Opened 13 years ago
Closed 12 years ago
#1373 closed defect (fixed)
bmv_video crash
Reported by: | ami_stuff | Owned by: | |
---|---|---|---|
Priority: | important | Component: | avcodec |
Version: | git-master | Keywords: | bmv crash SIGSEGV |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description
http://samples.mplayerhq.hu/V-codecs/IV32/levis.avi
(gdb) r -vcodec bmv_video -i levis.avi -f null - The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: d:\mingw\msys\1.0\ffmpeg-head-ab7d6cb\ffmpeg_g.exe -vcodec bmv _video -i levis.avi -f null - [New Thread 2464.0x2f8] ffmpeg version 0.10.2.git-ab7d6cb Copyright (c) 2000-2012 the FFmpeg developers built on May 27 2012 11:57:57 with gcc 4.6.1 configuration: --disable-ffprobe --enable-gpl libavutil 51. 55.100 / 51. 55.100 libavcodec 54. 23.100 / 54. 23.100 libavformat 54. 6.101 / 54. 6.101 libavdevice 54. 0.100 / 54. 0.100 libavfilter 2. 77.100 / 2. 77.100 libswscale 2. 1.100 / 2. 1.100 libswresample 0. 15.100 / 0. 15.100 libpostproc 52. 0.100 / 52. 0.100 [avi @ 03bc2340] non-interleaved AVI Guessed Channel Layout for Input Stream #0.1 : mono Input #0, avi, from 'levis.avi': Duration: 00:00:44.83, start: 0.000000, bitrate: 352 kb/s Stream #0:0: Video: bmv_video (IV32 / 0x32335649), pal8, 152x116, 6 tbr, 6 t bn, 6 tbc Stream #0:1: Audio: gsm_ms (1[0][0][0] / 0x0031), 44100 Hz, mono, s16, 71 kb /s [buffer @ 03bd2c20] w:152 h:116 pixfmt:pal8 tb:1/6 sar:0/1 sws_param:flags=2 [buffersink @ 03bd2f40] No opaque field provided Output #0, null, to 'pipe:': Metadata: encoder : Lavf54.6.101 Stream #0:0: Video: rawvideo, pal8, 152x116, q=2-31, 200 kb/s, 90k tbn, 6 tb c Stream #0:1: Audio: pcm_s16le, 44100 Hz, mono, s16, 705 kb/s Stream mapping: Stream #0:0 -> #0:0 (bmv_video -> rawvideo) Stream #0:1 -> #0:1 (gsm_ms -> pcm_s16le) Press [q] to stop, [?] for help [bmv_video @ 03bcc7c0] Error decoding frame data Error while decoding stream #0:0 Program received signal SIGSEGV, Segmentation fault. 0x006c10dc in decode_bmv_frame (frame_off=0, frame=0x4184224 "F4\025", src_len=0, source=0x3bc99e1 "") at libavcodec/bmv.c:161 161 memcpy(dst, src, len); (gdb) bt #0 0x006c10dc in decode_bmv_frame (frame_off=0, frame=0x4184224 "F4\025", src_len=0, source=0x3bc99e1 "") at libavcodec/bmv.c:161 #1 decode_frame (avctx=0x3bcc7c0, data=0x3bd4120, data_size=0x22e8bc, pkt=0x22e5b8) at libavcodec/bmv.c:236 #2 0x00542637 in avcodec_decode_video2 (avctx=0x3bcc7c0, picture=0x3bd4120, got_picture_ptr=0x22e8bc, avpkt=0x22e7f0) at libavcodec/utils.c:1464 #3 0x0040c507 in decode_video (got_output=<optimized out>, pkt=<optimized out>, ist=<optimized out>) at ffmpeg.c:2645 #4 output_packet (ist=0x3bd1a60, pkt=0x22fbb0) at ffmpeg.c:2816 #5 0x0040e723 in transcode () at ffmpeg.c:3662 #6 0x00b14ee2 in main (argc=8, argv=0x3bd0dd0) at ffmpeg.c:5926 (gdb)
Change History (7)
comment:1 by , 13 years ago
comment:2 by , 13 years ago
Component: | undetermined → avcodec |
---|---|
Keywords: | bmv crash SIGSEGV added |
Priority: | normal → important |
Reproduced by developer: | set |
Status: | new → open |
Version: | unspecified → git-master |
comment:3 by , 13 years ago
Here is fix, dunno if there is better one....
--- libavcodec/bmv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/bmv.c b/libavcodec/bmv.c index 37c8448..fe10f16 100644 --- a/libavcodec/bmv.c +++ b/libavcodec/bmv.c @@ -131,6 +131,8 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, } advance_mode = val & 1; len = (val >> 1) - 1; + if (len <= 0) + return -1; mode += 1 + advance_mode; if (mode >= 4) mode -= 3;
comment:4 by , 13 years ago
Resolution: | → fixed |
---|---|
Status: | open → closed |
comment:5 by , 12 years ago
"BoarApple_ProRes_422-partial.mov" still crashes here, could you reproduce?
comment:6 by , 12 years ago
Resolution: | fixed |
---|---|
Status: | closed → reopened |
Invalid reads are still reproducible.
$ ffmpeg_g -vcodec bmv_video -i Boar__Apple_ProRes_422-partial.mov -f null - ==8700== Memcheck, a memory error detector. ==8700== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al. ==8700== Using LibVEX rev 1732, a library for dynamic binary translation. ==8700== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP. ==8700== Using valgrind-3.2.3, a dynamic binary instrumentation framework. ==8700== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al. ==8700== For more details, rerun with: -v ==8700== ffmpeg version N-43443-g7fd467f Copyright (c) 2000-2012 the FFmpeg developers built on Aug 10 2012 18:35:15 with gcc 4.3.2 (GCC) configuration: --cc=/usr/local/gcc-4.3.2/bin/gcc --disable-optimizations libavutil 51. 67.100 / 51. 67.100 libavcodec 54. 51.100 / 54. 51.100 libavformat 54. 23.100 / 54. 23.100 libavdevice 54. 2.100 / 54. 2.100 libavfilter 3. 7.100 / 3. 7.100 libswscale 2. 1.101 / 2. 1.101 libswresample 0. 15.100 / 0. 15.100 Guessed Channel Layout for Input Stream #0.1 : mono Guessed Channel Layout for Input Stream #0.2 : mono Guessed Channel Layout for Input Stream #0.3 : mono Guessed Channel Layout for Input Stream #0.4 : mono Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'Boar__Apple_ProRes_422-partial.mov': Metadata: major_brand : qt minor_version : 537199360 compatible_brands: qt creation_time : 1938-02-17 02:04:25 Duration: 00:00:07.90, start: 0.000000, bitrate: 10618 kb/s Stream #0:0(eng): Video: bmv_video (apch / 0x68637061), pal8, 960x720, 151844 kb/s, SAR 4:3 DAR 16:9, 50 fps, 50 tbr, 50 tbn, 50 tbc Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung timecode : 00:00:00:00 Stream #0:1(eng): Audio: pcm_s16le (sowt / 0x74776F73), 48000 Hz, mono, s16, 768 kb/s Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung Stream #0:2(eng): Audio: pcm_s16le (sowt / 0x74776F73), 48000 Hz, mono, s16, 768 kb/s Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung Stream #0:3(eng): Audio: pcm_s16le (sowt / 0x74776F73), 48000 Hz, mono, s16, 768 kb/s Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung Stream #0:4(eng): Audio: pcm_s16le (sowt / 0x74776F73), 48000 Hz, mono, s16, 768 kb/s Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung Stream #0:5(eng): Data: none (tmcd / 0x64636D74) Metadata: creation_time : 1938-02-17 02:04:30 handler_name : Apple Alias-Datensteuerung timecode : 00:00:00:00 Output #0, null, to 'pipe:': Metadata: major_brand : qt minor_version : 537199360 compatible_brands: qt encoder : Lavf54.23.100 Stream #0:0(eng): Video: rawvideo, pal8, 960x720 [SAR 4:3 DAR 16:9], q=2-31, 200 kb/s, 90k tbn, 50 tbc Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung timecode : 00:00:00:00 Stream #0:1(eng): Audio: pcm_s16le, 48000 Hz, mono, s16, 768 kb/s Metadata: creation_time : 1938-02-17 02:04:25 handler_name : Apple Alias-Datensteuerung Stream mapping: Stream #0:0 -> #0:0 (bmv_video -> rawvideo) Stream #0:1 -> #0:1 (pcm_s16le -> pcm_s16le) Press [q] to stop, [?] for help [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input ==8700== Invalid read of size 1 ==8700== at 0x40245A1: memcpy (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x81D27C9: decode_frame (bmv.c:256) ==8700== by 0x8590027: avcodec_decode_video2 (utils.c:1509) ==8700== by 0x805BA35: decode_video (ffmpeg.c:1549) ==8700== by 0x805C8E0: output_packet (ffmpeg.c:1734) ==8700== by 0x806145B: process_input (ffmpeg.c:2858) ==8700== by 0x80615EC: transcode (ffmpeg.c:2916) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== Address 0x47577DF is 1 bytes before a block of size 8 alloc'd ==8700== at 0x4021A50: memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x4021AAA: posix_memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x8833493: av_malloc (mem.c:95) ==8700== by 0x88336AA: av_strdup (mem.c:217) ==8700== by 0x882BF22: av_dict_set (dict.c:79) ==8700== by 0x818A913: avformat_write_header (utils.c:3359) ==8700== by 0x805EC11: transcode_init (ffmpeg.c:2278) ==8700== by 0x806153E: transcode (ffmpeg.c:2887) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== ==8700== Invalid read of size 1 ==8700== at 0x40245A9: memcpy (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x81D27C9: decode_frame (bmv.c:256) ==8700== by 0x8590027: avcodec_decode_video2 (utils.c:1509) ==8700== by 0x805BA35: decode_video (ffmpeg.c:1549) ==8700== by 0x805C8E0: output_packet (ffmpeg.c:1734) ==8700== by 0x806145B: process_input (ffmpeg.c:2858) ==8700== by 0x80615EC: transcode (ffmpeg.c:2916) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== Address 0x47577DE is 2 bytes before a block of size 8 alloc'd ==8700== at 0x4021A50: memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x4021AAA: posix_memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x8833493: av_malloc (mem.c:95) ==8700== by 0x88336AA: av_strdup (mem.c:217) ==8700== by 0x882BF22: av_dict_set (dict.c:79) ==8700== by 0x818A913: avformat_write_header (utils.c:3359) ==8700== by 0x805EC11: transcode_init (ffmpeg.c:2278) ==8700== by 0x806153E: transcode (ffmpeg.c:2887) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== ==8700== Invalid read of size 1 ==8700== at 0x40245B0: memcpy (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x81D27C9: decode_frame (bmv.c:256) ==8700== by 0x8590027: avcodec_decode_video2 (utils.c:1509) ==8700== by 0x805BA35: decode_video (ffmpeg.c:1549) ==8700== by 0x805C8E0: output_packet (ffmpeg.c:1734) ==8700== by 0x806145B: process_input (ffmpeg.c:2858) ==8700== by 0x80615EC: transcode (ffmpeg.c:2916) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== Address 0x47577DD is 3 bytes before a block of size 8 alloc'd ==8700== at 0x4021A50: memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x4021AAA: posix_memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x8833493: av_malloc (mem.c:95) ==8700== by 0x88336AA: av_strdup (mem.c:217) ==8700== by 0x882BF22: av_dict_set (dict.c:79) ==8700== by 0x818A913: avformat_write_header (utils.c:3359) ==8700== by 0x805EC11: transcode_init (ffmpeg.c:2278) ==8700== by 0x806153E: transcode (ffmpeg.c:2887) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== ==8700== Invalid read of size 1 ==8700== at 0x40245B7: memcpy (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x81D27C9: decode_frame (bmv.c:256) ==8700== by 0x8590027: avcodec_decode_video2 (utils.c:1509) ==8700== by 0x805BA35: decode_video (ffmpeg.c:1549) ==8700== by 0x805C8E0: output_packet (ffmpeg.c:1734) ==8700== by 0x806145B: process_input (ffmpeg.c:2858) ==8700== by 0x80615EC: transcode (ffmpeg.c:2916) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) ==8700== Address 0x47577DC is 4 bytes before a block of size 8 alloc'd ==8700== at 0x4021A50: memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x4021AAA: posix_memalign (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==8700== by 0x8833493: av_malloc (mem.c:95) ==8700== by 0x88336AA: av_strdup (mem.c:217) ==8700== by 0x882BF22: av_dict_set (dict.c:79) ==8700== by 0x818A913: avformat_write_header (utils.c:3359) ==8700== by 0x805EC11: transcode_init (ffmpeg.c:2278) ==8700== by 0x806153E: transcode (ffmpeg.c:2887) ==8700== by 0x8061BA9: main (ffmpeg.c:3098) [null @ 0x45d9320] Encoder did not produce proper pts, making some up. Error decoding frame data size= 0kB time=00:00:00.28 bitrate= 0.0kbits/s dup=13 drop=0 Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input [bmv_video @ 0x4430100] Error decoding frame data Error while decoding stream #0:0: Invalid data found when processing input frame= 14 fps=5.1 q=0.0 Lsize= 0kB time=00:00:00.28 bitrate= 0.0kbits/s dup=13 drop=0 video:1kB audio:94kB subtitle:0 global headers:0kB muxing overhead -100.000000% ==8700== ==8700== ERROR SUMMARY: 409383 errors from 4 contexts (suppressed: 3 from 1) ==8700== malloc/free: in use at exit: 0 bytes in 0 blocks. ==8700== malloc/free: 2,776 allocs, 2,776 frees, 11,906,345 bytes allocated. ==8700== For counts of detected errors, rerun with: -v ==8700== All heap blocks were freed -- no leaks are possible.
comment:7 by , 12 years ago
Resolution: | → fixed |
---|---|
Status: | reopened → closed |
2nd try
will be fixed in my next git push
Note:
See TracTickets
for help on using tickets.
http://samples.mplayerhq.hu/V-codecs/HCPA/Boar__Apple_ProRes_422-partial.mov