[FFmpeg-trac] #474(avcodec:new): SIG SEV in clear_blocks_sse in ff_h263_decode_mb

[FFmpeg]

#474: SIG SEV  in clear_blocks_sse in ff_h263_decode_mb
---------------------------------+-------------------------------------
             Reporter:  sgarcia  |                     Type:  defect
               Status:  new      |                 Priority:  important
            Component:  avcodec  |                  Version:  git
             Keywords:           |               Blocked By:
             Blocking:           |  Reproduced by developer:  0
Analyzed by developer:  0        |
---------------------------------+-------------------------------------
 Hi,

 I am using libavcodec in my mcu project and I am latelly getting some
 random seg faults.

 I have traced it down to be in clear_blocks_sse called by
 ff_h263_decode_mb.

 Here is the gdb info:

 (gdb) bt
 #0  0x00e7fb63 in clear_blocks_sse (blocks=0xb36202e0) at
 libavcodec/x86/dsputil_mmx.c:539
 #1  0x00c7d5e9 in ff_h263_decode_mb (s=0xb3600a60, block=0xb36202e0) at
 libavcodec/ituh263dec.c:634
 #2  0x00bcd9af in decode_slice (s=0xb3600a60) at libavcodec/h263dec.c:215
 #3  0x00bceb11 in ff_h263_decode_frame (avctx=0xb3600520, data=0xb3600940,
 data_size=0xb15fbc40, avpkt=0xb15fbbfc) at libavcodec/h263dec.c:671
 #4  0x00dea531 in avcodec_decode_video2 (avctx=0xb3600520,
 picture=0xb3600940, got_picture_ptr=0xb15fbc40, avpkt=0xb15fbbfc) at
 libavcodec/utils.c:769
 #5  0x080c493d in H263Decoder::DecodePacket (this=0xb36004c8,
 in=0xb15fbcc4 "", inLen=1393, lost=0, last=1) at
 /usr/local/src/mcu/media/src/h263/h263codec.cpp:476
 #6  0x08077852 in VideoStream::RecVideo (this=0xb6a2ad70) at
 /usr/local/src/mcu/media/src/videostream.cpp:668
 #7  0x08076b17 in VideoStream::startReceivingVideo (par=0xb6a2ad70) at
 /usr/local/src/mcu/media/src/videostream.cpp:190
 #8  0x001239e9 in start_thread () from /lib/libpthread.so.0
 #9  0x00662f3e in clone () from /lib/libc.so.6
 (gdb) list
 534         );
 535     }
 536
 537     static void clear_blocks_sse(DCTELEM *blocks)
 538     {\
 539         __asm__ volatile(
 540             "xorps  %%xmm0, %%xmm0  \n"
 541             "mov     %1, %%"REG_a"  \n"
 542             "1:                     \n"
 543             "movaps %%xmm0,    (%0, %%"REG_a") \n"
 (gdb) print blocks
 $5 = (DCTELEM *) 0xb36202e0
 (gdb) print *blocks
 $6 = 0
 (gdb) up
 #1  0x00c7d5e9 in ff_h263_decode_mb (s=0xb3600a60, block=0xb36202e0) at
 libavcodec/ituh263dec.c:634
 634             s->dsp.clear_blocks(s->block[0]);
 (gdb) print *(s->blocks)
 $7 = {{0 <repeats 64 times>}, {0 <repeats 64 times>}, {0 <repeats 32
 times>, 41, 41, 41, 40, 40, 40, 39, 39, 41, 41, 41, 41, 40, 40, 40, 40,
 42, 41, 41, 41, 41, 40, 40,
     40, 42, 42, 41, 41, 41, 40, 40, 40}, {39, 40, 40, 41, 41, 40, 40, 39,
 39, 40, 40, 41, 41, 40, 40, 39, 39, 40, 40, 41, 41, 40, 40, 39, 40
 <repeats 16 times>, 41, 40,
     40, 39, 39, 40, 40, 41, 41, 40, 40, 39, 39, 40, 40, 41, 41, 40, 40,
 39, 39, 40, 40, 41}, {130, 133, 132, 127, 127, 132, 134, 132, 130, 132,
 131, 128, 128, 131, 132,
     130, 131, 130, 129, 127, 128, 129, 131, 131, 133, 129, 126, 125, 126,
 128, 131, 135, 132, 127, 124, 126, 128, 129, 132, 135, 129, 126, 126, 129,
 132, 132, 131, 131,
     129, 128, 129, 132, 134, 133, 130, 127, 132, 130, 130, 132, 134, 133,
 129, 125}, {132, 131, 131, 134, 134, 131, 131, 132, 132, 131, 132, 134,
 134, 132, 131, 132, 132,
     131, 132, 133, 133, 132, 131, 132, 131, 131, 132, 133, 133, 132, 131,
 131, 131, 132, 132, 133, 133, 132, 132, 131, 131, 132, 133, 132, 132, 133,
 132, 131, 130, 132,
     133, 132, 132, 133, 132, 130, 130, 133, 133, 132, 132, 133, 133, 130},
 {0 <repeats 64 times>}, {0 <repeats 64 times>}}
 (gdb) down
 #0  0x00e7fb63 in clear_blocks_sse (blocks=0xb36202e0) at
 libavcodec/x86/dsputil_mmx.c:539
 539         __asm__ volatile(


 Best regards
 Sergio

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/474>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker