[Ffmpeg-devel] [BUG] Segfault in h264 decoder on corrupt input

[Panagiotis Issaris]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Matthias,

Matthias Hopf schreef:
> On Mar 14, 07 15:58:44 +0100, Panagiotis Issaris wrote:
>> The commandline used to cause the crash:
>> ffplay_g -stats pi-20070314T154046-ffmpeg-ffplay_crash.h264
>> Input #0, h264, from 'pi-20070314T154046-ffmpeg-ffplay_crash.h264':
>>   Duration: N/A, bitrate: N/A
>>   Stream #0.0: Video: h264, yuv420p, 320x240, 25.00 fps(r)
>> [h264 @ 0x847a2dc]negative number of zero coeffs at 13 5
>> ...
>> [h264 @ 0x847a2dc]decode_slice_header error
>> [h264 @ 0x847a2dc]concealing 300 DC, 300 AC, 300 MV errors
>> Segmentation fault (core dumped)
> 
> The attached patch *might* also fix this one. Please test.
> But don't hold your breath.
Thanks! Seems to work! :)

The segfault is gone and at first it looked like the application was
stuck. In fact it just does not exit, but instead it appears to be
waiting for user output.

...
[h264 @ 0x847b39c]reference count overflow
[h264 @ 0x847b39c]decode_slice_header error
[h264 @ 0x847b39c]reference picture missing during reorder
[h264 @ 0x847b39c]reference count overflow
[h264 @ 0x847b39c]decode_slice_header error

[here I've hit ctrl-c to see why it got stuck]

Program received signal SIGINT, Interrupt.
[Switching to Thread -1212314896 (LWP 7530)]
0xb7f4b410 in __kernel_vsyscall ()
(gdb) bt
#0  0xb7f4b410 in __kernel_vsyscall ()
#1  0xb7db5e36 in nanosleep () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7ec4b28 in SDL_Delay () from /usr/lib/libSDL-1.2.so.0
#3  0xb7e72fbe in SDL_WaitEvent () from /usr/lib/libSDL-1.2.so.0
#4  0x0805cdb2 in main (argc=0, argv=0x6f038a) at ffplay.c:2233
(gdb)

With friendly regards,
Takis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF+WhF9kOxLuzz4CkRAo/bAJ9CVHsixEyJaVqeAfDovy0EkCMzUACbB1yx
7tM/h5ek1ORIuGU+dqPiUSg=
=vioX
-----END PGP SIGNATURE-----