[FFmpeg-trac] #2140(avfilter:reopened): null ptr deref due to vf_mp not setting pseudo palette

FFmpeg trac at avcodec.org
Sun Feb 10 12:10:53 CET 2013


#2140: null ptr deref due to vf_mp not setting pseudo palette
-------------------------------------+-------------------------------------
             Reporter:  cehoyos      |                    Owner:
                 Type:  defect       |                   Status:  reopened
             Priority:  important    |                Component:  avfilter
              Version:  git-master   |               Resolution:
             Keywords:  crash        |               Blocked By:
  SIGSEGV mp                         |  Reproduced by developer:  0
             Blocking:               |
Analyzed by developer:  1            |
-------------------------------------+-------------------------------------

Comment (by cehoyos):

 The mp=il filter was ported and removed by Paul B Mahol, the crash is
 still reproducible with mp=fspp.
 $ ffmpeg -i tests/lena.pnm -pix_fmt gray gray.png
 {{{
 (gdb) r -i gray.png -vf mp=fspp -f null -
 Starting program: ffmpeg_g -i gray.png -vf mp=fspp -f null -
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib64/libthread_db.so.1".
 ffmpeg version 1.1 Copyright (c) 2000-2013 the FFmpeg developers
   built on Feb 10 2013 11:46:21 with gcc 4.7 (SUSE Linux)
   configuration: --enable-gpl
   libavutil      52. 13.100 / 52. 13.100
   libavcodec     54. 86.100 / 54. 86.100
   libavformat    54. 59.106 / 54. 59.106
   libavdevice    54.  3.102 / 54.  3.102
   libavfilter     3. 32.100 /  3. 32.100
   libswscale      2.  1.103 /  2.  1.103
   libswresample   0. 17.102 /  0. 17.102
   libpostproc    52.  2.100 / 52.  2.100
 Input #0, image2, from 'gray.png':
   Duration: 00:00:00.04, start: 0.000000, bitrate: N/A
     Stream #0:0: Video: png, gray, 256x256, 25 tbr, 25 tbn, 25 tbc
 [Parsed_mp_0 @ 0x15de480] 'fspp' is a wrapped MPlayer filter
 (libmpcodecs). This filter may be removed
 once it has been ported to a native libavfilter.
 Output #0, null, to 'pipe:':
   Metadata:
     encoder         : Lavf54.59.106
     Stream #0:0: Video: rawvideo (Y800 / 0x30303859), gray, 256x256,
 q=2-31, 200 kb/s, 90k tbn, 25 tbc
 Stream mapping:
   Stream #0:0 -> #0:0 (png -> rawvideo)
 Press [q] to stop, [?] for help

 Program received signal SIGSEGV, Segmentation fault.
 0x0000000000bb8d60 in av_image_copy (dst_data=dst_data at entry=0x15dffc8,
     dst_linesizes=dst_linesizes at entry=0x15e0010,
     src_data=src_data at entry=0x15df708,
     src_linesizes=src_linesizes at entry=0x15df750, pix_fmt=AV_PIX_FMT_GRAY8,
     width=256, height=256) at libavutil/imgutils.c:272
 272             memcpy(dst_data[1], src_data[1], 4*256);
 (gdb) bt
 #0  0x0000000000bb8d60 in av_image_copy
 (dst_data=dst_data at entry=0x15dffc8,
     dst_linesizes=dst_linesizes at entry=0x15e0010,
     src_data=src_data at entry=0x15df708,
     src_linesizes=src_linesizes at entry=0x15df750, pix_fmt=AV_PIX_FMT_GRAY8,
     width=256, height=256) at libavutil/imgutils.c:272
 #1  0x00000000004713e6 in ff_filter_frame_framed
 (link=link at entry=0x15ded20,
     frame=frame at entry=0x15df700) at libavfilter/avfilter.c:693
 #2  0x00000000004731ab in ff_filter_frame (link=link at entry=0x15ded20,
     frame=frame at entry=0x15df700) at libavfilter/avfilter.c:791
 #3  0x000000000048bcac in ff_vf_next_put_image (vf=0x15de5a0,
 mpi=0x15df880, pts=0)
     at libavfilter/vf_mp.c:588
 #4  0x000000000048b952 in filter_frame (inlink=0x15dfcc0, inpic=0x15dfac0)
     at libavfilter/vf_mp.c:824
 #5  0x0000000000471555 in ff_filter_frame_framed
 (link=link at entry=0x15dfcc0,
     frame=frame at entry=0x15dfac0) at libavfilter/avfilter.c:719
 #6  0x00000000004731ab in ff_filter_frame (link=link at entry=0x15dfcc0,
     frame=0x15dfac0) at libavfilter/avfilter.c:791
 #7  0x0000000000475f02 in request_frame (link=0x15dfcc0)
     at libavfilter/buffersrc.c:372
 #8  0x0000000000476334 in av_buffersrc_add_ref (s=0x15b9480, buf=0x0,
     flags=flags at entry=7) at libavfilter/buffersrc.c:150
 #9  0x000000000045eafd in decode_video (ist=ist at entry=0x15d7540,
     pkt=pkt at entry=0x7fffffffdaf0,
 got_output=got_output at entry=0x7fffffffd88c)
     at ffmpeg.c:1672
 #10 0x0000000000461b0f in output_packet (pkt=0x7fffffffda90,
 ist=0x15d7540)
     at ffmpeg.c:1792
 #11 process_input (file_index=<optimized out>) at ffmpeg.c:2886
 #12 0x00000000004521e0 in transcode_step () at ffmpeg.c:2982
 #13 transcode () at ffmpeg.c:3034
 #14 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3209
 (gdb) disass $pc-32,$pc+32
 Dump of assembler code from 0xbb8d40 to 0xbb8d80:
    0x0000000000bb8d40 <av_image_copy+848>:      add    %al,(%rax)
    0x0000000000bb8d42 <av_image_copy+850>:      add    %al,-0xa(%rax)
    0x0000000000bb8d45 <av_image_copy+853>:      movl   $0x10d850f,(%rdx)
    0x0000000000bb8d4b <av_image_copy+859>:      add    %al,(%rax)
    0x0000000000bb8d4d <av_image_copy+861>:      test   $0x4,%dil
    0x0000000000bb8d51 <av_image_copy+865>:      jne    0xbb8e46
 <av_image_copy+1110>
    0x0000000000bb8d57 <av_image_copy+871>:      mov    %eax,%ecx
    0x0000000000bb8d59 <av_image_copy+873>:      xor    %edx,%edx
    0x0000000000bb8d5b <av_image_copy+875>:      shr    $0x3,%ecx
    0x0000000000bb8d5e <av_image_copy+878>:      test   $0x4,%al
 => 0x0000000000bb8d60 <av_image_copy+880>:      rep movsq
 %ds:(%rsi),%es:(%rdi)
    0x0000000000bb8d63 <av_image_copy+883>:      je     0xbb8d6e
 <av_image_copy+894>
    0x0000000000bb8d65 <av_image_copy+885>:      mov    (%rsi),%edx
    0x0000000000bb8d67 <av_image_copy+887>:      mov    %edx,(%rdi)
    0x0000000000bb8d69 <av_image_copy+889>:      mov    $0x4,%edx
    0x0000000000bb8d6e <av_image_copy+894>:      test   $0x2,%al
    0x0000000000bb8d70 <av_image_copy+896>:      je     0xbb8d7e
 <av_image_copy+910>
    0x0000000000bb8d72 <av_image_copy+898>:      movzwl (%rsi,%rdx,1),%ecx
    0x0000000000bb8d76 <av_image_copy+902>:      mov    %cx,(%rdi,%rdx,1)
    0x0000000000bb8d7a <av_image_copy+906>:      add    $0x2,%rdx
    0x0000000000bb8d7e <av_image_copy+910>:      test   $0x1,%al
 End of assembler dump.
 (gdb) info register
 rax            0x400    1024
 rbx            0x100    256
 rcx            0x80     128
 rdx            0x0      0
 rsi            0x0      0
 rdi            0x1627080        23228544
 rbp            0x100    0x100
 rsp            0x7fffffffd2e0   0x7fffffffd2e0
 r8             0x1626f80        23228288
 r9             0xf0     240
 r10            0x0      0
 r11            0x7ffff668dd60   140737327455584
 r12            0x1616e20        23162400
 r13            0x1627080        23228544
 r14            0x0      0
 r15            0x100    256
 rip            0xbb8d60 0xbb8d60 <av_image_copy+880>
 eflags         0x10246  [ PF ZF IF RF ]
 cs             0x33     51
 ss             0x2b     43
 ds             0x0      0
 es             0x0      0
 fs             0x0      0
 gs             0x0      0
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/2140#comment:4>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker


More information about the FFmpeg-trac mailing list