Opened 12 years ago

Closed 12 years ago

Last modified 12 years ago

#2140 closed defect (fixed)

null ptr deref due to vf_mp not setting pseudo palette

Reported by: Carl Eugen Hoyos Owned by:
Priority: important Component: avfilter
Version: git-master Keywords: crash SIGSEGV mpfilter
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: yes

Description

$ ffmpeg -i tests/lena.pnm -vf mp=il=d -pix_fmt gray gray.png

(gdb) r -i gray.png -vf mp=il=i gray2.png
Starting program: ffmpeg_g -i gray.png -vf mp=il=i gray2.png
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
ffmpeg version N-48916-ge074fe2 Copyright (c) 2000-2013 the FFmpeg developers
  built on Jan 15 2013 15:59:20 with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl --disable-indev=jack
  libavutil      52. 14.100 / 52. 14.100
  libavcodec     54. 89.100 / 54. 89.100
  libavformat    54. 59.107 / 54. 59.107
  libavdevice    54.  3.102 / 54.  3.102
  libavfilter     3. 32.100 /  3. 32.100
  libswscale      2.  1.103 /  2.  1.103
  libswresample   0. 17.102 /  0. 17.102
  libpostproc    52.  2.100 / 52.  2.100
Input #0, image2, from 'gray.png':
  Duration: 00:00:00.04, start: 0.000000, bitrate: N/A
    Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc
[Parsed_mp_0 @ 0x15d2a20] 'il' is a wrapped MPlayer filter (libmpcodecs). This filter may be removed
once it has been ported to a native libavfilter.
[New Thread 0x7ffff6563700 (LWP 11883)]
[New Thread 0x7ffff5d62700 (LWP 11884)]
[New Thread 0x7ffff5561700 (LWP 11885)]
[New Thread 0x7ffff4d60700 (LWP 11886)]
[New Thread 0x7fffe7fff700 (LWP 11887)]
[New Thread 0x7fffe77fe700 (LWP 11888)]
[New Thread 0x7fffe6ffd700 (LWP 11889)]
[New Thread 0x7fffe67fc700 (LWP 11890)]
Output #0, image2, to 'gray2.png':
  Metadata:
    encoder         : Lavf54.59.107
    Stream #0:0: Video: png, gray, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc
Stream mapping:
  Stream #0:0 -> #0:0 (png -> png)
Press [q] to stop, [?] for help

Program received signal SIGSEGV, Segmentation fault.
0x0000000000bb9ae0 in av_image_copy (dst_data=dst_data@entry=0x15b9108,
    dst_linesizes=dst_linesizes@entry=0x15b9150, src_data=src_data@entry=0x15c6b88,
    src_linesizes=src_linesizes@entry=0x15c6bd0, pix_fmt=AV_PIX_FMT_GRAY8, width=256,
    height=256) at libavutil/imgutils.c:272
272             memcpy(dst_data[1], src_data[1], 4*256);
(gdb) bt
#0  0x0000000000bb9ae0 in av_image_copy (dst_data=dst_data@entry=0x15b9108,
    dst_linesizes=dst_linesizes@entry=0x15b9150, src_data=src_data@entry=0x15c6b88,
    src_linesizes=src_linesizes@entry=0x15c6bd0, pix_fmt=AV_PIX_FMT_GRAY8, width=256,
    height=256) at libavutil/imgutils.c:272
#1  0x0000000000470667 in ff_filter_frame_framed (link=link@entry=0x15d42c0,
    frame=frame@entry=0x15c6b80) at libavfilter/avfilter.c:693
#2  0x0000000000470a71 in ff_filter_frame (frame=0x15c6b80, link=0x15d42c0)
    at libavfilter/avfilter.c:791
#3  default_filter_frame (link=<optimized out>, frame=0x15c6b80)
    at libavfilter/avfilter.c:638
#4  0x00000000004707d6 in ff_filter_frame_framed (link=link@entry=0x15d4020,
    frame=frame@entry=0x15c6b80) at libavfilter/avfilter.c:719
#5  0x000000000047242b in ff_filter_frame (link=link@entry=0x15d4020,
    frame=frame@entry=0x15c6b80) at libavfilter/avfilter.c:791
#6  0x000000000048af2c in ff_vf_next_put_image (vf=0x15d2ac0, mpi=0x15d43a0, pts=0)
    at libavfilter/vf_mp.c:588
#7  0x000000000048abd2 in filter_frame (inlink=0x15d41e0, inpic=0x15d4700)
    at libavfilter/vf_mp.c:824
#8  0x00000000004707d6 in ff_filter_frame_framed (link=link@entry=0x15d41e0,
    frame=frame@entry=0x15d4700) at libavfilter/avfilter.c:719
#9  0x000000000047242b in ff_filter_frame (link=link@entry=0x15d41e0, frame=0x15d4700)
    at libavfilter/avfilter.c:791
#10 0x0000000000475182 in request_frame (link=0x15d41e0) at libavfilter/buffersrc.c:372
#11 0x00000000004755b4 in av_buffersrc_add_ref (s=0x15c6e00, buf=0x0, flags=flags@entry=7)
    at libavfilter/buffersrc.c:150
#12 0x000000000045e5ed in decode_video (ist=ist@entry=0x15ddb40,
    pkt=pkt@entry=0x7fffffffdb00, got_output=got_output@entry=0x7fffffffd89c)
    at ffmpeg.c:1672
#13 0x00000000004615ff in output_packet (pkt=0x7fffffffdaa0, ist=0x15ddb40)
    at ffmpeg.c:1792
#14 process_input (file_index=<optimized out>) at ffmpeg.c:2886
#15 0x0000000000451cb0 in transcode_step () at ffmpeg.c:2982
#16 transcode () at ffmpeg.c:3034
#17 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3209
(gdb) disass $pc-32,$pc+32
Dump of assembler code from 0xbb9ac0 to 0xbb9b00:
   0x0000000000bb9ac0 <av_image_copy+848>:      add    %al,(%rax)
   0x0000000000bb9ac2 <av_image_copy+850>:      add    %al,-0xa(%rax)
   0x0000000000bb9ac5 <av_image_copy+853>:      movl   $0x10d850f,(%rdx)
   0x0000000000bb9acb <av_image_copy+859>:      add    %al,(%rax)
   0x0000000000bb9acd <av_image_copy+861>:      test   $0x4,%dil
   0x0000000000bb9ad1 <av_image_copy+865>:      jne    0xbb9bc6 <av_image_copy+1110>
   0x0000000000bb9ad7 <av_image_copy+871>:      mov    %eax,%ecx
   0x0000000000bb9ad9 <av_image_copy+873>:      xor    %edx,%edx
   0x0000000000bb9adb <av_image_copy+875>:      shr    $0x3,%ecx
   0x0000000000bb9ade <av_image_copy+878>:      test   $0x4,%al
=> 0x0000000000bb9ae0 <av_image_copy+880>:      rep movsq %ds:(%rsi),%es:(%rdi)
   0x0000000000bb9ae3 <av_image_copy+883>:      je     0xbb9aee <av_image_copy+894>
   0x0000000000bb9ae5 <av_image_copy+885>:      mov    (%rsi),%edx
   0x0000000000bb9ae7 <av_image_copy+887>:      mov    %edx,(%rdi)
   0x0000000000bb9ae9 <av_image_copy+889>:      mov    $0x4,%edx
   0x0000000000bb9aee <av_image_copy+894>:      test   $0x2,%al
   0x0000000000bb9af0 <av_image_copy+896>:      je     0xbb9afe <av_image_copy+910>
   0x0000000000bb9af2 <av_image_copy+898>:      movzwl (%rsi,%rdx,1),%ecx
   0x0000000000bb9af6 <av_image_copy+902>:      mov    %cx,(%rdi,%rdx,1)
   0x0000000000bb9afa <av_image_copy+906>:      add    $0x2,%rdx
   0x0000000000bb9afe <av_image_copy+910>:      test   $0x1,%al
(gdb) info register
rax            0x400    1024
rbx            0x100    256
rcx            0x80     128
rdx            0x0      0
rsi            0x0      0
rdi            0x162daa0        23255712
rbp            0x100    0x100
rsp            0x7fffffffd1f0   0x7fffffffd1f0
r8             0x162d9a0        23255456
r9             0xf0     240
r10            0x0      0
r11            0x7ffff68d1d60   140737329831264
r12            0x161d840        23189568
r13            0x162daa0        23255712
r14            0x0      0
r15            0x100    256
rip            0xbb9ae0 0xbb9ae0 <av_image_copy+880>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0

Change History (7)

comment:1 by Michael Niedermayer, 12 years ago

Resolution: fixed
Status: newclosed

was fixed by syncing libmpcodec from mplayer i think
feel free to backport to releases

comment:2 by Carl Eugen Hoyos, 12 years ago

Resolution: fixed
Status: closedreopened
(gdb) r -i gray.png -vf mp=il=i gray2.png
Starting program: ffmpeg_g -i gray.png -vf mp=il=i gray2.png
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
ffmpeg version N-49616-gf0eacbc Copyright (c) 2000-2013 the FFmpeg developers
  built on Feb  5 2013 23:36:50 with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl --disable-indev=jack
  libavutil      52. 17.101 / 52. 17.101
  libavcodec     54. 91.100 / 54. 91.100
  libavformat    54. 61.104 / 54. 61.104
  libavdevice    54.  3.103 / 54.  3.103
  libavfilter     3. 35.101 /  3. 35.101
  libswscale      2.  2.100 /  2.  2.100
  libswresample   0. 17.102 /  0. 17.102
  libpostproc    52.  2.100 / 52.  2.100
Input #0, image2, from 'gray.png':
  Duration: 00:00:00.04, start: 0.000000, bitrate: N/A
    Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc
[Parsed_mp_0 @ 0x160f5c0] 'il' is a wrapped MPlayer filter (libmpcodecs). This filter may be removed
once it has been ported to a native libavfilter.
[New Thread 0x7ffff6563700 (LWP 23337)]
[New Thread 0x7ffff5d62700 (LWP 23338)]
[New Thread 0x7ffff5561700 (LWP 23339)]
[New Thread 0x7ffff4d60700 (LWP 23340)]
[New Thread 0x7fffe7fff700 (LWP 23341)]
[New Thread 0x7fffe77fe700 (LWP 23342)]
[New Thread 0x7fffe6ffd700 (LWP 23343)]
[New Thread 0x7fffe67fc700 (LWP 23344)]
Output #0, image2, to 'gray2.png':
  Metadata:
    encoder         : Lavf54.61.104
    Stream #0:0: Video: png, gray, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc
Stream mapping:
  Stream #0:0 -> #0:0 (png -> png)
Press [q] to stop, [?] for help

Program received signal SIGSEGV, Segmentation fault.
0x0000000000bbdb60 in av_image_copy (dst_data=dst_data@entry=0x15e4288,
    dst_linesizes=dst_linesizes@entry=0x15e42d0, src_data=src_data@entry=0x15e32c8,
    src_linesizes=src_linesizes@entry=0x15e3310, pix_fmt=AV_PIX_FMT_GRAY8, width=256,
    height=256) at libavutil/imgutils.c:272
272             memcpy(dst_data[1], src_data[1], 4*256);
(gdb) bt
#0  0x0000000000bbdb60 in av_image_copy (dst_data=dst_data@entry=0x15e4288,
    dst_linesizes=dst_linesizes@entry=0x15e42d0, src_data=src_data@entry=0x15e32c8,
    src_linesizes=src_linesizes@entry=0x15e3310, pix_fmt=AV_PIX_FMT_GRAY8, width=256,
    height=256) at libavutil/imgutils.c:272
#1  0x000000000046e497 in ff_filter_frame_framed (link=link@entry=0x15fc960,
    frame=frame@entry=0x15e32c0) at libavfilter/avfilter.c:693
#2  0x000000000046e8a1 in ff_filter_frame (frame=0x15e32c0, link=0x15fc960)
    at libavfilter/avfilter.c:791
#3  default_filter_frame (link=<optimized out>, frame=0x15e32c0) at libavfilter/avfilter.c:638
#4  0x000000000046e606 in ff_filter_frame_framed (link=link@entry=0x15fc2a0,
    frame=frame@entry=0x15e32c0) at libavfilter/avfilter.c:719
#5  0x000000000047025b in ff_filter_frame (link=link@entry=0x15fc2a0,
    frame=frame@entry=0x15e32c0) at libavfilter/avfilter.c:791
#6  0x000000000048923c in ff_vf_next_put_image (vf=0x160f660, mpi=0x15e3110, pts=0)
    at libavfilter/vf_mp.c:588
#7  0x0000000000488ee2 in filter_frame (inlink=0x15fc880, inpic=0x15ff800)
    at libavfilter/vf_mp.c:824
#8  0x000000000046e606 in ff_filter_frame_framed (link=link@entry=0x15fc880,
    frame=frame@entry=0x15ff800) at libavfilter/avfilter.c:719
#9  0x000000000047025b in ff_filter_frame (link=link@entry=0x15fc880, frame=0x15ff800)
    at libavfilter/avfilter.c:791
#10 0x0000000000473242 in request_frame (link=0x15fc880) at libavfilter/buffersrc.c:396
#11 0x0000000000473694 in av_buffersrc_add_ref (s=0x160f4c0, buf=0x0, flags=flags@entry=7)
    at libavfilter/buffersrc.c:151
#12 0x000000000045b76d in decode_video (ist=ist@entry=0x1606ce0,
    pkt=pkt@entry=0x7fffffffdb00, got_output=got_output@entry=0x7fffffffd89c) at ffmpeg.c:1715
#13 0x000000000045e8bf in output_packet (pkt=0x7fffffffdaa0, ist=0x1606ce0) at ffmpeg.c:1835
#14 process_input (file_index=<optimized out>) at ffmpeg.c:2988
#15 0x000000000044ecc0 in transcode_step () at ffmpeg.c:3084
#16 transcode () at ffmpeg.c:3136
#17 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3311
(gdb) disass $pc-32,$pc+32
Dump of assembler code from 0xbbdb40 to 0xbbdb80:
   0x0000000000bbdb40 <av_image_copy+848>:      add    %al,(%rax)
   0x0000000000bbdb42 <av_image_copy+850>:      add    %al,-0xa(%rax)
   0x0000000000bbdb45 <av_image_copy+853>:      movl   $0x10d850f,(%rdx)
   0x0000000000bbdb4b <av_image_copy+859>:      add    %al,(%rax)
   0x0000000000bbdb4d <av_image_copy+861>:      test   $0x4,%dil
   0x0000000000bbdb51 <av_image_copy+865>:      jne    0xbbdc46 <av_image_copy+1110>
   0x0000000000bbdb57 <av_image_copy+871>:      mov    %eax,%ecx
   0x0000000000bbdb59 <av_image_copy+873>:      xor    %edx,%edx
   0x0000000000bbdb5b <av_image_copy+875>:      shr    $0x3,%ecx
   0x0000000000bbdb5e <av_image_copy+878>:      test   $0x4,%al
=> 0x0000000000bbdb60 <av_image_copy+880>:      rep movsq %ds:(%rsi),%es:(%rdi)
   0x0000000000bbdb63 <av_image_copy+883>:      je     0xbbdb6e <av_image_copy+894>
   0x0000000000bbdb65 <av_image_copy+885>:      mov    (%rsi),%edx
   0x0000000000bbdb67 <av_image_copy+887>:      mov    %edx,(%rdi)
   0x0000000000bbdb69 <av_image_copy+889>:      mov    $0x4,%edx
   0x0000000000bbdb6e <av_image_copy+894>:      test   $0x2,%al
   0x0000000000bbdb70 <av_image_copy+896>:      je     0xbbdb7e <av_image_copy+910>
   0x0000000000bbdb72 <av_image_copy+898>:      movzwl (%rsi,%rdx,1),%ecx
   0x0000000000bbdb76 <av_image_copy+902>:      mov    %cx,(%rdi,%rdx,1)
   0x0000000000bbdb7a <av_image_copy+906>:      add    $0x2,%rdx
   0x0000000000bbdb7e <av_image_copy+910>:      test   $0x1,%al
End of assembler dump.
(gdb) info register
rax            0x400    1024
rbx            0x100    256
rcx            0x80     128
rdx            0x0      0
rsi            0x0      0
rdi            0x1656c40        23424064
rbp            0x100    0x100
rsp            0x7fffffffd1f0   0x7fffffffd1f0
r8             0x1656c30        23424048
r9             0x0      0
r10            0x0      0
r11            0x7ffff68d1b20   140737329830688
r12            0x16469e0        23357920
r13            0x1656c40        23424064
r14            0x0      0
r15            0x100    256
rip            0xbbdb60 0xbbdb60 <av_image_copy+880>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0

comment:3 by Michael Niedermayer, 12 years ago

Analyzed by developer: set
Summary: Crash using mp=il=i on gray inputnull ptr deref due to vf_mp not setting pseudo palette

comment:4 by Carl Eugen Hoyos, 12 years ago

The mp=il filter was ported and removed by Paul B Mahol, the crash is still reproducible with mp=fspp.
$ ffmpeg -i tests/lena.pnm -pix_fmt gray gray.png

(gdb) r -i gray.png -vf mp=fspp -f null -
Starting program: ffmpeg_g -i gray.png -vf mp=fspp -f null -
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
ffmpeg version 1.1 Copyright (c) 2000-2013 the FFmpeg developers
  built on Feb 10 2013 11:46:21 with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl
  libavutil      52. 13.100 / 52. 13.100
  libavcodec     54. 86.100 / 54. 86.100
  libavformat    54. 59.106 / 54. 59.106
  libavdevice    54.  3.102 / 54.  3.102
  libavfilter     3. 32.100 /  3. 32.100
  libswscale      2.  1.103 /  2.  1.103
  libswresample   0. 17.102 /  0. 17.102
  libpostproc    52.  2.100 / 52.  2.100
Input #0, image2, from 'gray.png':
  Duration: 00:00:00.04, start: 0.000000, bitrate: N/A
    Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc
[Parsed_mp_0 @ 0x15de480] 'fspp' is a wrapped MPlayer filter (libmpcodecs). This filter may be removed
once it has been ported to a native libavfilter.
Output #0, null, to 'pipe:':
  Metadata:
    encoder         : Lavf54.59.106
    Stream #0:0: Video: rawvideo (Y800 / 0x30303859), gray, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc
Stream mapping:
  Stream #0:0 -> #0:0 (png -> rawvideo)
Press [q] to stop, [?] for help

Program received signal SIGSEGV, Segmentation fault.
0x0000000000bb8d60 in av_image_copy (dst_data=dst_data@entry=0x15dffc8,
    dst_linesizes=dst_linesizes@entry=0x15e0010,
    src_data=src_data@entry=0x15df708,
    src_linesizes=src_linesizes@entry=0x15df750, pix_fmt=AV_PIX_FMT_GRAY8,
    width=256, height=256) at libavutil/imgutils.c:272
272             memcpy(dst_data[1], src_data[1], 4*256);
(gdb) bt
#0  0x0000000000bb8d60 in av_image_copy (dst_data=dst_data@entry=0x15dffc8,
    dst_linesizes=dst_linesizes@entry=0x15e0010,
    src_data=src_data@entry=0x15df708,
    src_linesizes=src_linesizes@entry=0x15df750, pix_fmt=AV_PIX_FMT_GRAY8,
    width=256, height=256) at libavutil/imgutils.c:272
#1  0x00000000004713e6 in ff_filter_frame_framed (link=link@entry=0x15ded20,
    frame=frame@entry=0x15df700) at libavfilter/avfilter.c:693
#2  0x00000000004731ab in ff_filter_frame (link=link@entry=0x15ded20,
    frame=frame@entry=0x15df700) at libavfilter/avfilter.c:791
#3  0x000000000048bcac in ff_vf_next_put_image (vf=0x15de5a0, mpi=0x15df880, pts=0)
    at libavfilter/vf_mp.c:588
#4  0x000000000048b952 in filter_frame (inlink=0x15dfcc0, inpic=0x15dfac0)
    at libavfilter/vf_mp.c:824
#5  0x0000000000471555 in ff_filter_frame_framed (link=link@entry=0x15dfcc0,
    frame=frame@entry=0x15dfac0) at libavfilter/avfilter.c:719
#6  0x00000000004731ab in ff_filter_frame (link=link@entry=0x15dfcc0,
    frame=0x15dfac0) at libavfilter/avfilter.c:791
#7  0x0000000000475f02 in request_frame (link=0x15dfcc0)
    at libavfilter/buffersrc.c:372
#8  0x0000000000476334 in av_buffersrc_add_ref (s=0x15b9480, buf=0x0,
    flags=flags@entry=7) at libavfilter/buffersrc.c:150
#9  0x000000000045eafd in decode_video (ist=ist@entry=0x15d7540,
    pkt=pkt@entry=0x7fffffffdaf0, got_output=got_output@entry=0x7fffffffd88c)
    at ffmpeg.c:1672
#10 0x0000000000461b0f in output_packet (pkt=0x7fffffffda90, ist=0x15d7540)
    at ffmpeg.c:1792
#11 process_input (file_index=<optimized out>) at ffmpeg.c:2886
#12 0x00000000004521e0 in transcode_step () at ffmpeg.c:2982
#13 transcode () at ffmpeg.c:3034
#14 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3209
(gdb) disass $pc-32,$pc+32
Dump of assembler code from 0xbb8d40 to 0xbb8d80:
   0x0000000000bb8d40 <av_image_copy+848>:      add    %al,(%rax)
   0x0000000000bb8d42 <av_image_copy+850>:      add    %al,-0xa(%rax)
   0x0000000000bb8d45 <av_image_copy+853>:      movl   $0x10d850f,(%rdx)
   0x0000000000bb8d4b <av_image_copy+859>:      add    %al,(%rax)
   0x0000000000bb8d4d <av_image_copy+861>:      test   $0x4,%dil
   0x0000000000bb8d51 <av_image_copy+865>:      jne    0xbb8e46 <av_image_copy+1110>
   0x0000000000bb8d57 <av_image_copy+871>:      mov    %eax,%ecx
   0x0000000000bb8d59 <av_image_copy+873>:      xor    %edx,%edx
   0x0000000000bb8d5b <av_image_copy+875>:      shr    $0x3,%ecx
   0x0000000000bb8d5e <av_image_copy+878>:      test   $0x4,%al
=> 0x0000000000bb8d60 <av_image_copy+880>:      rep movsq %ds:(%rsi),%es:(%rdi)
   0x0000000000bb8d63 <av_image_copy+883>:      je     0xbb8d6e <av_image_copy+894>
   0x0000000000bb8d65 <av_image_copy+885>:      mov    (%rsi),%edx
   0x0000000000bb8d67 <av_image_copy+887>:      mov    %edx,(%rdi)
   0x0000000000bb8d69 <av_image_copy+889>:      mov    $0x4,%edx
   0x0000000000bb8d6e <av_image_copy+894>:      test   $0x2,%al
   0x0000000000bb8d70 <av_image_copy+896>:      je     0xbb8d7e <av_image_copy+910>
   0x0000000000bb8d72 <av_image_copy+898>:      movzwl (%rsi,%rdx,1),%ecx
   0x0000000000bb8d76 <av_image_copy+902>:      mov    %cx,(%rdi,%rdx,1)
   0x0000000000bb8d7a <av_image_copy+906>:      add    $0x2,%rdx
   0x0000000000bb8d7e <av_image_copy+910>:      test   $0x1,%al
End of assembler dump.
(gdb) info register
rax            0x400    1024
rbx            0x100    256
rcx            0x80     128
rdx            0x0      0
rsi            0x0      0
rdi            0x1627080        23228544
rbp            0x100    0x100
rsp            0x7fffffffd2e0   0x7fffffffd2e0
r8             0x1626f80        23228288
r9             0xf0     240
r10            0x0      0
r11            0x7ffff668dd60   140737327455584
r12            0x1616e20        23162400
r13            0x1627080        23228544
r14            0x0      0
r15            0x100    256
rip            0xbb8d60 0xbb8d60 <av_image_copy+880>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0

comment:5 by Carl Eugen Hoyos, 12 years ago

The crash is a regression since 82541d8.

comment:6 by Michael Niedermayer, 12 years ago

Resolution: fixed
Status: reopenedclosed

comment:7 by Carl Eugen Hoyos, 12 years ago

Keywords: mpfilter added; mp removed
Note: See TracTickets for help on using tickets.