#689 closed defect (fixed)
invalid reads in iff.c
Reported by: | ami_stuff | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | avcodec |
Version: | git-master | Keywords: | iff ffplay |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description
I get invalid reads while testing ffplay with attached iff ilbm (ham8) file under amigaos, so it would be good to check if the same happen under valgrid - "ffplay a4000t_ham8.iff"
the problem seems to disappear when I comment out two lines in decode_ham_plane32() function
C:\>ffmpeg -i A4000T_HAM8.IFF ffmpeg version N-35057-g2c44aed, Copyright (c) 2000-2011 the FFmpeg developers built on Nov 21 2011 02:36:31 with gcc 4.6.2 configuration: --enable-gpl --enable-version3 --disable-w32threads --enable-ru ntime-cpudetect --enable-avisynth --enable-bzlib --enable-frei0r --enable-libope ncore-amrnb --enable-libopencore-amrwb --enable-libfreetype --enable-libgsm --en able-libmp3lame --enable-libopenjpeg --enable-librtmp --enable-libschroedinger - -enable-libspeex --enable-libtheora --enable-libvo-aacenc --enable-libvo-amrwben c --enable-libvorbis --enable-libvpx --enable-libx264 --enable-libxavs --enable- libxvid --enable-zlib libavutil 51. 26. 0 / 51. 26. 0 libavcodec 53. 36. 0 / 53. 36. 0 libavformat 53. 21. 0 / 53. 21. 0 libavdevice 53. 4. 0 / 53. 4. 0 libavfilter 2. 49. 0 / 2. 49. 0 libswscale 2. 1. 0 / 2. 1. 0 libpostproc 51. 2. 0 / 51. 2. 0 [IFF @ 020A2320] Estimating duration from bitrate, this may be inaccurate Input #0, IFF, from 'A4000T_HAM8.IFF': Metadata: comment : $VER: Written by ASDG's Art Department Professional IFF3.0 .1 (03.19.93) Duration: N/A, bitrate: N/A Stream #0:0: Video: iff_byterun1 (ILBM / 0x4D424C49), rgba, 628x512, SAR 1:1 DAR 157:128, 90k tbr, 90k tbn, 90k tbc At least one output file must be specified
Attachments (4)
Change History (12)
by , 13 years ago
Attachment: | A4000T_HAM8.IFF added |
---|
by , 13 years ago
comment:1 by , 13 years ago
Component: | undetermined → avcodec |
---|---|
Keywords: | iff added |
Reproduced by developer: | set |
Status: | new → open |
Summary: | iff ilbm: possible invalid reads → invalid reads in iff.c |
Version: | unspecified → git-master |
comment:3 by , 13 years ago
Resolution: | fixed |
---|---|
Status: | closed → reopened |
There are still invalid writes while testing with FFplay (Peter's valgrid log).
ffplay version N-35236-g4704462, Copyright (c) 2003-2011 the FFmpeg developers built on Nov 28 2011 20:24:07 with gcc 4.6.2 configuration: libavutil 51. 29. 1 / 51. 29. 1 libavcodec 53. 38. 1 / 53. 38. 1 libavformat 53. 22. 0 / 53. 22. 0 libavdevice 53. 4. 0 / 53. 4. 0 libavfilter 2. 50. 0 / 2. 50. 0 libswscale 2. 1. 0 / 2. 1. 0 [IFF @ 0xc944b00] Estimating duration from bitrate, this may be inaccurate Input #0, IFF, from '/home/user/bug/A4000T_HAM8.IFF': Metadata: comment : $VER: Written by ASDG's Art Department Professional IFF3.0.1 (03.19.93) Duration: N/A, bitrate: N/A Stream #0:0: Video: iff_byterun1 (ILBM / 0x4D424C49), rgba, 628x512, SAR 1:1 DAR 157:128, 90k tbr, 90k tbn, 90k tbc [buffersink @ 0xb8a4380] auto-inserting filter 'auto-inserted scale 0' between the filter 'src' and the filter 'out' [scale @ 0xb8a4920] w:628 h:512 fmt:rgba -> w:628 h:512 fmt:yuv420p flags:0x4 4.44 A-V: 0.000 fd= 0 aq= 0KB vq= 0KB sq= 0B f=0/0 0/0 ==18169== Memcheck, a memory error detector ==18169== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al. ==18169== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info ==18169== Command: ./ffplay_g /home/user/bug/A4000T_HAM8.IFF ==18169== Parent PID: 18011 ==18169== ==18169== Thread 4: ==18169== Invalid write of size 4 ==18169== at 0x728986: decode_ham_plane32 (iff.c:376) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac30 is 0 bytes after a block of size 1,286,160 alloc'd ==18169== at 0x4C25CB8: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0x4C25D67: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0xA320BF: av_malloc (mem.c:90) ==18169== by 0xA2F779: av_image_alloc (imgutils.c:200) ==18169== by 0x449A59: avfilter_default_get_video_buffer (defaults.c:66) ==18169== by 0x446E78: avfilter_get_video_buffer (avfilter.c:406) ==18169== by 0x438B39: input_get_buffer (ffplay.c:1569) ==18169== by 0x72916E: decode_frame_byterun1 (iff.c:535) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== ==18169== Invalid write of size 4 ==18169== at 0x728994: decode_ham_plane32 (iff.c:376) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac34 is 4 bytes after a block of size 1,286,160 alloc'd ==18169== at 0x4C25CB8: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0x4C25D67: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0xA320BF: av_malloc (mem.c:90) ==18169== by 0xA2F779: av_image_alloc (imgutils.c:200) ==18169== by 0x449A59: avfilter_default_get_video_buffer (defaults.c:66) ==18169== by 0x446E78: avfilter_get_video_buffer (avfilter.c:406) ==18169== by 0x438B39: input_get_buffer (ffplay.c:1569) ==18169== by 0x72916E: decode_frame_byterun1 (iff.c:535) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== ==18169== Invalid write of size 4 ==18169== at 0x7289BD: decode_ham_plane32 (iff.c:377) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac38 is 8 bytes after a block of size 1,286,160 alloc'd ==18169== at 0x4C25CB8: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0x4C25D67: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0xA320BF: av_malloc (mem.c:90) ==18169== by 0xA2F779: av_image_alloc (imgutils.c:200) ==18169== by 0x449A59: avfilter_default_get_video_buffer (defaults.c:66) ==18169== by 0x446E78: avfilter_get_video_buffer (avfilter.c:406) ==18169== by 0x438B39: input_get_buffer (ffplay.c:1569) ==18169== by 0x72916E: decode_frame_byterun1 (iff.c:535) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== ==18169== Invalid write of size 4 ==18169== at 0x7289C8: decode_ham_plane32 (iff.c:377) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac3c is 12 bytes after a block of size 1,286,160 alloc'd ==18169== at 0x4C25CB8: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0x4C25D67: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==18169== by 0xA320BF: av_malloc (mem.c:90) ==18169== by 0xA2F779: av_image_alloc (imgutils.c:200) ==18169== by 0x449A59: avfilter_default_get_video_buffer (defaults.c:66) ==18169== by 0x446E78: avfilter_get_video_buffer (avfilter.c:406) ==18169== by 0x438B39: input_get_buffer (ffplay.c:1569) ==18169== by 0x72916E: decode_frame_byterun1 (iff.c:535) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== ==18169== Invalid write of size 4 ==18169== at 0x7289F1: decode_ham_plane32 (iff.c:378) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac40 is not stack'd, malloc'd or (recently) free'd ==18169== ==18169== Invalid write of size 4 ==18169== at 0x7289FC: decode_ham_plane32 (iff.c:378) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac44 is not stack'd, malloc'd or (recently) free'd ==18169== ==18169== Invalid write of size 4 ==18169== at 0x728A29: decode_ham_plane32 (iff.c:379) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac48 is not stack'd, malloc'd or (recently) free'd ==18169== ==18169== Invalid write of size 4 ==18169== at 0x728A37: decode_ham_plane32 (iff.c:379) ==18169== by 0x7294D4: decode_frame_byterun1 (iff.c:562) ==18169== by 0x86F9D6: avcodec_decode_video2 (utils.c:825) ==18169== by 0x43B38E: input_request_frame (ffplay.c:1483) ==18169== by 0x447304: avfilter_request_frame (avfilter.c:520) ==18169== by 0x44B8F3: av_buffersink_get_buffer_ref (sink_buffer.c:128) ==18169== by 0x43C270: video_thread (ffplay.c:1825) ==18169== by 0x5351C24: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x53981F8: ??? (in /usr/lib/libSDL-1.2.so.0.11.3) ==18169== by 0x5A7AB3F: start_thread (pthread_create.c:304) ==18169== by 0x5D6536C: clone (clone.S:112) ==18169== Address 0xcb1ac4c is not stack'd, malloc'd or (recently) free'd ==18169== ==18169== ==18169== HEAP SUMMARY: ==18169== in use at exit: 1,835,937 bytes in 555 blocks ==18169== total heap usage: 13,501 allocs, 12,946 frees, 7,069,830 bytes allocated ==18169== ==18169== LEAK SUMMARY: ==18169== definitely lost: 1,067 bytes in 11 blocks ==18169== indirectly lost: 1,288,656 bytes in 45 blocks ==18169== possibly lost: 491,536 bytes in 1 blocks ==18169== still reachable: 54,678 bytes in 498 blocks ==18169== suppressed: 0 bytes in 0 blocks ==18169== Rerun with --leak-check=full to see details of leaked memory ==18169== ==18169== For counts of detected and suppressed errors, rerun with: -v ==18169== ERROR SUMMARY: 8 errors from 8 contexts (suppressed: 6 from 6)
comment:5 by , 13 years ago
This fixes the problem for me. I have also tested with uncompressed IFF ILBM (HAM8) file and it seems the same must be done for ff_iff_ilbm_decoder.
by , 13 years ago
Attachment: | patchiffDR.diff added |
---|
comment:6 by , 13 years ago
Resolution: | → fixed |
---|---|
Status: | reopened → closed |
comment:7 by , 13 years ago
FFplay crashes with attached IFF-PBM file (HAM8 mode).
C:\>ffmpeg -i 2_pbm.iff ffmpeg version N-36890-g67f5650 Copyright (c) 2000-2012 the FFmpeg developers built on Jan 16 2012 21:57:13 with gcc 4.6.2 configuration: --enable-gpl --enable-version3 --disable-w32threads --enable-ru ntime-cpudetect --enable-avisynth --enable-bzlib --enable-frei0r --enable-libope ncore-amrnb --enable-libopencore-amrwb --enable-libfreetype --enable-libgsm --en able-libmp3lame --enable-libopenjpeg --enable-librtmp --enable-libschroedinger - -enable-libspeex --enable-libtheora --enable-libvo-aacenc --enable-libvo-amrwben c --enable-libvorbis --enable-libvpx --enable-libx264 --enable-libxavs --enable- libxvid --enable-zlib libavutil 51. 34.100 / 51. 34.100 libavcodec 53. 56.105 / 53. 56.105 libavformat 53. 30.100 / 53. 30.100 libavdevice 53. 4.100 / 53. 4.100 libavfilter 2. 59.100 / 2. 59.100 libswscale 2. 1.100 / 2. 1.100 libswresample 0. 6.100 / 0. 6.100 libpostproc 51. 2.100 / 51. 2.100 [IFF @ 020F2320] Estimating duration from bitrate, this may be inaccurate Input #0, IFF, from '2_pbm.iff': Metadata: comment : $VER: Written by ASDG's Art Department Professional IFF3.0 .1 (03.19.93) Duration: N/A, bitrate: N/A Stream #0:0: Video: iff_byterun1 (PBM / 0x204D4250), rgba, 628x512, SAR 22: 22 DAR 157:128, 90k tbr, 90k tbn, 90k tbc At least one output file must be specified
by , 13 years ago
comment:8 by , 13 years ago
If this problem is not reproducible with the original sample, please open a new ticket.