ffmpeg freezes and eats 100% CPU while encoding aac with too low bitrate

[divan]

Summary of the bug:
Trying to convert images+wav file into the 3gp video, ffmpeg freezes and eats 100% CPU. With some *.wav files it works correctly, but some causes this problem.
Latest git HEAD, 1.0 version are affected. Earlier versions process these files correctly.

How to reproduce:

% ./ffmpeg -v 9 -loglevel 99 -i ./audio.wav -f image2 -r 2 -i ./picture%d.jpg -acodec aac -ac 1 -ar 11025 -ab 64k -vcodec h263 -s qcif -r 2 -fs 307200 -strict -2 -y .pictures.3gp

ffmpeg version 1.1.git-d11ac64 Copyright (c) 2000-2013 the FFmpeg developers
  built on Feb  6 2012 16:30:17 with gcc 4.1.2 (GCC) 20080704 (Red Hat 4.1.2-44)
  configuration: --enable-static --extra-libs=-static --extra-cflags=--static --enable-libvpx
  libavutil      52. 17.101 / 52. 17.101
  libavcodec     54. 91.101 / 54. 91.101
  libavformat    54. 61.104 / 54. 61.104
  libavdevice    54.  3.103 / 54.  3.103
  libavfilter     3. 35.101 /  3. 35.101
  libswscale      2.  2.100 /  2.  2.100
  libswresample   0. 17.102 /  0. 17.102

Full log attached.

If run the above command in gdb with ffmpeg_g and interrupt, backtrace shows that it freezes somewhere in aac_encode_frame function. Full bt:

rogram received signal SIGINT, Interrupt.
quantize_and_encode_band_cost_ESC (s=0x9183d40, pb=0x9183d4c, in=0xb7f7b330, scaled=0x0, size=20, 
    scale_idx=216, cb=11, lambda=1.40129846e-45, uplim=92, bits=0x0) at libavcodec/aaccoder.c:172
172	                    curbits++;
(gdb) bt
#0  quantize_and_encode_band_cost_ESC (s=0x9183d40, pb=0x9183d4c, in=0xb7f7b330, scaled=0x0, size=20, 
    scale_idx=216, cb=11, lambda=1.40129846e-45, uplim=92, bits=0x0) at libavcodec/aaccoder.c:172
#1  0x087137d9 in quantize_and_encode_band (s=0x9183d40, pb=0x9183d4c, in=0xb7f7b330, size=20, 
    scale_idx=216, cb=11, lambda=1.40129846e-45) at libavcodec/aaccoder.c:270
#2  0x086658d4 in aac_encode_frame (avctx=0x915ffa0, avpkt=0xbfc2654c, frame=0x91d5fa0, 
    got_packet_ptr=0xbfc26690) at libavcodec/aacenc.c:430
#3  0x0855061b in avcodec_encode_audio2 (avctx=0x915ffa0, avpkt=0xbfc2654c, frame=0x91d5fa0, 
    got_packet_ptr=0xbfc26690) at libavcodec/utils.c:1227
#4  0x08058e11 in reap_filters () at ffmpeg.c:640
#5  0x08059861 in transcode_step () at ffmpeg.c:2991
#6  0x0805c74b in transcode () at ffmpeg.c:3034
#7  0x0805d6db in main (argc=Cannot access memory at address 0x8
) at ffmpeg.c:3209

[divan]

JPEGs and WAV for bug reproducing

[divan]

ffmpeg output log

[divan]

ffmpeg output log

[cehoyos]

Regression since 72dabdf

$ /ffmpeg -i audio.wav -ar 11025 -ab 32k -strict -2 -y out.aac
ffmpeg version N-49671-g199683c Copyright (c) 2000-2013 the FFmpeg developers
  built on Feb  7 2013 12:02:55 with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl
  libavutil      52. 17.101 / 52. 17.101
  libavcodec     54. 91.101 / 54. 91.101
  libavformat    54. 61.104 / 54. 61.104
  libavdevice    54.  3.103 / 54.  3.103
  libavfilter     3. 35.101 /  3. 35.101
  libswscale      2.  2.100 /  2.  2.100
  libswresample   0. 17.102 /  0. 17.102
  libpostproc    52.  2.100 / 52.  2.100
Guessed Channel Layout for  Input Stream #0.0 : mono
Input #0, wav, from 'audio.wav':
  Duration: 00:00:03.05, bitrate: 132 kb/s
    Stream #0:0: Audio: pcm_s16le ([1][0][0][0] / 0x0001), 8000 Hz, mono, s16, 128 kb/s
Output #0, adts, to 'out.aac':
  Metadata:
    encoder         : Lavf54.61.104
    Stream #0:0: Audio: aac, 11025 Hz, mono, fltp, 32 kb/s
Stream mapping:
  Stream #0:0 -> #0:0 (pcm_s16le -> aac)
Press [q] to stop, [?] for help

[cehoyos]

Fixed by Michael.