[FFmpeg-trac] #5557(undetermined:new): IFF ANIM: crash with fuzzed ANIM-J

[FFmpeg]

#5557: IFF ANIM: crash with fuzzed ANIM-J
-------------------------------------+-------------------------------------
             Reporter:  ami_stuff    |                    Owner:
                 Type:  defect       |                   Status:  new
             Priority:  normal       |                Component:
              Version:  unspecified  |  undetermined
             Keywords:               |               Resolution:
             Blocking:               |               Blocked By:
Analyzed by developer:  0            |  Reproduced by developer:  0
-------------------------------------+-------------------------------------

Comment (by ami_stuff):

 so I get the same backtrace with the git head

 maybe someone can test if this is reproducible on linux 32bit

 {{{
 (gdb) r -i '/media/sdb1/animj_ham6_fuzz.anim' -f null -
 Starting program: /media/sdb1/ffmpeg/ffmpeg_g -i
 '/media/sdb1/animj_ham6_fuzz.anim' -f null -
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
 ffmpeg version 3.0.git Copyright (c) 2000-2016 the FFmpeg developers
   built with gcc 5.3.0 (Ubuntu 5.3.0-3ubuntu1~14.04) 20151204
   configuration: --enable-debug --disable-ffprobe --disable-ffserver
   libavutil      55. 24.100 / 55. 24.100
   libavcodec     57. 41.102 / 57. 41.102
   libavformat    57. 36.100 / 57. 36.100
   libavdevice    57.  0.101 / 57.  0.101
   libavfilter     6. 45.100 /  6. 45.100
   libswscale      4.  1.100 /  4.  1.100
   libswresample   2.  0.101 /  2.  0.101
 Input #0, iff, from '/media/sdb1/animj_ham6_fuzz.anim':
   Duration: N/A, bitrate: N/A
     Stream #0:0: Video: iff_ilbm (ANIM / 0x4D494E41), rgb0, 160x100, SAR
 6:7 DAR 48:35, 30 fps, 60 tbr, 60 tbn
 [null @ 0x9803580] Using AVStream.codec to pass codec parameters to muxers
 is deprecated, use AVStream.codecpar instead.
 Output #0, null, to 'pipe:':
   Metadata:
     encoder         : Lavf57.36.100
     Stream #0:0: Video: wrapped_avframe, rgb0, 160x100 [SAR 6:7 DAR
 48:35], q=2-31, 200 kb/s, 60 fps, 60 tbn
     Metadata:
       encoder         : Lavc57.41.102 wrapped_avframe
 Stream mapping:
   Stream #0:0 -> #0:0 (iff_ilbm (iff) -> wrapped_avframe (native))
 Press [q] to stop, [?] for help
 decode_byterun ended before plane size
 *** Error in `/media/sdb1/ffmpeg/ffmpeg_g': double free or corruption
 (!prev): 0x09824200 ***

 Program received signal SIGABRT, Aborted.
 0xb7fdccb0 in ?? ()
 (gdb) bt
 #0  0xb7fdccb0 in ?? ()
 #1  0xb7dd233a in malloc_printerr (action=<optimized out>,
     str=0xb7ec4fd0 "double free or corruption (!prev)", ptr=0x9824200)
     at malloc.c:4996
 #2  0xb7dd2fad in _int_free (av=0xb7f09420 <main_arena>, p=<optimized
 out>,
     have_lock=0) at malloc.c:3840
 #3  0x082ef5c2 in read_from_packet_buffer (pkt=<optimized out>,
     pkt_buffer_end=<optimized out>, pkt_buffer=<optimized out>)
     at libavformat/utils.c:1436
 #4  av_read_frame (s=<optimized out>, pkt=0xbfffed34)
     at libavformat/utils.c:1688
 #5  0x080d059f in get_input_packet (f=f at entry=0x9803000,
     pkt=pkt at entry=0xbfffed34) at ffmpeg.c:3672
 #6  0x080bab97 in process_input (file_index=0) at ffmpeg.c:3792
 #7  transcode_step () at ffmpeg.c:4102
 #8  transcode () at ffmpeg.c:4156
 #9  main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:4349
 (gdb)
 }}}

--
Ticket URL: <https://trac.ffmpeg.org/ticket/5557#comment:3>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker