[FFmpeg-trac] #2993(swresample:open): swr ssse3: invalid read with forced mp3adu

[FFmpeg]

#2993: swr ssse3: invalid read with forced mp3adu
------------------------------------+--------------------------------------
             Reporter:  ami_stuff   |                    Owner:
                 Type:  defect      |                   Status:  open
             Priority:  normal      |                Component:  swresample
              Version:  git-master  |               Resolution:
             Keywords:              |               Blocked By:
             Blocking:              |  Reproduced by developer:  1
Analyzed by developer:  0           |
------------------------------------+--------------------------------------

Comment (by ami_stuff):

 I was able to prepare a file to reproduce this.

 http://www1.datafilehost.com/d/ad6be63f

 {{{
 knoppix at Microknoppix:/media/sdb1$ valgrind --leak-check=full ffmpeg-HEAD-
 5dc6c0e/ffmpeg_g -i ./out.mov -loglevel 0 -f null -
 ==6738== Memcheck, a memory error detector
 ==6738== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
 ==6738== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
 ==6738== Command: ffmpeg-HEAD-5dc6c0e/ffmpeg_g -i ./out.mov -loglevel 0 -f
 null -
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0x437C69F: ???
 ==6738==  Address 0x4305b1c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0x456D15F: ???
 ==6738==  Address 0x449045c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xABF4DFF: ???
 ==6738==  Address 0xab84c9c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xAC6969F: ???
 ==6738==  Address 0xab84c9c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xAF0FABF: ???
 ==6738==  Address 0xae8c93c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xB162FFF: ???
 ==6738==  Address 0xb10ce9c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xB4CB01F: ???
 ==6738==  Address 0xb4477fc is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xB6E83BF: ???
 ==6738==  Address 0xb635f3c is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xB8249FF: ???
 ==6738==  Address 0xb7b17bc is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xB9F1FBF: ???
 ==6738==  Address 0xb9e6d9c is 2,300 bytes inside a block of size 2,304
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738== Invalid read of size 8
 ==6738==    at 0x8824807: swri_resample_int16_ssse3
 (resample_template.c:122)
 ==6738==    by 0x8824FDF: multiple_resample (resample.c:321)
 ==6738==    by 0x881BF04: resample (swresample.c:569)
 ==6738==    by 0xBB3025F: ???
 ==6738==  Address 0xbaaabdc is 764 bytes inside a block of size 768
 alloc'd
 ==6738==    at 0x40268A4: memalign (vg_replace_malloc.c:694)
 ==6738==    by 0x402695E: posix_memalign (vg_replace_malloc.c:835)
 ==6738==    by 0x8875B97: av_malloc (mem.c:93)
 ==6738==    by 0x88682F8: av_buffer_alloc (buffer.c:70)
 ==6738==    by 0x8868B28: av_buffer_pool_get (buffer.c:305)
 ==6738==    by 0x8677CD0: audio_get_buffer (utils.c:540)
 ==6738==    by 0x8679850: get_buffer_internal (utils.c:876)
 ==6738==    by 0x8679DE3: ff_get_buffer (utils.c:888)
 ==6738==    by 0x8569A78: mp_decode_frame (mpegaudiodec.c:1633)
 ==6738==    by 0x856A050: decode_frame (mpegaudiodec.c:1709)
 ==6738==    by 0x867C0F4: avcodec_decode_audio4 (utils.c:2136)
 ==6738==    by 0x80B5859: decode_audio (ffmpeg.c:1526)
 ==6738==
 ==6738==
 ==6738== HEAP SUMMARY:
 ==6738==     in use at exit: 0 bytes in 0 blocks
 ==6738==   total heap usage: 50,508 allocs, 50,508 frees, 19,762,456 bytes
 allocated
 ==6738==
 ==6738== All heap blocks were freed -- no leaks are possible
 ==6738==
 ==6738== For counts of detected and suppressed errors, rerun with: -v
 ==6738== ERROR SUMMARY: 136 errors from 11 contexts (suppressed: 59 from
 6)
 knoppix at Microknoppix:/media/sdb1$
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/2993#comment:4>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker