[FFmpeg-trac] #1991(avformat:open): ffmpeg: probesize crash

[FFmpeg]

#1991: ffmpeg: probesize crash
-------------------------------------+-------------------------------------
             Reporter:  ami_stuff    |                    Owner:
                 Type:  defect       |                   Status:  open
             Priority:  important    |                Component:  avformat
              Version:  git-master   |               Resolution:
             Keywords:  regression   |               Blocked By:
  crash SIGSEGV                      |  Reproduced by developer:  1
             Blocking:               |
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
Changes (by cehoyos):

 * status:  new => open
 * component:  undetermined => avformat
 * priority:  normal => important
 * version:  unspecified => git-master
 * keywords:   => regression crash SIGSEGV
 * reproduced:  0 => 1


Old description:

> the command is
>
> ffmpeg -i probesize 1000000 -i
> nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3
>
> reported here:
>
> http://article.gmane.org/gmane.comp.video.ffmpeg.user/42233
>
> http://nl.nrk.no/podkast/aps/10908/nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3
>
> {{{
> < -i nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3
> Starting program: d:\mingw\msys\1.0\ffmpeg-head-ccf771c\ffmpeg_g.exe
> -probesize
> 1000000 -i nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3
> [New Thread 1976.0xc8]
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x0047a1d7 in av_probe_input_buffer (pb=0x462caa8, fmt=0x462c534,
>     filename=0x462c4e1
> "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
>     logctx=0x462c530, offset=0, max_probe_size=1000000)
>     at libavformat/utils.c:459
> 459             memset(pd.buf + pd.buf_size, 0, AVPROBE_PADDING_SIZE);
> (gdb) bt
> #0  0x0047a1d7 in av_probe_input_buffer (pb=0x462caa8, fmt=0x462c534,
>     filename=0x462c4e1
> "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
>     logctx=0x462c530, offset=0, max_probe_size=1000000)
>     at libavformat/utils.c:459
> #1  0x00481c1c in init_input (options=0x22fad4,
>     filename=0x462c4e1
> "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
>     s=0x462c530) at libavformat/utils.c:508
> #2  avformat_open_input (ps=0x22fbe4,
>     filename=0x462c4e1
> "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
>     fmt=0x0, options=0x11e58ec) at libavformat/utils.c:562
> #3  0x004059a1 in opt_input_file (optctx=0x22fd48, opt=0x462c4df "i",
>     filename=<optimized out>) at ffmpeg_opt.c:779
> #4  0x0041696c in parse_option (optctx=0x22fd48, opt=<optimized out>,
>     arg=0x462c4e1 "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
>     options=0xb00be0) at cmdutils.c:324
> #5  0x00416cee in parse_options (optctx=0x22fd48, argc=5,
>     argv=<optimized out>, options=0xb00be0,
>     parse_arg_function=0x406570 <opt_output_file>) at cmdutils.c:357
> #6  0x00a9433a in main (argc=5, argv=<optimized out>) at ffmpeg.c:3182
> (gdb)
> }}}

New description:

 the command is

 ffmpeg -probesize 1000000 -i
 nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3

 reported here:

 http://article.gmane.org/gmane.comp.video.ffmpeg.user/42233

 http://nl.nrk.no/podkast/aps/10908/nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3

 {{{
 < -i nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3
 Starting program: d:\mingw\msys\1.0\ffmpeg-head-ccf771c\ffmpeg_g.exe
 -probesize
 1000000 -i nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3
 [New Thread 1976.0xc8]

 Program received signal SIGSEGV, Segmentation fault.
 0x0047a1d7 in av_probe_input_buffer (pb=0x462caa8, fmt=0x462c534,
     filename=0x462c4e1
 "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
     logctx=0x462c530, offset=0, max_probe_size=1000000)
     at libavformat/utils.c:459
 459             memset(pd.buf + pd.buf_size, 0, AVPROBE_PADDING_SIZE);
 (gdb) bt
 #0  0x0047a1d7 in av_probe_input_buffer (pb=0x462caa8, fmt=0x462c534,
     filename=0x462c4e1
 "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
     logctx=0x462c530, offset=0, max_probe_size=1000000)
     at libavformat/utils.c:459
 #1  0x00481c1c in init_input (options=0x22fad4,
     filename=0x462c4e1
 "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
     s=0x462c530) at libavformat/utils.c:508
 #2  avformat_open_input (ps=0x22fbe4,
     filename=0x462c4e1
 "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
     fmt=0x0, options=0x11e58ec) at libavformat/utils.c:562
 #3  0x004059a1 in opt_input_file (optctx=0x22fd48, opt=0x462c4df "i",
     filename=<optimized out>) at ffmpeg_opt.c:779
 #4  0x0041696c in parse_option (optctx=0x22fd48, opt=<optimized out>,
     arg=0x462c4e1 "nrk_radioresepsjonen_2012-1129-0325_6348979963.mp3",
     options=0xb00be0) at cmdutils.c:324
 #5  0x00416cee in parse_options (optctx=0x22fd48, argc=5,
     argv=<optimized out>, options=0xb00be0,
     parse_arg_function=0x406570 <opt_output_file>) at cmdutils.c:357
 #6  0x00a9433a in main (argc=5, argv=<optimized out>) at ffmpeg.c:3182
 (gdb)
 }}}

--

Comment:

 Regression since 57151f8 / 479fb7b.

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/1991#comment:1>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker