[FFmpeg-trac] #2293(avformat:new): Apple HTTP Live Streaming demuxer does invalid accesses to avio internals

[FFmpeg]

#2293: Apple HTTP Live Streaming demuxer does invalid accesses to avio internals
------------------------------------+------------------------------------
             Reporter:  gjdfgh      |                    Owner:
                 Type:  defect      |                   Status:  new
             Priority:  important   |                Component:  avformat
              Version:  git-master  |               Resolution:
             Keywords:  crash       |               Blocked By:
             Blocking:              |  Reproduced by developer:  0
Analyzed by developer:  0           |
------------------------------------+------------------------------------

Comment (by gjdfgh):

 {{{
 Program received signal SIGSEGV, Segmentation fault.
 av_opt_find2 (obj=obj at entry=0xffffffff,
     name=name at entry=0x899a711 "user-agent",
 search_flags=search_flags at entry=0,
     target_obj=target_obj at entry=0xbffff18c, opt_flags=0, unit=0x0)
     at libavutil/opt.c:1158
 1158        c= *(AVClass**)obj;
 (gdb) bt
 #0  av_opt_find2 (obj=obj at entry=0xffffffff,
     name=name at entry=0x899a711 "user-agent",
 search_flags=search_flags at entry=0,
     target_obj=target_obj at entry=0xbffff18c, opt_flags=0, unit=0x0)
     at libavutil/opt.c:1158
 #1  0x088f524a in av_opt_get (obj=0xffffffff,
     name=name at entry=0x899a711 "user-agent",
 search_flags=search_flags at entry=0,
     out_val=out_val at entry=0x91f6f6c) at libavutil/opt.c:530
 #2  0x081fc0fb in hls_read_header (s=0x91dcf80) at libavformat/hls.c:488
 #3  0x082bec5a in avformat_open_input (ps=0xbffff330,
     filename=0x91d4870
 "http://fms3.mediadirect.ro/live3/_definst_/dolcesport/playlist.m3u8?publisher=6",
 fmt=0x8bd6740, options=0x0)
     at libavformat/utils.c:626
 #4  0x0810d6dc in demux_open_lavf (demuxer=0x91f61b8) at
 demux/demux_lavf.c:535
 (rest omitted)
 (gdb) disas
 Dump of assembler code for function av_opt_find2:
    0x088f29a0 <+0>:     push   %ebp
    0x088f29a1 <+1>:     push   %edi
    0x088f29a2 <+2>:     mov    %eax,%edi
    0x088f29a4 <+4>:     push   %esi
    0x088f29a5 <+5>:     push   %ebx
    0x088f29a6 <+6>:     sub    $0x3c,%esp
    0x088f29a9 <+9>:     test   %eax,%eax
    0x088f29ab <+11>:    mov    %ecx,0x1c(%esp)
    0x088f29af <+15>:    je     0x88f2a70 <av_opt_find2+208>
    0x088f29b5 <+21>:    test   $0x1,%cl
    0x088f29b8 <+24>:    mov    %edx,%ebx
 => 0x088f29ba <+26>:    mov    (%eax),%esi
    0x088f29bc <+28>:    je     0x88f2a10 <av_opt_find2+112>
    0x088f29be <+30>:    test   $0x2,%cl
    0x088f29c1 <+33>:    je     0x88f2a90 <av_opt_find2+240>
    0x088f29c7 <+39>:    movl   $0x0,0x2c(%esp)
    0x088f29cf <+47>:    xor    %edx,%edx
    0x088f29d1 <+49>:    mov    %ecx,%ebp
    0x088f29d3 <+51>:    jmp    0x88f2a05 <av_opt_find2+101>
    0x088f29d5 <+53>:    lea    0x0(%esi),%esi
    0x088f29d8 <+56>:    mov    %edx,(%esp)
    0x088f29db <+59>:    call   *%eax
 ---Type <return> to continue, or q <return> to quit---
 Quit
 (gdb) info registers
 eax            0xffffffff       -1
 ecx            0x0      0
 edx            0x899a711        144287505
 ebx            0x899a711        144287505
 esp            0xbffff110       0xbffff110
 ebp            0xbffff2cc       0xbffff2cc
 esi            0x91f6f6c        153055084
 edi            0xffffffff       -1
 eip            0x88f29ba        0x88f29ba <av_opt_find2+26>
 eflags         0x10246  [ PF ZF IF RF ]
 cs             0x73     115
 ss             0x7b     123
 ds             0x7b     123
 es             0x7b     123
 fs             0x0      0
 gs             0x33     51
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/2293#comment:2>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker