[Ffmpeg-devel] ffmpeg crash on ff_a52_syncinfo

[Sverker Abrahamsson]

Hi,
I'm getting sigsegv with ffmpeg fresh from cvs when reading input from a vob file. Older version (pre1) was able to read it correctly.

This is the output from valgrind:

[root at pumbaa tmp]# valgrind --tool=memcheck ffmpeg -i vts_01_3.vob -r 12 -s 176x144 -maxrate 90 -b 90 -vcodec mpeg4 -g 24 -aspect 4x3 -acodec amr -ar 8000 -ab 12 -f 3gp -passlogfile logfile.log -bufsize 16 -bt 5 -y -part -hq -4mv -dc 1 -qmax 14 -qns -nr -rc_init_cplx 1 -hq -sc_threshold 500000 -pass 1 test.3gp
==4946== Memcheck, a memory error detector for x86-linux.
==4946== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et al.
==4946== Using valgrind-2.4.0, a program supervision framework for x86-linux.
==4946== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et al.
==4946== For more details, rerun with: -v
==4946==
ffmpeg version CVS, build 3276800, Copyright (c) 2000-2004 Fabrice Bellard
  configuration:  --build=i686-redhat-linux-gnu --host=i686-redhat-linux-gnu --target=i386-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/usr/com --mandir=/usr/share/man --infodir=/usr/share/info --enable-mp3lame --enable-libogg --enable-vorbis --enable-faad --enable-faac --enable-xvid --enable-a52 --enable-a52bin --enable-amr_nb --enable-amr_wb --enable-pp --enable-shared-pp --enable-shared --enable-gpl --disable-opts --disable-strip
  built on Oct  2 2005 23:01:12, gcc: 3.4.4 20050721 (Red Hat 3.4.4-2)
==4946== Invalid read of size 4
==4946==    at 0x1BB5E23D: ff_a52_syncinfo (a52dec.c:84)
==4946==    by 0x1BA8B356: av_parser_parse (parser.c:106)
==4946==    by 0x1B93D130: ??? (utils.c:890)
==4946==    by 0x1B93EACD: av_find_stream_info (utils.c:1913)
==4946==    by 0x804F270: ??? (ffmpeg.c:2893)
==4946==    by 0x8053E5D: parse_options (cmdutils.c:99)
==4946==    by 0x80518FA: main (ffmpeg.c:4240)
==4946==  Address 0x1024 is not stack'd, malloc'd or (recently) free'd
==4946==
==4946== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==4946==  Access not within mapped region at address 0x1024
==4946==    at 0x1BB5E23D: ff_a52_syncinfo (a52dec.c:84)
==4946==    by 0x1BA8B356: av_parser_parse (parser.c:106)
==4946==    by 0x1B93D130: ??? (utils.c:890)
==4946==    by 0x1B93EACD: av_find_stream_info (utils.c:1913)
==4946==    by 0x804F270: ??? (ffmpeg.c:2893)
==4946==    by 0x8053E5D: parse_options (cmdutils.c:99)
==4946==    by 0x80518FA: main (ffmpeg.c:4240)
==4946==
==4946== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 30 from 1)
==4946== malloc/free: in use at exit: 71846 bytes in 15 blocks.
==4946== malloc/free: 38 allocs, 23 frees, 238606 bytes allocated.
==4946== For counts of detected errors, rerun with: -v
==4946== searching for pointers to 15 not-freed blocks.
==4946== checked 2504868 bytes.
==4946==
==4946== LEAK SUMMARY:
==4946==    definitely lost: 0 bytes in 0 blocks.
==4946==      possibly lost: 0 bytes in 0 blocks.
==4946==    still reachable: 71846 bytes in 15 blocks.
==4946==         suppressed: 0 bytes in 0 blocks.
==4946== Reachable blocks (those to which a pointer was found) are not shown.
==4946== To see them, rerun with: --show-reachable=yes
Segmentation fault

and this is some info from gdb:

#0  0x1bb5e23d in ff_a52_syncinfo (avctx=0x52bfdc08,
    buf=0x1bcc51d0 "\vwl[\030 C", flags=0x7, sample_rate=0x52bfdc04,
    bit_rate=0x52bfdc08) at a52dec.c:84
84          return s->a52_syncinfo(buf, flags, sample_rate, bit_rate);
(gdb) print s
$1 = (AC3DecodeState *) 0x1bcc51cf
(gdb) print buf
$2 = (uint8_t *) 0x1bcc51d0 "\vwl[\030 C"
(gdb) print flags
$3 = (int *) 0x7
(gdb) print sample_rate
$4 = (int *) 0x52bfdc04
(gdb) print bit_rate
$5 = (int *) 0x52bfdc08
(gdb) print s->a52_syncinfo
$6 = (int (*)(uint8_t *, int *, int *, int *)) 0

/Sverker