[FFmpeg-trac] #1203(avcodec:open): Illegal Data Usage in Avcodec

[FFmpeg]

#1203: Illegal Data Usage in Avcodec
-------------------------------------+-------------------------------------
             Reporter:  daybreak     |                    Owner:
                 Type:  defect       |                   Status:  open
             Priority:  critical     |                Component:  avcodec
              Version:  git-master   |               Resolution:
             Keywords:  crash        |               Blocked By:
  SIGSEGV wmapro                     |  Reproduced by developer:  1
             Blocking:               |
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------

Comment (by cehoyos):

 Also reproducible with --disable-optimizations --disable-asm --disable-
 yasm.
 {{{
 ...

 Program received signal SIGSEGV, Segmentation fault.
 [Switching to Thread 0xb7bc46c0 (LWP 8447)]
 0x0828cdeb in vector_fmul_window_c (dst=0x8e2b5a0, src0=0x8e2b5a0,
 src1=0x8e2b5a0, win=0x40, len=16)
     at libavcodec/dsputil.c:2506
 2506            float wi = win[i];
 (gdb) bt
 #0  0x0828cdeb in vector_fmul_window_c (dst=0x8e2b5a0, src0=0x8e2b5a0,
 src1=0x8e2b5a0, win=0x40, len=16)
     at libavcodec/dsputil.c:2506
 #1  0x08584770 in wmapro_window (s=0x8e18880) at
 libavcodec/wmaprodec.c:1045
 #2  0x08585459 in decode_subframe (s=0x8e18880) at
 libavcodec/wmaprodec.c:1275
 #3  0x0858583c in decode_frame (s=0x8e18880, got_frame_ptr=0xbff11624) at
 libavcodec/wmaprodec.c:1364
 #4  0x08586243 in decode_packet (avctx=0x8de3df0, data=0x8de3470,
 got_frame_ptr=0xbff11624, avpkt=0xbff1143c)
     at libavcodec/wmaprodec.c:1573
 #5  0x0850e7c2 in avcodec_decode_audio4 (avctx=0x8de3df0, frame=0x8de3470,
 got_frame_ptr=0xbff11624,
     avpkt=0xbff115d4) at libavcodec/utils.c:1541
 #6  0x08051a0c in transcode_audio (ist=0x8de5700, pkt=0xbff115d4,
 got_output=0xbff11624) at ffmpeg.c:2005
 #7  0x0805298f in output_packet (ist=0x8de5700, ost_table=0x8de5768,
 nb_ostreams=1, pkt=0xbff12968)
     at ffmpeg.c:2289
 #8  0x08056590 in transcode (output_files=0x8de4d50, nb_output_files=1,
 input_files=0x8dddc10,
     nb_input_files=1) at ffmpeg.c:3163
 #9  0x0805dcfe in main (argc=6, argv=0xbff12da4) at ffmpeg.c:5275
 (gdb) disass $pc-32 $pc+32
 Dump of assembler code from 0x828cdcb to 0x828ce0b:
 0x0828cdcb <vector_fmul_window_c+57>:   add    (%ebx),%al
 0x0828cdcd <vector_fmul_window_c+59>:   inc    %ebp
 0x0828cdce <vector_fmul_window_c+60>:   or     $0x8b,%al
 0x0828cdd0 <vector_fmul_window_c+62>:   add    %cl,0x458bf045(%ecx)
 0x0828cdd6 <vector_fmul_window_c+68>:   in     (%dx),%al
 0x0828cdd7 <vector_fmul_window_c+69>:   shl    $0x2,%eax
 0x0828cdda <vector_fmul_window_c+72>:   add    0x10(%ebp),%eax
 0x0828cddd <vector_fmul_window_c+75>:   mov    (%eax),%eax
 0x0828cddf <vector_fmul_window_c+77>:   mov    %eax,-0xc(%ebp)
 0x0828cde2 <vector_fmul_window_c+80>:   mov    -0x18(%ebp),%eax
 0x0828cde5 <vector_fmul_window_c+83>:   shl    $0x2,%eax
 0x0828cde8 <vector_fmul_window_c+86>:   add    0x14(%ebp),%eax
 0x0828cdeb <vector_fmul_window_c+89>:   mov    (%eax),%eax
 0x0828cded <vector_fmul_window_c+91>:   mov    %eax,-0x8(%ebp)
 0x0828cdf0 <vector_fmul_window_c+94>:   mov    -0x14(%ebp),%eax
 0x0828cdf3 <vector_fmul_window_c+97>:   shl    $0x2,%eax
 0x0828cdf6 <vector_fmul_window_c+100>:  add    0x14(%ebp),%eax
 0x0828cdf9 <vector_fmul_window_c+103>:  mov    (%eax),%eax
 0x0828cdfb <vector_fmul_window_c+105>:  mov    %eax,-0x4(%ebp)
 0x0828cdfe <vector_fmul_window_c+108>:  mov    -0x18(%ebp),%eax
 0x0828ce01 <vector_fmul_window_c+111>:  shl    $0x2,%eax
 0x0828ce04 <vector_fmul_window_c+114>:  add    0x8(%ebp),%eax
 0x0828ce07 <vector_fmul_window_c+117>:  flds   -0x10(%ebp)
 0x0828ce0a <vector_fmul_window_c+120>:  fmuls  -0x4(%ebp)
 (gdb) info register
 eax            0x0      0
 ecx            0x828cd92        136891794
 edx            0x8e2b5a0        149075360
 ebx            0x0      0
 esp            0xbff11248       0xbff11248
 ebp            0xbff11268       0xbff11268
 esi            0x0      0
 edi            0x15a5810        22698000
 eip            0x828cdeb        0x828cdeb <vector_fmul_window_c+89>
 eflags         0x210247 [ CF PF ZF IF RF ID ]
 cs             0x73     115
 ss             0x7b     123
 ds             0x7b     123
 es             0x7b     123
 fs             0x0      0
 gs             0x33     51
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/1203#comment:2>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker