Builder ffmpeg64-solaris10-i386 Build #14096

Results:

Failed

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpeg64-solaris10-i386' triggered this build

Steps and Logfiles:

1. git updating ( 5 secs )
   1. stdio
2. shell  
   1. - no logs -
3. shell_1  
   1. - no logs -
4. shell_2  
   1. - no logs -
5. shell_3  
   1. - no logs -
6. shell_4  
   1. - no logs -
7. shell_5  
   1. - no logs -

Build Properties:

Forced Build Properties:

Responsible Users:

1. David Tolnay

   dtolnayohnoyoudont@gmail.com

Timing:

All Changes:

:

1. Change #281193

   Category	ffmpeg
   Changed by	David Tolnay <dtolnayohnoyoudont@gmail.com>
   Changed at	Wed 09 Sep 2026 01:59:36
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	705286a8a7a8f9118465b2bd83f99a6f066dcbbc

   Comments

   avcodec/fflcms2: fix memory leak after cmsDeleteContext(NULL)
   At the time that this code was introduced into FFmpeg in April 2022 by commit
   b9a25963f7232433c9370ac369fb668ac0d5cb53, it was correct as written. The latest release of
   lcms2 at the time was 2.13.1 in which `cmsDeleteContext(NULL)` was a no-op.
   
   Since lcms2 version 2.15, released Mar 2023, the same call is no longer a no-op and
   instead means destroy the global context. The new behavior is justifiable as being
   consistent with the rest of lcms2's API, where passing NULL for a cmsContext argument
   means operate on the global context. For example `cmsDupContext(NULL, ...)` constructs a
   context duplicated from the global context; `cmsPluginTHR(NULL, ...)` registers a plugin
   into the global context.
   
   The upstream commit that introduced the behavior change for `cmsDeleteContext` is:
   https://github.com/mm2/Little-CMS/commit/a9e4601ceb3a185d4f78cc0cfbd285cf0c399e9d
   
   In FFmpeg, the new behavior leads to a memory leak if `ff_icc_context_uninit` is ever
   called on an `FFIccContext` without `ff_icc_context_init`. Here is why that can happen,
   and here is how it leads to a memory leak.
   
   Naively, uninitializing something which was never initialized seems like it shouldn't
   happen, but in this case these contexts are *lazily* initialized and *unconditionally*
   deinitialized. `FFIccContext` is a member of `AVCodecInternal`:
   
       // libavcodec/internal.h:148-150
       #if CONFIG_LCMS2
           FFIccContext icc; /* used to read and write embedded ICC profiles */
       #endif
   
   It is initialized conditionally by the snippet of `detect_colorspace` shown below, or by
   similary shaped code in libavcodec/encode.c. The `avci->icc.avctx` guards "has it already
   been initialized". The early returns beforehand are codepaths for which `icc` will not be
   initialized, and will remain all-zero as allocated by `av_mallocz` in
   `ff_decode_internal_alloc`.
   
       // libavcodec/decode.c:534-542
       if (!(avctx->flags2 & AV_CODEC_FLAG2_ICC_PROFILES))
           return 0;
       sd = av_frame_get_side_data(frame, AV_FRAME_DATA_ICC_PROFILE);
       if (!sd || !sd->size)
           return 0;
       if (!avci->icc.avctx) {
           ret = ff_icc_context_init(&avci->icc, avctx);
   
   Later, `avci->icc` is uninitialized unconditionally by `ff_codec_close`:
   
       // libavcodec/avcodec.c:447-480
       if (avcodec_is_open(avctx)) {
           ...
       #if CONFIG_LCMS2
           ff_icc_context_uninit(&avci->icc);
       #endif
   
   So every codec closed without `AV_CODEC_FLAGS2_ICC_PROFILES`, or without an ICC side-data
   packet, reaches `ff_icc_context_uninit` on a never-initialized context.
   
   As part of `cmsDeleteContext(NULL)` destroying lcms2's global context, it runs
   `cmsUnregisterPlugins()` and destroys `globalContext.MemPool`. Since the global context is
   shared by every user of lcms2 in the process, closing an FFmpeg codec silently tears down
   unrelated libraries' lcms2 state. The most visible symptom is that
   `_cmsRegisterMutexPlugin(NULL, NULL)` nulls out the mutex callbacks, after which
   `cmsCloseProfile()` leaks each profile's `UsrMutex` and profiles opened later are left
   without any locking at all.
   
   The fix is to delete only contexts created by FFmpeg.
   
   Signed-off-by: David Tolnay <dtolnay@gmail.com>

   Changed files

   • libavcodec/fflcms2.c