[FFmpeg-trac] #3115(avcodec:open): hevc: crash with threads 1 (fuzzed file)

[FFmpeg]

#3115: hevc: crash with threads 1 (fuzzed file)
------------------------------------+-----------------------------------
             Reporter:  ami_stuff   |                    Owner:
                 Type:  defect      |                   Status:  open
             Priority:  important   |                Component:  avcodec
              Version:  git-master  |               Resolution:
             Keywords:  hevc crash  |               Blocked By:
             Blocking:              |  Reproduced by developer:  1
Analyzed by developer:  0           |
------------------------------------+-----------------------------------

Comment (by cehoyos):

 {{{
 (gdb) r -threads 1 -i fahevc2.ts -f null -
 ffmpeg version N-58263-g1f7b7d5 Copyright (c) 2000-2013 the FFmpeg
 developers
   built on Nov 19 2013 11:36:45 with gcc 4.7 (SUSE Linux)
   configuration: --disable-optimizations --disable-asm --enable-debug=3
   libavutil      52. 53.100 / 52. 53.100
   libavcodec     55. 43.101 / 55. 43.101
   libavformat    55. 21.100 / 55. 21.100
   libavdevice    55.  5.100 / 55.  5.100
   libavfilter     3. 91.100 /  3. 91.100
   libswscale      2.  5.101 /  2.  5.101
   libswresample   0. 17.104 /  0. 17.104

 ...

 *** glibc detected *** ffmpeg_g: corrupted double-linked list:
 0x0000000002d6a680 ***

 ...

 (gdb) bt
 #0  0x00007ffff6104c0b in __lll_lock_wait_private () from /lib64/libc.so.6
 #1  0x00007ffff6092b5e in _L_lock_11285 () from /lib64/libc.so.6
 #2  0x00007ffff6090c22 in malloc () from /lib64/libc.so.6
 #3  0x00007ffff7de01d2 in local_strdup () from /lib64/ld-linux-x86-64.so.2
 #4  0x00007ffff7de33c7 in _dl_map_object () from /lib64/ld-
 linux-x86-64.so.2
 #5  0x00007ffff7ded81e in dl_open_worker () from /lib64/ld-
 linux-x86-64.so.2
 #6  0x00007ffff7de95f6 in _dl_catch_error () from /lib64/ld-
 linux-x86-64.so.2
 #7  0x00007ffff7ded28c in _dl_open () from /lib64/ld-linux-x86-64.so.2
 #8  0x00007ffff612e332 in do_dlopen () from /lib64/libc.so.6
 #9  0x00007ffff7de95f6 in _dl_catch_error () from /lib64/ld-
 linux-x86-64.so.2
 #10 0x00007ffff612e3cf in dlerror_run () from /lib64/libc.so.6
 #11 0x00007ffff612e441 in __libc_dlopen_mode () from /lib64/libc.so.6
 #12 0x00007ffff6109ed5 in init () from /lib64/libc.so.6
 #13 0x00007ffff6ce9c80 in pthread_once () from /lib64/libpthread.so.0
 #14 0x00007ffff6109ff4 in backtrace () from /lib64/libc.so.6
 #15 0x00007ffff6086fe5 in __libc_message () from /lib64/libc.so.6
 #16 0x00007ffff608cb66 in malloc_printerr () from /lib64/libc.so.6
 #17 0x00007ffff608edcc in _int_malloc () from /lib64/libc.so.6
 #18 0x00007ffff6090c30 in malloc () from /lib64/libc.so.6
 #19 0x00007ffff609261c in posix_memalign () from /lib64/libc.so.6
 #20 0x0000000000de95ba in av_malloc (size=1200) at libavutil/mem.c:94
 #21 0x000000000088d73b in av_malloc_array (nmemb=300, size=4) at
 ./libavutil/mem.h:97
 #22 0x0000000000892408 in ff_hevc_decode_nal_pps (s=0x19b75a0) at
 libavcodec/hevc_ps.c:1238
 #23 0x000000000088ce09 in parse_nal_units (s=0x19a4000, avctx=0x1932500,
     buf=0x19270c0 "D\001\300b\006\002\222", buf_size=8778) at
 libavcodec/hevc_parser.c:146
 #24 0x000000000088d4a0 in hevc_parse (s=0x19a4000, avctx=0x1932500,
 poutbuf=0x7fffffffd3b8,
     poutbuf_size=0x7fffffffd3c0, buf=0x1927080 "", buf_size=8778)
     at libavcodec/hevc_parser.c:279
 #25 0x00000000009e4cf1 in av_parser_parse2 (s=0x19a4000, avctx=0x1932500,
     poutbuf=0x7fffffffd3b8, poutbuf_size=0x7fffffffd3c0, buf=0x2f2e900 "",
 buf_size=4119,
     pts=499065, dts=495465, pos=920636) at libavcodec/parser.c:155
 #26 0x00000000005b74b3 in parse_packet (s=0x192e7e0, pkt=0x7fffffffd470,
 stream_index=0)
     at libavformat/utils.c:1206
 #27 0x00000000005b7f87 in read_frame_internal (s=0x192e7e0,
 pkt=0x7fffffffd7a0)
     at libavformat/utils.c:1384
 #28 0x00000000005b8265 in av_read_frame (s=0x192e7e0, pkt=0x7fffffffd7a0)
     at libavformat/utils.c:1425
 #29 0x000000000041e5e5 in get_input_packet (f=0x1b36b20,
 pkt=0x7fffffffd7a0) at ffmpeg.c:2919
 #30 0x000000000041e700 in process_input (file_index=0) at ffmpeg.c:2956
 #31 0x000000000041fe8d in transcode_step () at ffmpeg.c:3226
 #32 0x000000000041ff9a in transcode () at ffmpeg.c:3278
 #33 0x00000000004204ae in main (argc=8, argv=0x7fffffffdd48) at
 ffmpeg.c:3456
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/3115#comment:4>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker