[FFmpeg-trac] #74(avfilter:new): Fuzzed sample crashes avfilter
FFmpeg
trac at avcodec.org
Tue Apr 19 20:22:31 CEST 2011
#74: Fuzzed sample crashes avfilter
------------------------+----------------------
Reporter: cehoyos | Owner: michael
Type: defect | Status: new
Priority: important | Component: avfilter
Version: git | Keywords:
Blocked By: | Blocking:
Reproduced: 1 | Analyzed: 0
------------------------+----------------------
The sample from issue 2441 now crashes avfilter.
{{{
(gdb) r -i crash_pirateszz_2_s25_r003.fuzz.sample -f null -
FFmpeg version git-N-29196-ge61b83d, Copyright (c) 2000-2011 the FFmpeg
developers
built on Apr 19 2011 19:44:16 with gcc 4.4.5
configuration: --cc='/usr/local/gcc-4.4.5/bin/gcc -m32' --disable-asm
libavutil 50. 40. 1 / 50. 40. 1
libavcodec 52.120. 0 / 52.120. 0
libavformat 52.108. 0 / 52.108. 0
libavdevice 52. 4. 0 / 52. 4. 0
libavfilter 1. 79. 1 / 1. 79. 1
libswscale 0. 13. 0 / 0. 13. 0
[mpeg1video @ 0x8c696d0] matrix damaged
[mpeg1video @ 0x8c696d0] sequence header damaged
[mpeg1video @ 0x8c696d0] matrix damaged
[mpeg1video @ 0x8c696d0] sequence header damaged
[mpeg1video @ 0x8c696d0] matrix damaged
[mpeg1video @ 0x8c696d0] sequence header damaged
[mpeg1video @ 0x8c696d0] Missing picture start code
Last message repeated 15 times
[mpegvideo @ 0x8c66de0] max_analyze_duration reached
[mpegvideo @ 0x8c66de0] Estimating duration from bitrate, this may be
inaccurate
Seems stream 0 codec frame rate differs from container frame rate: 6.66
(60000/9009) -> 3.33 (60000/18018)
Input #0, mpegvideo, from 'crash_pirateszz_2_s25_r003.fuzz.sample':
Duration: 00:00:08.35, bitrate: 9800 kb/s
Stream #0.0: Video: mpeg2video (4:2:2), yuv420p, 720x4576 [PAR
4576:405 DAR 16:9], 9800 kb/s, 17.53 fps, 3.33 tbr, 1200k tbn, 6.66 tbc
[buffer @ 0x8d865e0] w:720 h:4576 pixfmt:yuv420p
Output #0, null, to 'pipe:':
Metadata:
encoder : Lavf52.108.0
Stream #0.0: Video: rawvideo, yuv420p, 720x4576 [PAR 4576:405 DAR
16:9], q=2-31, 200 kb/s, 90k tbn, 3.33 tbc
Stream mapping:
Stream #0.0 -> #0.0
Press [q] to stop encoding
mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] Missing picture start code
Last message repeated 15 times
[mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] ignoring pic cod ext after 0
[mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] matrix damaged
[mpeg2video @ 0x8c696d0] sequence header damaged
[mpeg2video @ 0x8c696d0] warning: first frame is no keyframe
[mpeg2video @ 0x8c696d0] invalid mb type in P Frame at 4 131
[mpeg2video @ 0x8c696d0] invalid mb type in P Frame at 27 3
...
Program received signal SIGSEGV, Segmentation fault.
0x0806d489 in av_vsrc_buffer_add_frame2 (buffer_filter=0x8d865e0,
frame=0xffffbe68, pts=1101100, pixel_aspect=..., width=721, height=480,
pix_fmt=PIX_FMT_YUV420P, sws_param=0x85c6d2e "0:0") at
libavfilter/vsrc_buffer.c:60
60 av_log(buffer_filter, AV_LOG_INFO, "Changing filter graph
input to accept %dx%d %d (%d %d)\n",
(gdb) bt
#0 0x0806d489 in av_vsrc_buffer_add_frame2 (buffer_filter=0x8d865e0,
frame=0xffffbe68, pts=1101100, pixel_aspect=..., width=721, height=480,
pix_fmt=PIX_FMT_YUV420P, sws_param=0x85c6d2e "0:0") at
libavfilter/vsrc_buffer.c:60
#1 0x08052295 in output_packet (ist=<value optimized out>,
ist_index=<value optimized out>, ost_table=0x8d86570, nb_ostreams=1,
pkt=0xffffcdac) at ffmpeg.c:1644
#2 0x08054743 in transcode (nb_output_files=<value optimized out>,
nb_input_files=<value optimized out>, stream_maps=<value optimized out>,
nb_stream_maps=0, input_files=<value optimized out>, output_files=<value
optimized out>)
at ffmpeg.c:2719
#3 0x08055cab in main (argc=6, argv=0xffffcfe4) at ffmpeg.c:4463
(gdb) disass $pc-32 $pc+32
Dump of assembler code from 0x806d469 to 0x806d4a9:
0x0806d469 <av_vsrc_buffer_add_frame2+89>: mov 0x100(%ebx),%ecx
0x0806d46f <av_vsrc_buffer_add_frame2+95>: mov 0x70(%esp),%edx
0x0806d473 <av_vsrc_buffer_add_frame2+99>: mov 0x20(%edx),%eax
0x0806d476 <av_vsrc_buffer_add_frame2+102>: mov 0x88(%esp),%edx
0x0806d47d <av_vsrc_buffer_add_frame2+109>: mov (%eax),%eax
0x0806d47f <av_vsrc_buffer_add_frame2+111>: mov 0x8(%eax),%eax
0x0806d482 <av_vsrc_buffer_add_frame2+114>: mov %eax,0x4c(%esp)
0x0806d486 <av_vsrc_buffer_add_frame2+118>: mov 0x20(%eax),%eax
0x0806d489 <av_vsrc_buffer_add_frame2+121>: mov (%eax),%eax
0x0806d48b <av_vsrc_buffer_add_frame2+123>: mov 0x38(%eax),%eax
0x0806d48e <av_vsrc_buffer_add_frame2+126>: mov %ecx,0x18(%esp)
0x0806d492 <av_vsrc_buffer_add_frame2+130>: mov 0x90(%esp),%ecx
0x0806d499 <av_vsrc_buffer_add_frame2+137>: mov %edx,0xc(%esp)
0x0806d49d <av_vsrc_buffer_add_frame2+141>: movl
$0x85cb56c,0x8(%esp)
0x0806d4a5 <av_vsrc_buffer_add_frame2+149>: mov %eax,0x1c(%esp)
End of assembler dump.
(gdb) info register
eax 0x0 0
ecx 0x0 0
edx 0x2d1 721
ebx 0x8d86670 148399728
esp 0xffffbc20 0xffffbc20
ebp 0xffffbe68 0xffffbe68
esi 0x8d86570 148399472
edi 0x10cd2c 1101100
eip 0x806d489 0x806d489 <av_vsrc_buffer_add_frame2+121>
eflags 0x10297 [ CF PF AF SF IF RF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x63 99
}}}
--
Ticket URL: <https://avcodec.org/trac/ffmpeg/ticket/74>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker
More information about the FFmpeg-trac
mailing list