[FFmpeg-devel] [PATCH 2/2] avcodec/speexdec: fix setting frame_size from extradata

[Michael Niedermayer]

On Fri, Jan 19, 2024 at 10:47:30PM -0300, James Almer wrote:
> Finishes fixing vp5/potter512-400-partial.avi
> 
> The fate-matroska-ms-mode test ref is updated to reflect that the Speex decoder
> can now read the stream.
> 
> Signed-off-by: James Almer <jamrial at gmail.com>
> ---
>  libavcodec/speexdec.c           | 4 +---
>  tests/ref/fate/matroska-ms-mode | 2 +-
>  2 files changed, 2 insertions(+), 4 deletions(-)

Theres plenty of code remaining after this change that assumes NB_FRAME_SIZE
are available and writes that also.

There was a testcase reporrted that causes this and many others
ill forward the testcase.

==18747== Invalid write of size 4
==18747==    at 0xD1CFC3: sb_decode (speexdec.c:1260)
==18747==    by 0xD1E5CE: speex_decode_frame (speexdec.c:1557)
==18747==    by 0x998846: decode_simple_internal (decode.c:430)
==18747==    by 0x998DD7: decode_simple_receive_frame (decode.c:609)
==18747==    by 0x998F47: decode_receive_frame_internal (decode.c:637)
==18747==    by 0x99930C: avcodec_send_packet (decode.c:734)
==18747==    by 0x669D2F: try_decode_frame (demux.c:2126)
==18747==    by 0x66CAA0: avformat_find_stream_info (demux.c:2809)
==18747==    by 0x24E9C2: ifile_open (ffmpeg_demux.c:1663)
==18747==    by 0x2755BE: open_files (ffmpeg_opt.c:1333)
==18747==    by 0x275780: ffmpeg_parse_options (ffmpeg_opt.c:1373)
==18747==    by 0x289702: main (ffmpeg.c:1032)
==18747==  Address 0x16a170c0 is 0 bytes after a block of size 1,536 alloc'd
==18747==    at 0x4C33E76: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==18747==    by 0x4C33F91: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==18747==    by 0x13E3FE6: av_malloc (mem.c:105)
==18747==    by 0x13BFBFD: av_buffer_alloc (buffer.c:82)
==18747==    by 0x13C0645: pool_alloc_buffer (buffer.c:362)
==18747==    by 0x13C07C6: av_buffer_pool_get (buffer.c:401)
==18747==    by 0xA46052: audio_get_buffer (get_buffer.c:203)
==18747==    by 0xA4648D: avcodec_default_get_buffer2 (get_buffer.c:278)
==18747==    by 0x99B967: ff_get_buffer (decode.c:1673)
==18747==    by 0xD1E52E: speex_decode_frame (speexdec.c:1552)
==18747==    by 0x998846: decode_simple_internal (decode.c:430)
==18747==    by 0x998DD7: decode_simple_receive_frame (decode.c:609)
==18747==    by 0x998F47: decode_receive_frame_internal (decode.c:637)
==18747==    by 0x99930C: avcodec_send_packet (decode.c:734)
==18747==    by 0x669D2F: try_decode_frame (demux.c:2126)
==18747==    by 0x66CAA0: avformat_find_stream_info (demux.c:2809)
==18747==    by 0x24E9C2: ifile_open (ffmpeg_demux.c:1663)
==18747==    by 0x2755BE: open_files (ffmpeg_opt.c:1333)
==18747==    by 0x275780: ffmpeg_parse_options (ffmpeg_opt.c:1373)
==18747==    by 0x289702: main (ffmpeg.c:1032)

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240216/26aa19de/attachment.sig>