[FFmpeg-trac] #8273(undetermined:new): Segmentation fault in avpriv_copy_bits at libavcodec/bitstream.c:86

[FFmpeg]

#8273: Segmentation fault in avpriv_copy_bits at libavcodec/bitstream.c:86
-------------------------------------+-------------------------------------
             Reporter:  Suhwan       |                     Type:  defect
               Status:  new          |                 Priority:  important
            Component:               |                  Version:  git-
  undetermined                       |  master
             Keywords:  SIGSEGV      |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 Summary of the bug:
 There is a Segmentation fault in avpriv_copy_bits at
 libavcodec/bitstream.c:86
 How to reproduce:
 {{{
 % ffmpeg_g -i $PoC -c copy tmp.loas

 ffmpeg version N-95382-g62f4722582 Copyright (c) 2000-2019 the FFmpeg
 developers
 built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
 }}}

 Here's log

 {{{
 Program received signal SIGSEGV, Segmentation fault.
 0x0000000001cb6126 in avpriv_copy_bits (pb=<optimized out>, src=<optimized
 out>, length=3) at libavcodec/bitstream.c:86
 86          put_bits(pb, bits, AV_RB16(src + 2 * words) >> (16 - bits));
 (gdb) bt
 #0  0x0000000001cb6126 in avpriv_copy_bits (pb=<optimized out>,
 src=<optimized out>, length=3) at libavcodec/bitstream.c:86
 #1  0x00000000015ee80f in latm_write_frame_header (s=<optimized out>,
 bs=<optimized out>) at libavformat/latmenc.c:128
 #2  latm_write_packet (s=<optimized out>, pkt=<optimized out>) at
 libavformat/latmenc.c:188
 #3  0x00000000017c7515 in write_packet (s=0x9132ec0, pkt=<optimized out>)
 at libavformat/mux.c:747
 #4  0x00000000017cded6 in av_interleaved_write_frame (s=<optimized out>,
 pkt=0x7fffffffc790) at libavformat/mux.c:1238
 #5  0x00000000004b5d9b in write_packet (of=<optimized out>,
 pkt=0x7fffffffc790, ost=<optimized out>, unqueue=<optimized out>) at
 fftools/ffmpeg.c:815
 #6  0x00000000004a3f21 in do_streamcopy (ist=<optimized out>,
 ost=<optimized out>, pkt=<optimized out>) at fftools/ffmpeg.c:2066
 #7  process_input_packet (ist=<optimized out>, pkt=<optimized out>,
 no_eof=<optimized out>) at fftools/ffmpeg.c:2736
 #8  0x00000000004bf0a0 in process_input (file_index=<optimized out>) at
 fftools/ffmpeg.c:4508
 #9  0x000000000048d59b in transcode_step () at fftools/ffmpeg.c:4628
 #10 transcode () at fftools/ffmpeg.c:4682
 #11 0x0000000000487d54 in main (argc=9, argv=<optimized out>) at
 fftools/ffmpeg.c:4884
 (gdb) disass $pc-32,$pc+32
 Dump of assembler code from 0x1cb6106 to 0x1cb6146:
    0x0000000001cb6106 <avpriv_copy_bits+2038>:  repnz add %rax,%rdx
    0x0000000001cb610a <avpriv_copy_bits+2042>:  setb   %bl
    0x0000000001cb610d <avpriv_copy_bits+2045>:  cmp    %rsi,%rdx
    0x0000000001cb6110 <avpriv_copy_bits+2048>:  setae  %cl
    0x0000000001cb6113 <avpriv_copy_bits+2051>:  test   %ebp,%ebp
    0x0000000001cb6115 <avpriv_copy_bits+2053>:  js     0x1cb6153
 <avpriv_copy_bits+2115>
    0x0000000001cb6117 <avpriv_copy_bits+2055>:  add    %rax,%r12
    0x0000000001cb611a <avpriv_copy_bits+2058>:  test   %cl,%cl
    0x0000000001cb611c <avpriv_copy_bits+2060>:  je     0x1cb615c
 <avpriv_copy_bits+2124>
    0x0000000001cb611e <avpriv_copy_bits+2062>:  and    $0xf,%ebp
    0x0000000001cb6121 <avpriv_copy_bits+2065>:  test   %r12,%r12
    0x0000000001cb6124 <avpriv_copy_bits+2068>:  je     0x1cb616e
 <avpriv_copy_bits+2142>
 => 0x0000000001cb6126 <avpriv_copy_bits+2070>:  movzwl (%r12),%eax
    0x0000000001cb612b <avpriv_copy_bits+2075>:  rol    $0x8,%ax
    0x0000000001cb612f <avpriv_copy_bits+2079>:  movzwl %ax,%edx
    0x0000000001cb6132 <avpriv_copy_bits+2082>:  mov    $0x10,%ecx
    0x0000000001cb6137 <avpriv_copy_bits+2087>:  sub    %ebp,%ecx
    0x0000000001cb6139 <avpriv_copy_bits+2089>:  shr    %cl,%edx
    0x0000000001cb613b <avpriv_copy_bits+2091>:  mov    %r15,%rdi
    0x0000000001cb613e <avpriv_copy_bits+2094>:  mov    %ebp,%esi
    0x0000000001cb6140 <avpriv_copy_bits+2096>:  add    $0x38,%rsp
    0x0000000001cb6144 <avpriv_copy_bits+2100>:  pop    %rbx
    0x0000000001cb6145 <avpriv_copy_bits+2101>:  pop    %r12
 End of assembler dump.

 }}}
 Please confirm.
 Thanks

--
Ticket URL: <https://trac.ffmpeg.org/ticket/8273>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker