[MPlayer-dev-eng] [PATCH] libass: ass_render.c: SEGFAULT: return without a safe default
Stanislav Maslovski
stanislav.maslovski at gmail.com
Sat Jan 27 17:53:27 CET 2007
Mplayer segfaults when started with -ass and the attached subtitle file.
GDB log:
====================================================================
[postproc @ 0x86bc81c]using npp filters 0x7/0x7241 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7242 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7243 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7244 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7245 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7246 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7247 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7248 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7249 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7250 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7251 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7252 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7253 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7254 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7255 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7256 4% 9% 0.7% 0 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7257 4% 9% 0.7% 0 0
fontconfig_select: (Trebuchet MS, 200, 0) ->
/var/lib/defoma/fontconfig.d/T/TrebuchetMS-Bold.ttf, 0
[postproc @ 0x86bc81c]using npp filters 0x7/0x7258 4% 9% 0.7% 0 0
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1231206144 (LWP 17631)]
0x08b5740d in ?? ()
(gdb) bt
#0 0x08b5740d in ?? ()
#1 0xb7492107 in FT_Glyph_Transform () from /usr/lib/libfreetype.so.6
#2 0x0852ad66 in ass_render_frame (priv=0x8807090, track=0x87f1708,
now=135886, detect_change=0x0) at ass_render.c:1826
#3 0x0813911d in put_image (vf=0x8804ac0, mpi=0x87d1850,
pts=135.88587951660156) at vf_ass.c:329
#4 0x0810684e in filter_video (sh_video=0x87cf920, frame=0x89c5af8,
pts=135.88587951660156) at dec_video.c:388
#5 0x08088940 in main (argc=-1076527260, argv=0x0) at mplayer.c:3446
(gdb) disass $pc-32 $pc+32
Dump of assembler code from 0x8b573ed to 0x8b5742d:
/////// this code looks like garbage ///////
0x08b573ed: add %al,(%eax)
0x08b573ef: add %cl,0x69(%ebp)
0x08b573f2: arpl %si,0x6f(%edx)
0x08b573f5: jae 0x8b57466
0x08b573f7: data16
0x08b573f8: je 0x8b5741a
0x08b573fa: push %ebx
0x08b573fb: popa
0x08b573fc: outsb %ds:(%esi),(%dx)
0x08b573fd: jae 0x8b5741f
0x08b573ff: push %ebx
0x08b57400: gs
0x08b57401: jb 0x8b5746c
0x08b57403: data16
0x08b57404: add %al,(%ecx)
0x08b57406: add %al,(%eax)
0x08b57408: imul $0x0,(%ecx),%eax
0x08b5740b: add %dl,(%ecx)
///////////////////////////////////////////
0x08b5740d: add %al,(%eax)
///////////////////////////////////////////
0x08b5740f: add %al,(%eax)
0x08b57411: add $0x628b742,%eax
0x08b57416: mov $0x8,%cl
0x08b57418: adc %al,(%eax)
0x08b5741a: add %al,(%eax)
0x08b5741c: call 0x8b57421
0x08b57421: add %al,(%eax)
0x08b57423: add %dl,0xeed6ab68
0x08b57429: sti
0x08b5742a: imul %cl
0x08b5742c: movl $0x6000000,0x348(%edi)
End of assembler dump.
(gdb) up
#1 0xb7492107 in FT_Glyph_Transform () from /usr/lib/libfreetype.so.6
(gdb) disass $pc-32 $pc+32
Dump of assembler code from 0xb74920e7 to 0xb7492127:
0xb74920e7 <FT_Glyph_Transform+39>: test %eax,%eax
0xb74920e9 <FT_Glyph_Transform+41>: je 0xb749212b
<FT_Glyph_Transform+107>
0xb74920eb <FT_Glyph_Transform+43>: mov 0x14(%eax),%edx
0xb74920ee <FT_Glyph_Transform+46>: mov $0x12,%eax
0xb74920f3 <FT_Glyph_Transform+51>: test %edx,%edx
0xb74920f5 <FT_Glyph_Transform+53>: je 0xb749211e
<FT_Glyph_Transform+94>
0xb74920f7 <FT_Glyph_Transform+55>: mov 0x10(%ebp),%eax
0xb74920fa <FT_Glyph_Transform+58>: mov %edi,0x4(%esp)
0xb74920fe <FT_Glyph_Transform+62>: mov %esi,(%esp)
0xb7492101 <FT_Glyph_Transform+65>: mov %eax,0x8(%esp)
////////////////////////////////////////////////////////////
0xb7492105 <FT_Glyph_Transform+69>: call *%edx
////////////////////////////////////////////////////////////
0xb7492107 <FT_Glyph_Transform+71>: xor %eax,%eax
0xb7492109 <FT_Glyph_Transform+73>: test %edi,%edi
0xb749210b <FT_Glyph_Transform+75>: je 0xb749211e
<FT_Glyph_Transform+94>
0xb749210d <FT_Glyph_Transform+77>: lea 0xc(%esi),%eax
0xb7492110 <FT_Glyph_Transform+80>: mov %eax,(%esp)
0xb7492113 <FT_Glyph_Transform+83>: mov %edi,0x4(%esp)
0xb7492117 <FT_Glyph_Transform+87>: call 0xb7487690
<FT_Vector_Transform at plt>
0xb749211c <FT_Glyph_Transform+92>: xor %eax,%eax
0xb749211e <FT_Glyph_Transform+94>: mov 0xfffffff4(%ebp),%ebx
0xb7492121 <FT_Glyph_Transform+97>: mov 0xfffffff8(%ebp),%esi
0xb7492124 <FT_Glyph_Transform+100>: mov 0xfffffffc(%ebp),%edi
End of assembler dump.
(gdb) print /x $edx
$1 = 0x8b57408
(gdb) up
#2 0x0852ad66 in ass_render_frame (priv=0x8807090, track=0x87f1708,
now=135886, detect_change=0x0) at ass_render.c:1826
1826 FT_Glyph_Transform(info->outline_glyph, &matrix_rotate, 0 );
(gdb) list
1821 info->pos.y -= start.y >> 6;
1822
1823 if (info->glyph)
1824 FT_Glyph_Transform( info->glyph, &matrix_rotate, 0 );
1825 if (info->outline_glyph)
1826 FT_Glyph_Transform( info->outline_glyph, &matrix_rotate, 0 );
1827 }
1828 }
1829
1830 event_images->top = device_y - (text_info.lines[0].asc >> 6);
(gdb) print info->outline_glyph
$2 = (FT_Glyph) 0x4241
(gdb) print &matrix_rotate
$3 = (FT_Matrix *) 0xbfd55bd8
=============================================================================
Likely, a wrong (old or unset) value of info->outline_glyph has slipped
into the code. Investigating ass_render.c around lines 1230 - 1250 we see
that get_glyph() may return without setting outline_glyph.
And "Vuala!" this solves the issue.
The patch is attached.
--
Stanislav
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ass_render_segfault_patch.diff
Type: text/x-diff
Size: 744 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/attachments/20070127/b8c6f642/attachment.diff>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Episode 01.ass.gz
Type: application/octet-stream
Size: 12669 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/attachments/20070127/b8c6f642/attachment.obj>
More information about the MPlayer-dev-eng
mailing list