#839: crash with png (gray) to snow (gray) conversion -------------------------------------+------------------------------------- Reporter: ami_stuff | Type: defect Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- https://ffmpeg.org/trac/ffmpeg/attachment/ticket/833/gray.png {{{ (gdb) r -i gray.png -vcodec snow -strict -2 out.avi Starting program: F:\MinGW\msys\1.0\ffmpeg-HEAD-834f80d/ffmpeg_g.exe -i gray.png -vcodec snow -strict -2 out.avi [New Thread 3404.0xf18] ffmpeg version 0.9.0.git-834f80d, Copyright (c) 2000-2011 the FFmpeg developers built on Dec 22 2011 14:07:40 with gcc 4.5.2 configuration: --disable-ffplay --disable-ffserver --disable-asm --disable-yas m --disable-shared --enable-static libavutil 51. 32.100 / 51. 32.100 libavcodec 53. 47.100 / 53. 47.100 libavformat 53. 28.100 / 53. 28.100 libavdevice 53. 4.100 / 53. 4.100 libavfilter 2. 53. 0 / 2. 53. 0 libswscale 2. 1.100 / 2. 1.100 libswresample 0. 5.100 / 0. 0.100 Input #0, image2, from 'gray.png': Duration: 00:00:00.04, start: 0.000000, bitrate: N/A Stream #0:0: Video: png, gray, 1024x768, 25 tbr, 25 tbn, 25 tbc [buffer @ 03d61640] w:1024 h:768 pixfmt:gray tb:1/1000000 sar:0/1 sws_param: Output #0, avi, to 'out.avi': Metadata: ISFT : Lavf53.28.100 Stream #0:0: Video: snow (SNOW / 0x574F4E53), gray, 1024x768, q=2-31, 200 kb /s, 25 tbn, 25 tbc Stream mapping: Stream #0:0 -> #0:0 (png -> snow) Press [q] to stop, [?] for help Program received signal SIGSEGV, Segmentation fault. 0x0080e15f in encode_frame (avctx=0x3d5f8b8, buf=0x4a10020 "", buf_size=5515024, data=0x22daf0) at libavcodec/snowenc.c:1619 1619 memcpy(&s->input_picture.data[i][y * s->input_picture.linesi ze[i]], (gdb) bt #0 0x0080e15f in encode_frame (avctx=0x3d5f8b8, buf=0x4a10020 "", buf_size=5515024, data=0x22daf0) at libavcodec/snowenc.c:1619 #1 0x00509101 in avcodec_encode_video (avctx=0x3d5f8b8, buf=0x4a10020 "", buf_size=5515024, pict=0x22daf0) at libavcodec/utils.c:881 #2 0x00404f6e in do_video_out (s=0x3d5f3b0, ost=0x3d5fcd0, in_picture=0x3d62220, frame_size=0x22de9c, quality=0, ist=<value optimized out>) at ffmpeg.c:1349 #3 0x004068c5 in transcode_video (ist=0x3d611d0, ost_table=0x3d5fcd0, nb_ostreams=1, pkt=0x22fbb8) at ffmpeg.c:1955 #4 output_packet (ist=0x3d611d0, ost_table=0x3d5fcd0, nb_ostreams=1, pkt=0x22fbb8) at ffmpeg.c:2046 #5 0x0040a63e in transcode (output_files=<value optimized out>, nb_output_files=0, input_files=0x0, nb_input_files=4256952) at ffmpeg.c:2804 #6 0x0022ff48 in ?? () #7 0x00000000 in ?? () (gdb) disass $pc-32,$pc+32 Dump of assembler code from 0x80e13f to 0x80e17f: 0x0080e13f <encode_frame+187>: add %al,(%eax) 0x0080e141 <encode_frame+189>: add 0x1040(%esi,%eax,4),%edx 0x0080e148 <encode_frame+196>: mov %ebx,%esi 0x0080e14a <encode_frame+198>: mov 0xa0(%esp),%edi 0x0080e151 <encode_frame+205>: imul 0x10(%edi,%eax,4),%esi 0x0080e156 <encode_frame+210>: add (%edi,%eax,4),%esi 0x0080e159 <encode_frame+213>: mov %edx,%edi 0x0080e15b <encode_frame+215>: mov 0x50(%esp),%ecx => 0x0080e15f <encode_frame+219>: rep movsb %ds:(%esi),%es:(%edi) 0x0080e161 <encode_frame+221>: inc %ebx 0x0080e162 <encode_frame+222>: cmp 0x54(%esp),%ebx 0x0080e166 <encode_frame+226>: jl 0x80e133 <encode_frame+175> 0x0080e168 <encode_frame+228>: inc %eax 0x0080e169 <encode_frame+229>: cmp $0x3,%eax 0x0080e16c <encode_frame+232>: jne 0x80e116 <encode_frame+146> 0x0080e16e <encode_frame+234>: mov 0x6c(%esp),%edi 0x0080e172 <encode_frame+238>: add $0xf20,%edi 0x0080e178 <encode_frame+244>: mov $0x48,%ecx 0x0080e17d <encode_frame+249>: mov 0xa0(%esp),%esi End of assembler dump. (gdb) info all-registers eax 0x1 1 ecx 0x200 512 edx 0x0 0 ebx 0x0 0 esp 0x22c860 0x22c860 ebp 0x400 0x400 esi 0x0 0 edi 0x0 0 eip 0x80e15f 0x80e15f <encode_frame+219> eflags 0x10246 [ PF ZF IF RF ] cs 0x1b 27 ss 0x23 35 ds 0x23 35 es 0x23 35 fs 0x3b 59 gs 0x0 0 st0 0 (raw 0x00000000000000000000) st1 0 (raw 0x00000000000000000000) st2 0 (raw 0x00000000000000000000) st3 -2147483648 (raw 0xc01e8000000000000000) st4 -1.1000000000000001 (raw 0xbfff8ccccccccccccccd) st5 0 (raw 0x00000000000000000000) st6 0.59999999999999998 (raw 0x3ffe999999999999999a) st7 0 (raw 0x00000000000000000000) fctrl 0xffff037f -64641 fstat 0xffff0120 -65248 ftag 0xffffffff -1 fiseg 0x0 0 fioff 0x0 0 foseg 0xffff0000 -65536 fooff 0x0 0 fop 0x0 0 xmm0 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm1 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm2 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm3 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm4 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm5 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm6 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} xmm7 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000} mxcsr 0x1f80 [ IM DM ZM OM UM PM ] mm0 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}} mm1 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}} mm2 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}} mm3 {uint64 = 0x8000000000000000, v2_int32 = {0x0, 0x80000000}, v4_int16 = {0x0, 0x0, 0x0, 0x8000}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}} mm4 {uint64 = 0x8ccccccccccccccd, v2_int32 = {0xcccccccd, 0x8ccccccc}, v4_int16 = {0xcccd, 0xcccc, 0xcccc, 0x8ccc}, v8_int8 = { 0xcd, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x8c}} mm5 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}} mm6 {uint64 = 0x999999999999999a, v2_int32 = {0x9999999a, 0x99999999}, v4_int16 = {0x999a, 0x9999, 0x9999, 0x9999}, v8_int8 = { 0x9a, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99}} mm7 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}} }}} -- Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/839> FFmpeg <http://ffmpeg.org> FFmpeg issue tracker