155:15 + #9 0x5ce4b2dfd540 in CGUIWindow::Load(std::__cxx11::basic_string, std::allocator> const&, bool) xbmc/guilib/GUIWindow.cpp:109:14 + #10 0x5ce4b2e1cac5 in CGUIWindow::AllocResources(bool) xbmc/guilib/GUIWindow.cpp:765:7 + #11 0x5ce4b2e14c77 in CGUIWindow::OnMessage(CGUIMessage&) xbmc/guilib/GUIWindow.cpp:594:52 + #12 0x5ce4b19ce9d2 in CGUIWindowHome::OnMessage(CGUIMessage&) xbmc/windows/GUIWindowHome.cpp:182:22 + #13 0x5ce4b2e613a1 in CGUIWindowManager::ActivateWindow_Internal(int, std::vector, std::allocator>, std::allocator, std::allocator>>> const&, bool, bool) xbmc/guilib/GUIWindowManager.cpp:896:15 + #14 0x5ce4b2e5ce3c in CGUIWindowManager::ActivateWindow(int, std::vector, std::allocator>, std::allocator, std::allocator>>> const&, bool, bool) xbmc/guilib/GUIWindowManager.cpp:802:5 + #15 0x5ce4b683ad63 in int (anonymous namespace)::ActivateWindow(std::vector, std::allocator>, std::allocator, std::allocator>>> const&) xbmc/interfaces/builtins/GUIBuiltins.cpp:109:52 + #16 0x5ce4b6822865 in CBuiltins::Execute(std::__cxx11::basic_string, std::allocator> const&) xbmc/interfaces/builtins/Builtins.cpp:158:14 + #17 0x5ce4b34047ff in CApplication::ExecuteXBMCAction(std::__cxx11::basic_string, std::allocator>, std::shared_ptr const&) xbmc/application/Application.cpp:3037:32 + #18 0x5ce4b3400a16 in CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp:3013:14 + #19 0x5ce4b34058a0 in non-virtual thunk to CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp + #20 0x5ce4b2e52261 in CGUIWindowManager::SendMessage(CGUIMessage&) xbmc/guilib/GUIWindowManager.cpp:510:23 + #21 0x5ce4b2e7cc7f in CGUIWindowManager::DispatchThreadMessages() xbmc/guilib/GUIWindowManager.cpp:1572:7 + #22 0x5ce4b3405bfa in CApplication::Process() xbmc/application/Application.cpp:3139:48 + #23 0x5ce4b33ddc98 in CApplication::Run() xbmc/application/Application.cpp:1855:5 + #24 0x5ce4b251b323 in XBMC_Run xbmc/platform/xbmc.cpp:61:26 + #25 0x5ce4af14af0f in main xbmc/platform/posix/main.cpp:70:16 + #26 0x76d804243ccf (/usr/lib/libc.so.6+0x25ccf) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + #27 0x76d804243d89 in __libc_start_main (/usr/lib/libc.so.6+0x25d89) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + #28 0x5ce4af010b94 in _start (/home/mark/Coding/Repos/kodi-git/build_clang_debug_sanitizer/kodi.bin+0xa317b94) (BuildId: 923aa634157be6adc50052366abd3ca0edfeffc0) + +0x511003b69210 is located 208 bytes inside of 216-byte region [0x511003b69140,0x511003b69218) +freed by thread T0 here: + #0 0x5ce4af148d72 in operator delete(void*, unsigned long) (/home/mark/Coding/Repos/kodi-git/build_clang_debug_sanitizer/kodi.bin+0xa44fd72) (BuildId: 923aa634157be6adc50052366abd3ca0edfeffc0) + #1 0x76d80670ea48 in TiXmlNode::RemoveChild(TiXmlNode*) (/usr/lib/libtinyxml.so.0+0x8a48) (BuildId: 2f5d236264d4d695dbe432f41e1eb46c7bc2d5d4) + #2 0x5ce4b2bae9a3 in CGUIIncludes::ResolveIncludes(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/guilib/GUIIncludes.cpp:482:9 + #3 0x5ce4b2ba8eaf in CGUIIncludes::Resolve(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/guilib/GUIIncludes.cpp:312:3 + #4 0x5ce4b2ba8fce in CGUIIncludes::Resolve(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/guilib/GUIIncludes.cpp:318:5 + #5 0x5ce4b3e808d3 in ADDON::CSkinInfo::ResolveIncludes(TiXmlElement*, std::map, bool, std::less>, std::allocator const, bool>>>*) xbmc/addons/Skin.cpp:307:14 + #6 0x5ce4b2e00084 in CGUIWindow::Prepare(std::unique_ptr> const&) xbmc/guilib/GUIWindow.cpp:168:15 + #7 0x5ce4b2dff45e in CGUIWindow::LoadXML(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&) xbmc/guilib/GUIWindow.cpp:155:15 + #8 0x5ce4b2dfd540 in CGUIWindow::Load(std::__cxx11::basic_string, std::allocator> const&, bool) xbmc/guilib/GUIWindow.cpp:109:14 + #9 0x5ce4b2e1cac5 in CGUIWindow::AllocResources(bool) xbmc/guilib/GUIWindow.cpp:765:7 + #10 0x5ce4b2e14c77 in CGUIWindow::OnMessage(CGUIMessage&) xbmc/guilib/GUIWindow.cpp:594:52 + #11 0x5ce4b19ce9d2 in CGUIWindowHome::OnMessage(CGUIMessage&) xbmc/windows/GUIWindowHome.cpp:182:22 + #12 0x5ce4b2e613a1 in CGUIWindowManager::ActivateWindow_Internal(int, std::vector, std::allocator>, std::allocator, std::allocator>>> const&, bool, bool) xbmc/guilib/GUIWindowManager.cpp:896:15 + #13 0x5ce4b2e5ce3c in CGUIWindowManager::ActivateWindow(int, std::vector, std::allocator>, std::allocator, std::allocator>>> const&, bool, bool) xbmc/guilib/GUIWindowManager.cpp:802:5 + #14 0x5ce4b683ad63 in int (anonymous namespace)::ActivateWindow(std::vector, std::allocator>, std::allocator, std::allocator>>> const&) xbmc/interfaces/builtins/GUIBuiltins.cpp:109:52 + #15 0x5ce4b6822865 in CBuiltins::Execute(std::__cxx11::basic_string, std::allocator> const&) xbmc/interfaces/builtins/Builtins.cpp:158:14 + #16 0x5ce4b34047ff in CApplication::ExecuteXBMCAction(std::__cxx11::basic_string, std::allocator>, std::shared_ptr const&) xbmc/application/Application.cpp:3037:32 + #17 0x5ce4b3400a16 in CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp:3013:14 + #18 0x5ce4b34058a0 in non-virtual thunk to CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp + #19 0x5ce4b2e52261 in CGUIWindowManager::SendMessage(CGUIMessage&) xbmc/guilib/GUIWindowManager.cpp:510:23 + #20 0x5ce4b2e7cc7f in CGUIWindowManager::DispatchThreadMessages() xbmc/guilib/GUIWindowManager.cpp:1572:7 + #21 0x5ce4b3405bfa in CApplication::Process() xbmc/application/Application.cpp:3139:48 + #22 0x5ce4b33ddc98 in CApplication::Run() xbmc/application/Application.cpp:1855:5 + #23 0x5ce4b251b323 in XBMC_Run xbmc/platform/xbmc.cpp:61:26 + #24 0x5ce4af14af0f in main xbmc/platform/posix/main.cpp:70:16 + #25 0x76d804243ccf (/usr/lib/libc.so.6+0x25ccf) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + +previously allocated by thread T0 here: + #0 0x5ce4af147e12 in operator new(unsigned long) (/home/mark/Coding/Repos/kodi-git/build_clang_debug_sanitizer/kodi.bin+0xa44ee12) (BuildId: 923aa634157be6adc50052366abd3ca0edfeffc0) + #1 0x76d806711497 in TiXmlElement::Clone() const (/usr/lib/libtinyxml.so.0+0xb497) (BuildId: 2f5d236264d4d695dbe432f41e1eb46c7bc2d5d4) + +SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/tinyxml.h:915:50 in TiXmlAttributeSet::First() +Shadow bytes around the buggy address: + 0x511003b68f80: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69100: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x511003b69180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x511003b69200: fd fd[fd]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511003b69480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==51989==ABORTING + +(cherry picked from commit 52988c92e934e593ddb8e93d6369f0636dc7db84) +--- + xbmc/guilib/GUIIncludes.cpp | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/xbmc/guilib/GUIIncludes.cpp b/xbmc/guilib/GUIIncludes.cpp +index 55d967346f1f5..da8f3a33c943e 100644 +--- a/xbmc/guilib/GUIIncludes.cpp ++++ b/xbmc/guilib/GUIIncludes.cpp +@@ -529,7 +529,8 @@ void CGUIIncludes::InsertNested(TiXmlElement *controls, TiXmlElement *include, T + } + child = child->NextSiblingElement(); + } +- target->RemoveChild(nested); ++ if (nested != node) ++ target->RemoveChild(nested); + } + + } + +From 25dec1b0ee14b65cc44d0fd1792e4e6b583fbdcb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Markus=20H=C3=A4rer?= +Date: Mon, 1 Apr 2024 19:24:57 +0200 +Subject: [PATCH 2/2] [GUIBaseContainer] Fix heap-use-after-free + +See comment in code for information. + +==30885==ERROR: AddressSanitizer: heap-use-after-free on address 0x51800050bbe8 at pc 0x56aa085d20db bp 0x7ffd92777f50 sp 0x7ffd92777f48 +READ of size 1 at 0x51800050bbe8 thread T0 + #0 0x56aa085d20da in CGUIAction::ExecuteActions(int, int, std::shared_ptr const&) const xbmc/guilib/GUIAction.cpp:86:9 + #1 0x56aa084b7701 in CStaticListProvider::OnClick(std::shared_ptr const&) xbmc/guilib/listproviders/StaticProvider.cpp:136:40 + #2 0x56aa0862e065 in CGUIBaseContainer::OnClick(int) xbmc/guilib/GUIBaseContainer.cpp:881:27 + #3 0x56aa0862b09c in CGUIBaseContainer::OnAction(CAction const&) xbmc/guilib/GUIBaseContainer.cpp:474:28 + #4 0x56aa08c4bdf5 in CGUIWrappingListContainer::OnAction(CAction const&) xbmc/guilib/GUIWrappingListContainer.cpp:75:29 + #5 0x56aa08b8f441 in CGUIWindow::OnAction(CAction const&) xbmc/guilib/GUIWindow.cpp:429:27 + #6 0x56aa08bee00c in CGUIWindowManager::HandleAction(CAction const&) const xbmc/guilib/GUIWindowManager.cpp:1199:20 + #7 0x56aa08bec973 in CGUIWindowManager::OnAction(CAction const&) const xbmc/guilib/GUIWindowManager.cpp:1144:11 + #8 0x56aa0912be04 in CApplication::OnAction(CAction const&) xbmc/application/Application.cpp:913:54 + #9 0x56aa0c914de1 in CInputManager::ExecuteInputAction(CAction const&) xbmc/input/InputManager.cpp:746:29 + #10 0x56aa0c921842 in CInputManager::HandleKey(CKey const&) xbmc/input/InputManager.cpp:680:10 + #11 0x56aa0c91c2ec in CInputManager::OnKeyUp(CKey const&) xbmc/input/InputManager.cpp:693:5 + #12 0x56aa0c917737 in CInputManager::OnEvent(XBMC_Event&) xbmc/input/InputManager.cpp:361:7 + #13 0x56aa090fe458 in CAppInboundProtocol::HandleEvents() xbmc/application/AppInboundProtocol.cpp:113:43 + #14 0x56aa0915b240 in CApplication::FrameMove(bool, bool) xbmc/application/Application.cpp:1756:17 + #15 0x56aa0915f200 in CApplication::Run() xbmc/application/Application.cpp:1860:7 + #16 0x56aa0829c3e3 in XBMC_Run xbmc/platform/xbmc.cpp:61:26 + #17 0x56aa04ecbfcf in main xbmc/platform/posix/main.cpp:70:16 + #18 0x7517fb043ccf (/usr/lib/libc.so.6+0x25ccf) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + #19 0x7517fb043d89 in __libc_start_main (/usr/lib/libc.so.6+0x25d89) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + #20 0x56aa04d91c54 in _start (/home/mark/Coding/Repos/kodi-git/build_clang_debug_sanitizer/kodi.bin+0xa317c54) (BuildId: 7f84180dd757174de6de03b115843129667234d3) + +0x51800050bbe8 is located 872 bytes inside of 880-byte region [0x51800050b880,0x51800050bbf0) +freed by thread T0 here: + #0 0x56aa04ec996a in operator delete(void*) (/home/mark/Coding/Repos/kodi-git/build_clang_debug_sanitizer/kodi.bin+0xa44f96a) (BuildId: 7f84180dd757174de6de03b115843129667234d3) + #1 0x56aa08ae24d1 in CGUIStaticItem::~CGUIStaticItem() xbmc/guilib/GUIStaticItem.h:55:38 + #2 0x56aa05922763 in std::_Sp_counted_ptr::_M_dispose() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/shared_ptr_base.h:428:9 + #3 0x56aa04ecd0bc in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/shared_ptr_base.h:346:8 + #4 0x56aa04eccca9 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/shared_ptr_base.h:1071:11 + #5 0x56aa050d1c6c in std::__shared_ptr::~__shared_ptr() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/shared_ptr_base.h:1524:31 + #6 0x56aa050c6ee8 in std::shared_ptr::~shared_ptr() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/shared_ptr.h:175:11 + #7 0x56aa08465110 in void std::_Destroy>(std::shared_ptr*) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_construct.h:151:19 + #8 0x56aa0846505e in void std::_Destroy_aux::__destroy*>(std::shared_ptr*, std::shared_ptr*) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_construct.h:163:6 + #9 0x56aa08465024 in void std::_Destroy*>(std::shared_ptr*, std::shared_ptr*) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_construct.h:195:7 + #10 0x56aa084a624b in void std::_Destroy*, std::shared_ptr>(std::shared_ptr*, std::shared_ptr*, std::allocator>&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/alloc_traits.h:947:7 + #11 0x56aa084a624b in std::vector, std::allocator>>::~vector() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_vector.h:732:2 + #12 0x56aa086169e5 in CGUIBaseContainer::~CGUIBaseContainer() xbmc/guilib/GUIBaseContainer.cpp:117:1 + #13 0x56aa08c4a148 in CGUIWrappingListContainer::~CGUIWrappingListContainer() xbmc/guilib/GUIWrappingListContainer.cpp:26:59 + #14 0x56aa08c4a198 in CGUIWrappingListContainer::~CGUIWrappingListContainer() xbmc/guilib/GUIWrappingListContainer.cpp:26:59 + #15 0x56aa08758935 in CGUIControlGroup::ClearAll() xbmc/guilib/GUIControlGroup.cpp:525:5 + #16 0x56aa08743bb9 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:56:3 + #17 0x56aa08743c48 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:55:1 + #18 0x56aa08758935 in CGUIControlGroup::ClearAll() xbmc/guilib/GUIControlGroup.cpp:525:5 + #19 0x56aa08743bb9 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:56:3 + #20 0x56aa08743c48 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:55:1 + #21 0x56aa08758935 in CGUIControlGroup::ClearAll() xbmc/guilib/GUIControlGroup.cpp:525:5 + #22 0x56aa08743bb9 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:56:3 + #23 0x56aa08743c48 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:55:1 + #24 0x56aa08758935 in CGUIControlGroup::ClearAll() xbmc/guilib/GUIControlGroup.cpp:525:5 + #25 0x56aa08743bb9 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:56:3 + #26 0x56aa08743c48 in CGUIControlGroup::~CGUIControlGroup() xbmc/guilib/GUIControlGroup.cpp:55:1 + #27 0x56aa08758935 in CGUIControlGroup::ClearAll() xbmc/guilib/GUIControlGroup.cpp:525:5 + #28 0x56aa08b9f39d in CGUIWindow::ClearAll() xbmc/guilib/GUIWindow.cpp:816:21 + #29 0x56aa08b9ed97 in CGUIWindow::FreeResources(bool) xbmc/guilib/GUIWindow.cpp:799:53 + #30 0x56aa08bf8e34 in CGUIWindowManager::DeInitialize() xbmc/guilib/GUIWindowManager.cpp:1452:14 + #31 0x56aa09264d22 in CApplicationSkinHandling::UnloadSkin() xbmc/application/ApplicationSkinHandling.cpp:235:29 + #32 0x56aa0925e0fd in CApplicationSkinHandling::LoadSkin(std::__cxx11::basic_string, std::allocator> const&) xbmc/application/ApplicationSkinHandling.cpp:111:3 + #33 0x56aa0926a8e6 in CApplicationSkinHandling::ReloadSkin(bool) xbmc/application/ApplicationSkinHandling.cpp:390:7 + #34 0x56aa0c635399 in ReloadSkin(std::vector, std::allocator>, std::allocator, std::allocator>>> const&) xbmc/interfaces/builtins/SkinBuiltins.cpp:46:12 + #35 0x56aa0c5a39e5 in CBuiltins::Execute(std::__cxx11::basic_string, std::allocator> const&) xbmc/interfaces/builtins/Builtins.cpp:158:14 + #36 0x56aa0918597f in CApplication::ExecuteXBMCAction(std::__cxx11::basic_string, std::allocator>, std::shared_ptr const&) xbmc/application/Application.cpp:3037:32 + #37 0x56aa09181b96 in CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp:3013:14 + #38 0x56aa09186a20 in non-virtual thunk to CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp + #39 0x56aa08bd33e1 in CGUIWindowManager::SendMessage(CGUIMessage&) xbmc/guilib/GUIWindowManager.cpp:510:23 + #40 0x56aa085d2502 in CGUIAction::ExecuteActions(int, int, std::shared_ptr const&) const xbmc/guilib/GUIAction.cpp:89:52 + #41 0x56aa084b7701 in CStaticListProvider::OnClick(std::shared_ptr const&) xbmc/guilib/listproviders/StaticProvider.cpp:136:40 + #42 0x56aa0862e065 in CGUIBaseContainer::OnClick(int) xbmc/guilib/GUIBaseContainer.cpp:881:27 + #43 0x56aa0862b09c in CGUIBaseContainer::OnAction(CAction const&) xbmc/guilib/GUIBaseContainer.cpp:474:28 + #44 0x56aa08c4bdf5 in CGUIWrappingListContainer::OnAction(CAction const&) xbmc/guilib/GUIWrappingListContainer.cpp:75:29 + #45 0x56aa08b8f441 in CGUIWindow::OnAction(CAction const&) xbmc/guilib/GUIWindow.cpp:429:27 + #46 0x56aa08bee00c in CGUIWindowManager::HandleAction(CAction const&) const xbmc/guilib/GUIWindowManager.cpp:1199:20 + #47 0x56aa08bec973 in CGUIWindowManager::OnAction(CAction const&) const xbmc/guilib/GUIWindowManager.cpp:1144:11 + #48 0x56aa0912be04 in CApplication::OnAction(CAction const&) xbmc/application/Application.cpp:913:54 + #49 0x56aa0c914de1 in CInputManager::ExecuteInputAction(CAction const&) xbmc/input/InputManager.cpp:746:29 + #50 0x56aa0c921842 in CInputManager::HandleKey(CKey const&) xbmc/input/InputManager.cpp:680:10 + #51 0x56aa0c91c2ec in CInputManager::OnKeyUp(CKey const&) xbmc/input/InputManager.cpp:693:5 + #52 0x56aa0c917737 in CInputManager::OnEvent(XBMC_Event&) xbmc/input/InputManager.cpp:361:7 + #53 0x56aa090fe458 in CAppInboundProtocol::HandleEvents() xbmc/application/AppInboundProtocol.cpp:113:43 + #54 0x56aa0915b240 in CApplication::FrameMove(bool, bool) xbmc/application/Application.cpp:1756:17 + #55 0x56aa0915f200 in CApplication::Run() xbmc/application/Application.cpp:1860:7 + #56 0x56aa0829c3e3 in XBMC_Run xbmc/platform/xbmc.cpp:61:26 + #57 0x56aa04ecbfcf in main xbmc/platform/posix/main.cpp:70:16 + #58 0x7517fb043ccf (/usr/lib/libc.so.6+0x25ccf) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + +previously allocated by thread T0 here: + #0 0x56aa04ec8ed2 in operator new(unsigned long) (/home/mark/Coding/Repos/kodi-git/build_clang_debug_sanitizer/kodi.bin+0xa44eed2) (BuildId: 7f84180dd757174de6de03b115843129667234d3) + #1 0x56aa084b3183 in CStaticListProvider::CStaticListProvider(TiXmlElement const*, int) xbmc/guilib/listproviders/StaticProvider.cpp:28:33 + #2 0x56aa0849c590 in std::__detail::_MakeUniq::__single_object std::make_unique(TiXmlElement const*&&, int&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/unique_ptr.h:1070:34 + #3 0x56aa0849bac7 in IListProvider::CreateSingle(TiXmlNode const*, int) xbmc/guilib/listproviders/IListProvider.cpp:34:12 + #4 0x56aa0849b582 in IListProvider::Create(TiXmlNode const*, int) xbmc/guilib/listproviders/IListProvider.cpp:25:12 + #5 0x56aa0864bbe8 in CGUIBaseContainer::LoadListProvider(TiXmlElement*, int, bool) xbmc/guilib/GUIBaseContainer.cpp:1282:20 + #6 0x56aa0871b1c3 in CGUIControlFactory::Create(int, CRectGen const&, TiXmlElement*, bool) xbmc/guilib/GUIControlFactory.cpp:1543:17 + #7 0x56aa08b884c4 in CGUIWindow::LoadControl(TiXmlElement*, CGUIControlGroup*, CRectGen const&) xbmc/guilib/GUIWindow.cpp:281:38 + #8 0x56aa08b8a088 in CGUIWindow::LoadControl(TiXmlElement*, CGUIControlGroup*, CRectGen const&) xbmc/guilib/GUIWindow.cpp:309:9 + #9 0x56aa08b8a088 in CGUIWindow::LoadControl(TiXmlElement*, CGUIControlGroup*, CRectGen const&) xbmc/guilib/GUIWindow.cpp:309:9 + #10 0x56aa08b8a088 in CGUIWindow::LoadControl(TiXmlElement*, CGUIControlGroup*, CRectGen const&) xbmc/guilib/GUIWindow.cpp:309:9 + #11 0x56aa08b8a088 in CGUIWindow::LoadControl(TiXmlElement*, CGUIControlGroup*, CRectGen const&) xbmc/guilib/GUIWindow.cpp:309:9 + #12 0x56aa08b87cf6 in CGUIWindow::Load(TiXmlElement*) xbmc/guilib/GUIWindow.cpp:264:11 + #13 0x56aa08b80657 in CGUIWindow::LoadXML(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&) xbmc/guilib/GUIWindow.cpp:155:10 + #14 0x56aa08b7e6c0 in CGUIWindow::Load(std::__cxx11::basic_string, std::allocator> const&, bool) xbmc/guilib/GUIWindow.cpp:109:14 + #15 0x56aa08b9dc45 in CGUIWindow::AllocResources(bool) xbmc/guilib/GUIWindow.cpp:765:7 + #16 0x56aa08b95df7 in CGUIWindow::OnMessage(CGUIMessage&) xbmc/guilib/GUIWindow.cpp:594:52 + #17 0x56aa08be2521 in CGUIWindowManager::ActivateWindow_Internal(int, std::vector, std::allocator>, std::allocator, std::allocator>>> const&, bool, bool) xbmc/guilib/GUIWindowManager.cpp:896:15 + #18 0x56aa08bddfbc in CGUIWindowManager::ActivateWindow(int, std::vector, std::allocator>, std::allocator, std::allocator>>> const&, bool, bool) xbmc/guilib/GUIWindowManager.cpp:802:5 + #19 0x56aa0c5b75f3 in int (anonymous namespace)::ActivateWindow(std::vector, std::allocator>, std::allocator, std::allocator>>> const&) xbmc/interfaces/builtins/GUIBuiltins.cpp:109:52 + #20 0x56aa0c5a39e5 in CBuiltins::Execute(std::__cxx11::basic_string, std::allocator> const&) xbmc/interfaces/builtins/Builtins.cpp:158:14 + #21 0x56aa0918597f in CApplication::ExecuteXBMCAction(std::__cxx11::basic_string, std::allocator>, std::shared_ptr const&) xbmc/application/Application.cpp:3037:32 + #22 0x56aa09181b96 in CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp:3013:14 + #23 0x56aa09186a20 in non-virtual thunk to CApplication::OnMessage(CGUIMessage&) xbmc/application/Application.cpp + #24 0x56aa08bd33e1 in CGUIWindowManager::SendMessage(CGUIMessage&) xbmc/guilib/GUIWindowManager.cpp:510:23 + #25 0x56aa085d2502 in CGUIAction::ExecuteActions(int, int, std::shared_ptr const&) const xbmc/guilib/GUIAction.cpp:89:52 + #26 0x56aa0867f896 in CGUIButtonControl::OnClick() xbmc/guilib/GUIButtonControl.cpp:393:16 + #27 0x56aa08677e86 in CGUIButtonControl::OnAction(CAction const&) xbmc/guilib/GUIButtonControl.cpp:212:5 + #28 0x56aa08b8f441 in CGUIWindow::OnAction(CAction const&) xbmc/guilib/GUIWindow.cpp:429:27 + #29 0x56aa08bee00c in CGUIWindowManager::HandleAction(CAction const&) const xbmc/guilib/GUIWindowManager.cpp:1199:20 + #30 0x56aa08bec973 in CGUIWindowManager::OnAction(CAction const&) const xbmc/guilib/GUIWindowManager.cpp:1144:11 + #31 0x56aa0912be04 in CApplication::OnAction(CAction const&) xbmc/application/Application.cpp:913:54 + #32 0x56aa0c914de1 in CInputManager::ExecuteInputAction(CAction const&) xbmc/input/InputManager.cpp:746:29 + #33 0x56aa0c921842 in CInputManager::HandleKey(CKey const&) xbmc/input/InputManager.cpp:680:10 + #34 0x56aa0c91c2ec in CInputManager::OnKeyUp(CKey const&) xbmc/input/InputManager.cpp:693:5 + #35 0x56aa0c917737 in CInputManager::OnEvent(XBMC_Event&) xbmc/input/InputManager.cpp:361:7 + #36 0x56aa090fe458 in CAppInboundProtocol::HandleEvents() xbmc/application/AppInboundProtocol.cpp:113:43 + #37 0x56aa0915b240 in CApplication::FrameMove(bool, bool) xbmc/application/Application.cpp:1756:17 + #38 0x56aa0915f200 in CApplication::Run() xbmc/application/Application.cpp:1860:7 + #39 0x56aa0829c3e3 in XBMC_Run xbmc/platform/xbmc.cpp:61:26 + #40 0x56aa04ecbfcf in main xbmc/platform/posix/main.cpp:70:16 + #41 0x7517fb043ccf (/usr/lib/libc.so.6+0x25ccf) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af) + +SUMMARY: AddressSanitizer: heap-use-after-free xbmc/guilib/GUIAction.cpp:86:9 in CGUIAction::ExecuteActions(int, int, std::shared_ptr