I have a reproducible crash playing divx+ac3 in ogm container (produced with
ogmtools). I'm not very familiar with mplayer source but I will try to make
an educated guess at what is wrong.

In libmpcodecs/ad_liba52.c, a52_fillbuff() at line 47 there is this code
snippet:
    while(sh_audio->a_in_buffer_len<7){
        int c=demux_getc(sh_audio->ds);
        if(c<0) return -1; /* EOF*/
        sh_audio->a_in_buffer[sh_audio->a_in_buffer_len++]=c;
    }

It takes 7 bytes from sh_audio->ds->buffer with demux_getc macro in a loop.
For some reason, at the end of playback (only at the very end),
sh_audio->ds->buffer is NULL, so when macro tries to dereference
ds->buffer[ds->buffer_pos++], it crashes.
But, I could be wrong.

I'm not sure how ogmtools creates files. Specifically, maybe last ac3 frame
is broken if a movie is encoded at chapter boundary?

If someone wants to dig into this but is missing a sample, I have uploaded a
short (~1Mb) clip that will trigger this bug.
It is in incoming - 'divx-ac3-sig11.ogm'.

[ftp://mplayerhq.hu/MPlayer/incoming/ is readable, is that intentional?]

Info:
Debian: potato-woody mix
Kernel: 2.4.19
Libc: 2.3.1-3
X Window System: 4.1.0-14
gcc: 2.95.4-14
ld: 2.11.90.0.7
as: 2.11.90.0.7

Video card: NVidia GeForce4 MX440
Video driver: NVidia 1.0-3123
Sound card: SB Live Player 5.1, ALSA 0.9.0rc6-3

-- 
Kresimir Kukulj                      madmax@iskon.hr
+--------------------------------------------------+
Old PC's never die. They just become Unix terminals.