[FFmpeg-trac] #1834(swresample:new): swr_convert() results in integer division by zero exception

[FFmpeg]

#1834: swr_convert() results in integer division by zero exception
------------------------------------+--------------------------------------
             Reporter:  mbradshaw   |                    Owner:  michael
                 Type:  defect      |                   Status:  new
             Priority:  normal      |                Component:  swresample
              Version:  git-master  |               Resolution:
             Keywords:              |               Blocked By:
             Blocking:              |  Reproduced by developer:  0
Analyzed by developer:  0           |
------------------------------------+--------------------------------------

Comment (by mbradshaw):

 Replying to [comment:1 cehoyos]:
 > Replying to [ticket:1834 mbradshaw]:
 > > '''Summary of the bug:'''
 > > When I call `swr_convert()` I get an integer division by zero
 exception at 0x707c86ee. The disassembly around 0x707c86ee, should it
 help, is:
 >
 > The disassembly looks very odd, did you read
 http://ffmpeg.org/bugreports.html ?
 Heh, sorry, I forgot it was Intel syntax and not AT&T syntax. I've re-run
 the program (on OS X 10.6) with gdb and got the following:
 {{{
 Program received signal EXC_ARITHMETIC, Arithmetic exception.
 0x0000000100632ba8 in realloc_audio (a=0x10185f9d0, count=1024) at
 libswresample/swresample.c:359
 359         if(count < 0 || count > INT_MAX/2/a->bps/a->ch_count)
 }}}

 It looks like `a->bps` and `a->ch_count` are both zero.
 {{{
 (gdb) p *a
 $5 = {
   ch = {0x0 <repeats 32 times>},
   data = 0x0,
   ch_count = 0,
   bps = 0,
   count = 0,
   planar = 0,
   fmt = AV_SAMPLE_FMT_U8
 }
 }}}

 Backtrace is (I'm not entirely sure why it says there's only two
 frames...):
 {{{
 (gdb) bt
 #0  0x0000000100632ba8 in realloc_audio (a=0x10185f9d0, count=1024) at
 libswresample/swresample.c:359
 #1  0x00000001006334de in swr_convert_internal (s=0x400, out=0x10185fd30,
 out_count=0, in=0x0, in_count=25557456) at libswresample/swresample.c:535
 }}}

 I can post the disassembly of `realloc_audio` if needed, but I don't think
 that's necessary.
 [[BR]]
 [[BR]]

 > Is the FPE reproducible with ffmpeg (the application)? If not, do you
 know why?
 No (or at least I haven't found a way to trigger it). Doing ` ffmpeg -i
 TimeCode.mov -strict -2 -af "aconvert=s16:stereo" out.mp4` (or `mono`) did
 not result in any errors. I've no clue why my code gets the floating point
 exception but ffmpeg does not. `file` reports both my program and ffmpeg
 as "`Mach-O 64-bit executable x86_64`". However, I get this same crash on
 Windows 7 64-bit (using 32-bit ffmpeg in a 32-bit application).

 I probably should've added this: the video file info is:
 {{{
 $ ffmpeg -i TimeCode.mov
 ffmpeg version N-45342-g6efe1ed Copyright (c) 2000-2012 the FFmpeg
 developers
   built on Oct 13 2012 10:34:47 with gcc 4.2.1 (GCC) (Apple Inc. build
 5666) (dot 3)
   configuration: --enable-libopenjpeg --enable-libx264 --enable-gpl
   libavutil      51. 74.100 / 51. 74.100
   libavcodec     54. 65.100 / 54. 65.100
   libavformat    54. 32.100 / 54. 32.100
   libavdevice    54.  3.100 / 54.  3.100
   libavfilter     3. 19.102 /  3. 19.102
   libswscale      2.  1.101 /  2.  1.101
   libswresample   0. 16.100 /  0. 16.100
   libpostproc    52.  1.100 / 52.  1.100
 Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'TimeCode.mov':
   Metadata:
     major_brand     : qt
     minor_version   : 537199360
     compatible_brands: qt
     creation_time   : 2011-06-13 20:22:03
   Duration: 00:00:15.04, start: 0.038345, bitrate: 1173 kb/s
     Stream #0:0(eng): Audio: aac (mp4a / 0x6134706D), 44100 Hz, stereo,
 s16, 157 kb/s
     Metadata:
       creation_time   : 2011-06-13 20:22:03
       handler_name    : Apple Alias Data Handler
     Stream #0:1(eng): Video: h264 (Baseline) (avc1 / 0x31637661), yuv420p,
 852x480 [SAR 1:1 DAR 71:40], 1003 kb/s, 23.98 fps, 24 tbr, 600 tbn, 47.95
 tbc
     Metadata:
       creation_time   : 2011-06-13 20:22:03
       handler_name    : Apple Alias Data Handler
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/1834#comment:2>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker