#2140 closed defect (fixed)
null ptr deref due to vf_mp not setting pseudo palette
Reported by: | Carl Eugen Hoyos | Owned by: | |
---|---|---|---|
Priority: | important | Component: | avfilter |
Version: | git-master | Keywords: | crash SIGSEGV mpfilter |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | no | |
Analyzed by developer: | yes |
Description
$ ffmpeg -i tests/lena.pnm -vf mp=il=d -pix_fmt gray gray.png
(gdb) r -i gray.png -vf mp=il=i gray2.png Starting program: ffmpeg_g -i gray.png -vf mp=il=i gray2.png [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". ffmpeg version N-48916-ge074fe2 Copyright (c) 2000-2013 the FFmpeg developers built on Jan 15 2013 15:59:20 with gcc 4.7 (SUSE Linux) configuration: --enable-gpl --disable-indev=jack libavutil 52. 14.100 / 52. 14.100 libavcodec 54. 89.100 / 54. 89.100 libavformat 54. 59.107 / 54. 59.107 libavdevice 54. 3.102 / 54. 3.102 libavfilter 3. 32.100 / 3. 32.100 libswscale 2. 1.103 / 2. 1.103 libswresample 0. 17.102 / 0. 17.102 libpostproc 52. 2.100 / 52. 2.100 Input #0, image2, from 'gray.png': Duration: 00:00:00.04, start: 0.000000, bitrate: N/A Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc [Parsed_mp_0 @ 0x15d2a20] 'il' is a wrapped MPlayer filter (libmpcodecs). This filter may be removed once it has been ported to a native libavfilter. [New Thread 0x7ffff6563700 (LWP 11883)] [New Thread 0x7ffff5d62700 (LWP 11884)] [New Thread 0x7ffff5561700 (LWP 11885)] [New Thread 0x7ffff4d60700 (LWP 11886)] [New Thread 0x7fffe7fff700 (LWP 11887)] [New Thread 0x7fffe77fe700 (LWP 11888)] [New Thread 0x7fffe6ffd700 (LWP 11889)] [New Thread 0x7fffe67fc700 (LWP 11890)] Output #0, image2, to 'gray2.png': Metadata: encoder : Lavf54.59.107 Stream #0:0: Video: png, gray, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc Stream mapping: Stream #0:0 -> #0:0 (png -> png) Press [q] to stop, [?] for help Program received signal SIGSEGV, Segmentation fault. 0x0000000000bb9ae0 in av_image_copy (dst_data=dst_data@entry=0x15b9108, dst_linesizes=dst_linesizes@entry=0x15b9150, src_data=src_data@entry=0x15c6b88, src_linesizes=src_linesizes@entry=0x15c6bd0, pix_fmt=AV_PIX_FMT_GRAY8, width=256, height=256) at libavutil/imgutils.c:272 272 memcpy(dst_data[1], src_data[1], 4*256); (gdb) bt #0 0x0000000000bb9ae0 in av_image_copy (dst_data=dst_data@entry=0x15b9108, dst_linesizes=dst_linesizes@entry=0x15b9150, src_data=src_data@entry=0x15c6b88, src_linesizes=src_linesizes@entry=0x15c6bd0, pix_fmt=AV_PIX_FMT_GRAY8, width=256, height=256) at libavutil/imgutils.c:272 #1 0x0000000000470667 in ff_filter_frame_framed (link=link@entry=0x15d42c0, frame=frame@entry=0x15c6b80) at libavfilter/avfilter.c:693 #2 0x0000000000470a71 in ff_filter_frame (frame=0x15c6b80, link=0x15d42c0) at libavfilter/avfilter.c:791 #3 default_filter_frame (link=<optimized out>, frame=0x15c6b80) at libavfilter/avfilter.c:638 #4 0x00000000004707d6 in ff_filter_frame_framed (link=link@entry=0x15d4020, frame=frame@entry=0x15c6b80) at libavfilter/avfilter.c:719 #5 0x000000000047242b in ff_filter_frame (link=link@entry=0x15d4020, frame=frame@entry=0x15c6b80) at libavfilter/avfilter.c:791 #6 0x000000000048af2c in ff_vf_next_put_image (vf=0x15d2ac0, mpi=0x15d43a0, pts=0) at libavfilter/vf_mp.c:588 #7 0x000000000048abd2 in filter_frame (inlink=0x15d41e0, inpic=0x15d4700) at libavfilter/vf_mp.c:824 #8 0x00000000004707d6 in ff_filter_frame_framed (link=link@entry=0x15d41e0, frame=frame@entry=0x15d4700) at libavfilter/avfilter.c:719 #9 0x000000000047242b in ff_filter_frame (link=link@entry=0x15d41e0, frame=0x15d4700) at libavfilter/avfilter.c:791 #10 0x0000000000475182 in request_frame (link=0x15d41e0) at libavfilter/buffersrc.c:372 #11 0x00000000004755b4 in av_buffersrc_add_ref (s=0x15c6e00, buf=0x0, flags=flags@entry=7) at libavfilter/buffersrc.c:150 #12 0x000000000045e5ed in decode_video (ist=ist@entry=0x15ddb40, pkt=pkt@entry=0x7fffffffdb00, got_output=got_output@entry=0x7fffffffd89c) at ffmpeg.c:1672 #13 0x00000000004615ff in output_packet (pkt=0x7fffffffdaa0, ist=0x15ddb40) at ffmpeg.c:1792 #14 process_input (file_index=<optimized out>) at ffmpeg.c:2886 #15 0x0000000000451cb0 in transcode_step () at ffmpeg.c:2982 #16 transcode () at ffmpeg.c:3034 #17 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3209 (gdb) disass $pc-32,$pc+32 Dump of assembler code from 0xbb9ac0 to 0xbb9b00: 0x0000000000bb9ac0 <av_image_copy+848>: add %al,(%rax) 0x0000000000bb9ac2 <av_image_copy+850>: add %al,-0xa(%rax) 0x0000000000bb9ac5 <av_image_copy+853>: movl $0x10d850f,(%rdx) 0x0000000000bb9acb <av_image_copy+859>: add %al,(%rax) 0x0000000000bb9acd <av_image_copy+861>: test $0x4,%dil 0x0000000000bb9ad1 <av_image_copy+865>: jne 0xbb9bc6 <av_image_copy+1110> 0x0000000000bb9ad7 <av_image_copy+871>: mov %eax,%ecx 0x0000000000bb9ad9 <av_image_copy+873>: xor %edx,%edx 0x0000000000bb9adb <av_image_copy+875>: shr $0x3,%ecx 0x0000000000bb9ade <av_image_copy+878>: test $0x4,%al => 0x0000000000bb9ae0 <av_image_copy+880>: rep movsq %ds:(%rsi),%es:(%rdi) 0x0000000000bb9ae3 <av_image_copy+883>: je 0xbb9aee <av_image_copy+894> 0x0000000000bb9ae5 <av_image_copy+885>: mov (%rsi),%edx 0x0000000000bb9ae7 <av_image_copy+887>: mov %edx,(%rdi) 0x0000000000bb9ae9 <av_image_copy+889>: mov $0x4,%edx 0x0000000000bb9aee <av_image_copy+894>: test $0x2,%al 0x0000000000bb9af0 <av_image_copy+896>: je 0xbb9afe <av_image_copy+910> 0x0000000000bb9af2 <av_image_copy+898>: movzwl (%rsi,%rdx,1),%ecx 0x0000000000bb9af6 <av_image_copy+902>: mov %cx,(%rdi,%rdx,1) 0x0000000000bb9afa <av_image_copy+906>: add $0x2,%rdx 0x0000000000bb9afe <av_image_copy+910>: test $0x1,%al (gdb) info register rax 0x400 1024 rbx 0x100 256 rcx 0x80 128 rdx 0x0 0 rsi 0x0 0 rdi 0x162daa0 23255712 rbp 0x100 0x100 rsp 0x7fffffffd1f0 0x7fffffffd1f0 r8 0x162d9a0 23255456 r9 0xf0 240 r10 0x0 0 r11 0x7ffff68d1d60 140737329831264 r12 0x161d840 23189568 r13 0x162daa0 23255712 r14 0x0 0 r15 0x100 256 rip 0xbb9ae0 0xbb9ae0 <av_image_copy+880> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0
Change History (7)
comment:1 by , 12 years ago
Resolution: | → fixed |
---|---|
Status: | new → closed |
comment:2 by , 12 years ago
Resolution: | fixed |
---|---|
Status: | closed → reopened |
(gdb) r -i gray.png -vf mp=il=i gray2.png Starting program: ffmpeg_g -i gray.png -vf mp=il=i gray2.png [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". ffmpeg version N-49616-gf0eacbc Copyright (c) 2000-2013 the FFmpeg developers built on Feb 5 2013 23:36:50 with gcc 4.7 (SUSE Linux) configuration: --enable-gpl --disable-indev=jack libavutil 52. 17.101 / 52. 17.101 libavcodec 54. 91.100 / 54. 91.100 libavformat 54. 61.104 / 54. 61.104 libavdevice 54. 3.103 / 54. 3.103 libavfilter 3. 35.101 / 3. 35.101 libswscale 2. 2.100 / 2. 2.100 libswresample 0. 17.102 / 0. 17.102 libpostproc 52. 2.100 / 52. 2.100 Input #0, image2, from 'gray.png': Duration: 00:00:00.04, start: 0.000000, bitrate: N/A Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc [Parsed_mp_0 @ 0x160f5c0] 'il' is a wrapped MPlayer filter (libmpcodecs). This filter may be removed once it has been ported to a native libavfilter. [New Thread 0x7ffff6563700 (LWP 23337)] [New Thread 0x7ffff5d62700 (LWP 23338)] [New Thread 0x7ffff5561700 (LWP 23339)] [New Thread 0x7ffff4d60700 (LWP 23340)] [New Thread 0x7fffe7fff700 (LWP 23341)] [New Thread 0x7fffe77fe700 (LWP 23342)] [New Thread 0x7fffe6ffd700 (LWP 23343)] [New Thread 0x7fffe67fc700 (LWP 23344)] Output #0, image2, to 'gray2.png': Metadata: encoder : Lavf54.61.104 Stream #0:0: Video: png, gray, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc Stream mapping: Stream #0:0 -> #0:0 (png -> png) Press [q] to stop, [?] for help Program received signal SIGSEGV, Segmentation fault. 0x0000000000bbdb60 in av_image_copy (dst_data=dst_data@entry=0x15e4288, dst_linesizes=dst_linesizes@entry=0x15e42d0, src_data=src_data@entry=0x15e32c8, src_linesizes=src_linesizes@entry=0x15e3310, pix_fmt=AV_PIX_FMT_GRAY8, width=256, height=256) at libavutil/imgutils.c:272 272 memcpy(dst_data[1], src_data[1], 4*256); (gdb) bt #0 0x0000000000bbdb60 in av_image_copy (dst_data=dst_data@entry=0x15e4288, dst_linesizes=dst_linesizes@entry=0x15e42d0, src_data=src_data@entry=0x15e32c8, src_linesizes=src_linesizes@entry=0x15e3310, pix_fmt=AV_PIX_FMT_GRAY8, width=256, height=256) at libavutil/imgutils.c:272 #1 0x000000000046e497 in ff_filter_frame_framed (link=link@entry=0x15fc960, frame=frame@entry=0x15e32c0) at libavfilter/avfilter.c:693 #2 0x000000000046e8a1 in ff_filter_frame (frame=0x15e32c0, link=0x15fc960) at libavfilter/avfilter.c:791 #3 default_filter_frame (link=<optimized out>, frame=0x15e32c0) at libavfilter/avfilter.c:638 #4 0x000000000046e606 in ff_filter_frame_framed (link=link@entry=0x15fc2a0, frame=frame@entry=0x15e32c0) at libavfilter/avfilter.c:719 #5 0x000000000047025b in ff_filter_frame (link=link@entry=0x15fc2a0, frame=frame@entry=0x15e32c0) at libavfilter/avfilter.c:791 #6 0x000000000048923c in ff_vf_next_put_image (vf=0x160f660, mpi=0x15e3110, pts=0) at libavfilter/vf_mp.c:588 #7 0x0000000000488ee2 in filter_frame (inlink=0x15fc880, inpic=0x15ff800) at libavfilter/vf_mp.c:824 #8 0x000000000046e606 in ff_filter_frame_framed (link=link@entry=0x15fc880, frame=frame@entry=0x15ff800) at libavfilter/avfilter.c:719 #9 0x000000000047025b in ff_filter_frame (link=link@entry=0x15fc880, frame=0x15ff800) at libavfilter/avfilter.c:791 #10 0x0000000000473242 in request_frame (link=0x15fc880) at libavfilter/buffersrc.c:396 #11 0x0000000000473694 in av_buffersrc_add_ref (s=0x160f4c0, buf=0x0, flags=flags@entry=7) at libavfilter/buffersrc.c:151 #12 0x000000000045b76d in decode_video (ist=ist@entry=0x1606ce0, pkt=pkt@entry=0x7fffffffdb00, got_output=got_output@entry=0x7fffffffd89c) at ffmpeg.c:1715 #13 0x000000000045e8bf in output_packet (pkt=0x7fffffffdaa0, ist=0x1606ce0) at ffmpeg.c:1835 #14 process_input (file_index=<optimized out>) at ffmpeg.c:2988 #15 0x000000000044ecc0 in transcode_step () at ffmpeg.c:3084 #16 transcode () at ffmpeg.c:3136 #17 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3311 (gdb) disass $pc-32,$pc+32 Dump of assembler code from 0xbbdb40 to 0xbbdb80: 0x0000000000bbdb40 <av_image_copy+848>: add %al,(%rax) 0x0000000000bbdb42 <av_image_copy+850>: add %al,-0xa(%rax) 0x0000000000bbdb45 <av_image_copy+853>: movl $0x10d850f,(%rdx) 0x0000000000bbdb4b <av_image_copy+859>: add %al,(%rax) 0x0000000000bbdb4d <av_image_copy+861>: test $0x4,%dil 0x0000000000bbdb51 <av_image_copy+865>: jne 0xbbdc46 <av_image_copy+1110> 0x0000000000bbdb57 <av_image_copy+871>: mov %eax,%ecx 0x0000000000bbdb59 <av_image_copy+873>: xor %edx,%edx 0x0000000000bbdb5b <av_image_copy+875>: shr $0x3,%ecx 0x0000000000bbdb5e <av_image_copy+878>: test $0x4,%al => 0x0000000000bbdb60 <av_image_copy+880>: rep movsq %ds:(%rsi),%es:(%rdi) 0x0000000000bbdb63 <av_image_copy+883>: je 0xbbdb6e <av_image_copy+894> 0x0000000000bbdb65 <av_image_copy+885>: mov (%rsi),%edx 0x0000000000bbdb67 <av_image_copy+887>: mov %edx,(%rdi) 0x0000000000bbdb69 <av_image_copy+889>: mov $0x4,%edx 0x0000000000bbdb6e <av_image_copy+894>: test $0x2,%al 0x0000000000bbdb70 <av_image_copy+896>: je 0xbbdb7e <av_image_copy+910> 0x0000000000bbdb72 <av_image_copy+898>: movzwl (%rsi,%rdx,1),%ecx 0x0000000000bbdb76 <av_image_copy+902>: mov %cx,(%rdi,%rdx,1) 0x0000000000bbdb7a <av_image_copy+906>: add $0x2,%rdx 0x0000000000bbdb7e <av_image_copy+910>: test $0x1,%al End of assembler dump. (gdb) info register rax 0x400 1024 rbx 0x100 256 rcx 0x80 128 rdx 0x0 0 rsi 0x0 0 rdi 0x1656c40 23424064 rbp 0x100 0x100 rsp 0x7fffffffd1f0 0x7fffffffd1f0 r8 0x1656c30 23424048 r9 0x0 0 r10 0x0 0 r11 0x7ffff68d1b20 140737329830688 r12 0x16469e0 23357920 r13 0x1656c40 23424064 r14 0x0 0 r15 0x100 256 rip 0xbbdb60 0xbbdb60 <av_image_copy+880> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0
comment:3 by , 12 years ago
Analyzed by developer: | set |
---|---|
Summary: | Crash using mp=il=i on gray input → null ptr deref due to vf_mp not setting pseudo palette |
comment:4 by , 12 years ago
The mp=il filter was ported and removed by Paul B Mahol, the crash is still reproducible with mp=fspp.
$ ffmpeg -i tests/lena.pnm -pix_fmt gray gray.png
(gdb) r -i gray.png -vf mp=fspp -f null - Starting program: ffmpeg_g -i gray.png -vf mp=fspp -f null - [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". ffmpeg version 1.1 Copyright (c) 2000-2013 the FFmpeg developers built on Feb 10 2013 11:46:21 with gcc 4.7 (SUSE Linux) configuration: --enable-gpl libavutil 52. 13.100 / 52. 13.100 libavcodec 54. 86.100 / 54. 86.100 libavformat 54. 59.106 / 54. 59.106 libavdevice 54. 3.102 / 54. 3.102 libavfilter 3. 32.100 / 3. 32.100 libswscale 2. 1.103 / 2. 1.103 libswresample 0. 17.102 / 0. 17.102 libpostproc 52. 2.100 / 52. 2.100 Input #0, image2, from 'gray.png': Duration: 00:00:00.04, start: 0.000000, bitrate: N/A Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc [Parsed_mp_0 @ 0x15de480] 'fspp' is a wrapped MPlayer filter (libmpcodecs). This filter may be removed once it has been ported to a native libavfilter. Output #0, null, to 'pipe:': Metadata: encoder : Lavf54.59.106 Stream #0:0: Video: rawvideo (Y800 / 0x30303859), gray, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc Stream mapping: Stream #0:0 -> #0:0 (png -> rawvideo) Press [q] to stop, [?] for help Program received signal SIGSEGV, Segmentation fault. 0x0000000000bb8d60 in av_image_copy (dst_data=dst_data@entry=0x15dffc8, dst_linesizes=dst_linesizes@entry=0x15e0010, src_data=src_data@entry=0x15df708, src_linesizes=src_linesizes@entry=0x15df750, pix_fmt=AV_PIX_FMT_GRAY8, width=256, height=256) at libavutil/imgutils.c:272 272 memcpy(dst_data[1], src_data[1], 4*256); (gdb) bt #0 0x0000000000bb8d60 in av_image_copy (dst_data=dst_data@entry=0x15dffc8, dst_linesizes=dst_linesizes@entry=0x15e0010, src_data=src_data@entry=0x15df708, src_linesizes=src_linesizes@entry=0x15df750, pix_fmt=AV_PIX_FMT_GRAY8, width=256, height=256) at libavutil/imgutils.c:272 #1 0x00000000004713e6 in ff_filter_frame_framed (link=link@entry=0x15ded20, frame=frame@entry=0x15df700) at libavfilter/avfilter.c:693 #2 0x00000000004731ab in ff_filter_frame (link=link@entry=0x15ded20, frame=frame@entry=0x15df700) at libavfilter/avfilter.c:791 #3 0x000000000048bcac in ff_vf_next_put_image (vf=0x15de5a0, mpi=0x15df880, pts=0) at libavfilter/vf_mp.c:588 #4 0x000000000048b952 in filter_frame (inlink=0x15dfcc0, inpic=0x15dfac0) at libavfilter/vf_mp.c:824 #5 0x0000000000471555 in ff_filter_frame_framed (link=link@entry=0x15dfcc0, frame=frame@entry=0x15dfac0) at libavfilter/avfilter.c:719 #6 0x00000000004731ab in ff_filter_frame (link=link@entry=0x15dfcc0, frame=0x15dfac0) at libavfilter/avfilter.c:791 #7 0x0000000000475f02 in request_frame (link=0x15dfcc0) at libavfilter/buffersrc.c:372 #8 0x0000000000476334 in av_buffersrc_add_ref (s=0x15b9480, buf=0x0, flags=flags@entry=7) at libavfilter/buffersrc.c:150 #9 0x000000000045eafd in decode_video (ist=ist@entry=0x15d7540, pkt=pkt@entry=0x7fffffffdaf0, got_output=got_output@entry=0x7fffffffd88c) at ffmpeg.c:1672 #10 0x0000000000461b0f in output_packet (pkt=0x7fffffffda90, ist=0x15d7540) at ffmpeg.c:1792 #11 process_input (file_index=<optimized out>) at ffmpeg.c:2886 #12 0x00000000004521e0 in transcode_step () at ffmpeg.c:2982 #13 transcode () at ffmpeg.c:3034 #14 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3209 (gdb) disass $pc-32,$pc+32 Dump of assembler code from 0xbb8d40 to 0xbb8d80: 0x0000000000bb8d40 <av_image_copy+848>: add %al,(%rax) 0x0000000000bb8d42 <av_image_copy+850>: add %al,-0xa(%rax) 0x0000000000bb8d45 <av_image_copy+853>: movl $0x10d850f,(%rdx) 0x0000000000bb8d4b <av_image_copy+859>: add %al,(%rax) 0x0000000000bb8d4d <av_image_copy+861>: test $0x4,%dil 0x0000000000bb8d51 <av_image_copy+865>: jne 0xbb8e46 <av_image_copy+1110> 0x0000000000bb8d57 <av_image_copy+871>: mov %eax,%ecx 0x0000000000bb8d59 <av_image_copy+873>: xor %edx,%edx 0x0000000000bb8d5b <av_image_copy+875>: shr $0x3,%ecx 0x0000000000bb8d5e <av_image_copy+878>: test $0x4,%al => 0x0000000000bb8d60 <av_image_copy+880>: rep movsq %ds:(%rsi),%es:(%rdi) 0x0000000000bb8d63 <av_image_copy+883>: je 0xbb8d6e <av_image_copy+894> 0x0000000000bb8d65 <av_image_copy+885>: mov (%rsi),%edx 0x0000000000bb8d67 <av_image_copy+887>: mov %edx,(%rdi) 0x0000000000bb8d69 <av_image_copy+889>: mov $0x4,%edx 0x0000000000bb8d6e <av_image_copy+894>: test $0x2,%al 0x0000000000bb8d70 <av_image_copy+896>: je 0xbb8d7e <av_image_copy+910> 0x0000000000bb8d72 <av_image_copy+898>: movzwl (%rsi,%rdx,1),%ecx 0x0000000000bb8d76 <av_image_copy+902>: mov %cx,(%rdi,%rdx,1) 0x0000000000bb8d7a <av_image_copy+906>: add $0x2,%rdx 0x0000000000bb8d7e <av_image_copy+910>: test $0x1,%al End of assembler dump. (gdb) info register rax 0x400 1024 rbx 0x100 256 rcx 0x80 128 rdx 0x0 0 rsi 0x0 0 rdi 0x1627080 23228544 rbp 0x100 0x100 rsp 0x7fffffffd2e0 0x7fffffffd2e0 r8 0x1626f80 23228288 r9 0xf0 240 r10 0x0 0 r11 0x7ffff668dd60 140737327455584 r12 0x1616e20 23162400 r13 0x1627080 23228544 r14 0x0 0 r15 0x100 256 rip 0xbb8d60 0xbb8d60 <av_image_copy+880> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0
comment:6 by , 12 years ago
Resolution: | → fixed |
---|---|
Status: | reopened → closed |
comment:7 by , 12 years ago
Keywords: | mpfilter added; mp removed |
---|
Note:
See TracTickets
for help on using tickets.
was fixed by syncing libmpcodec from mplayer i think
feel free to backport to releases