const&) const +Shadow bytes around the buggy address: + 0x51800050b900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x51800050b980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x51800050ba00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x51800050ba80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x51800050bb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x51800050bb80: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fa fa + 0x51800050bc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51800050bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51800050bd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51800050bd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51800050be00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==30885==ABORTING + +(cherry picked from commit 9e4cfd2d174bd939191d64e1788835a00ffcb28f) +--- + xbmc/guilib/GUIBaseContainer.cpp | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/xbmc/guilib/GUIBaseContainer.cpp b/xbmc/guilib/GUIBaseContainer.cpp +index c22eb71284f27..897459790dd76 100644 +--- a/xbmc/guilib/GUIBaseContainer.cpp ++++ b/xbmc/guilib/GUIBaseContainer.cpp +@@ -13,6 +13,7 @@ + #include "GUIListItemLayout.h" + #include "GUIMessage.h" + #include "ServiceBroker.h" ++#include "guilib/GUIListItem.h" + #include "guilib/guiinfo/GUIInfoLabels.h" + #include "guilib/listproviders/IListProvider.h" + #include "input/actions/Action.h" +@@ -875,10 +876,16 @@ bool CGUIBaseContainer::OnClick(int actionID) + int selected = GetSelectedItem(); + if (selected >= 0 && selected < static_cast(m_items.size())) + { ++ // One of the actions could trigger a reload of the GUI which destroys ++ // this CGUIBaseContainer and therefore the m_items[selected] we are ++ // going to process. The shared_ptr ensures that item survives until ++ // it has been processed. ++ std::shared_ptr item = m_items[selected]; ++ + if (m_clickActions.HasActionsMeetingCondition()) +- m_clickActions.ExecuteActions(0, GetParentID(), m_items[selected]); ++ m_clickActions.ExecuteActions(0, GetParentID(), item); + else +- m_listProvider->OnClick(m_items[selected]); ++ m_listProvider->OnClick(item); + } + return true; + } diff --git a/media-tv/kodi/kodi-21.0.ebuild b/media-tv/kodi/kodi-21.0.ebuild index c073ef5..fde96b4 100644 --- a/media-tv/kodi/kodi-21.0.ebuild +++ b/media-tv/kodi/kodi-21.0.ebuild @@ -277,6 +277,10 @@ In some cases Kodi needs to access multicast addresses. Please consider enabling IP_MULTICAST under Networking options. " +PATCHES=( + "${FILESDIR}/${P}-fix-head-use-after-free.patch" +) + pkg_setup() { check_extra_config java-pkg-2_pkg_setup @@ -290,11 +294,9 @@ src_unpack() { unpack ${MY_P}.tar.gz fi - for dep in apache-groovy-binary-${GROOVY_VERSION}.zip \ - commons-lang3-${APACHE_COMMONS_LANG_VERSION}-bin.tar.gz \ - commons-text-${APACHE_COMMONS_TEXT_VERSION}-bin.tar.gz; do - unpack ${dep} - done + unpack apache-groovy-binary-${GROOVY_VERSION}.zip + unpack commons-lang3-${APACHE_COMMONS_LANG_VERSION}-bin.tar.gz + unpack commons-text-${APACHE_COMMONS_TEXT_VERSION}-bin.tar.gz } src_prepare() {