[FFmpeg-trac] #2727(avcodec:open): rv9 crash with low mem

[FFmpeg]

#2727: rv9 crash with low mem
---------------------------------------+-----------------------------------
             Reporter:  ami_stuff      |                    Owner:
                 Type:  defect         |                   Status:  open
             Priority:  important      |                Component:  avcodec
              Version:  git-master     |               Resolution:
             Keywords:  crash SIGSEGV  |               Blocked By:
             Blocking:                 |  Reproduced by developer:  1
Analyzed by developer:  0              |
---------------------------------------+-----------------------------------
Changes (by cehoyos):

 * status:  new => open
 * reproduced:  0 => 1
 * component:  undetermined => avcodec
 * priority:  normal => important
 * version:  unspecified => git-master
 * keywords:   => crash SIGSEGV


Comment:

 http://thread.gmane.org/gmane.comp.video.ffmpeg.devel/165332/focus=165366
 {{{
 (gdb) r -max_alloc 50000 -i rv9.rm
 Starting program: ffmpeg_g -max_alloc 50000 -i rv9.rm
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib64/libthread_db.so.1".
 ffmpeg version N-54249-gfc736a9 Copyright (c) 2000-2013 the FFmpeg
 developers
   built on Jun 29 2013 12:22:00 with gcc 4.7 (SUSE Linux)
   configuration:
   libavutil      52. 37.101 / 52. 37.101
   libavcodec     55. 17.100 / 55. 17.100
   libavformat    55. 10.100 / 55. 10.100
   libavdevice    55.  2.100 / 55.  2.100
   libavfilter     3. 77.101 /  3. 77.101
   libswscale      2.  3.100 /  2.  3.100
   libswresample   0. 17.102 /  0. 17.102
 [rm @ 0x1623060] Invalid stream index 2 for index at pos 850403
 [rv40 @ 0x1623e60] Cannot allocate memory.

 Program received signal SIGSEGV, Segmentation fault.
 ff_MPV_frame_start (s=s at entry=0x1633860, avctx=0x1623e60) at
 libavcodec/mpegvideo.c:1513
 1513                    &s->picture[i] != s->next_picture_ptr &&
 (gdb) bt
 #0  ff_MPV_frame_start (s=s at entry=0x1633860, avctx=0x1623e60) at
 libavcodec/mpegvideo.c:1513
 #1  0x0000000000924a11 in ff_rv34_decode_frame (avctx=0x1623e60,
 data=0x1628920,
     got_picture_ptr=0x7fffffffd16c, avpkt=0x7fffffffd0c0) at
 libavcodec/rv34.c:1696
 #2  0x0000000000998a8b in avcodec_decode_video2 (avctx=0x1623e60,
 picture=0x1628920,
     got_picture_ptr=got_picture_ptr at entry=0x7fffffffd16c,
 avpkt=avpkt at entry=0x7fffffffd1a0)
     at libavcodec/utils.c:1947
 #3  0x000000000058f20c in try_decode_frame (st=st at entry=0x1623b80,
     avpkt=avpkt at entry=0x1628860, options=0x1626f60) at
 libavformat/utils.c:2447
 #4  0x0000000000596c90 in avformat_find_stream_info (ic=0x1623060,
 options=0x1626f60)
     at libavformat/utils.c:2880
 #5  0x0000000000462289 in open_input_file (o=o at entry=0x7fffffffd750,
 filename=<optimized out>)
     at ffmpeg_opt.c:814
 #6  0x000000000045cd82 in open_files (inout=<optimized out>,
 inout at entry=0xc08adf "input",
     open_file=open_file at entry=0x461ee0 <open_input_file>, l=<optimized
 out>,
     l=<optimized out>) at ffmpeg_opt.c:2483
 #7  0x0000000000463619 in ffmpeg_parse_options (argc=argc at entry=5,
     argv=argv at entry=0x7fffffffdde8) at ffmpeg_opt.c:2520
 #8  0x000000000045a8c8 in main (argc=5, argv=0x7fffffffdde8) at
 ffmpeg.c:3368
 (gdb) print s->picture
 $2 = (Picture *) 0x0
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/2727#comment:1>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker