Opened 8 years ago

Closed 8 years ago

#5394 closed defect (fixed)

assertion failed with fuzzed file (tta in mkv output)

Reported by: ami_stuff Owned by:
Priority: important Component: avcodec
Version: git-master Keywords: tta crash abort
Cc: Blocked By:
Blocking: Reproduced by developer: yes
Analyzed by developer: no

Description 

(gdb) r -i atrac3_fuzz.omg -acodec tta /home/aaa/out4.mkv
Starting program: /media/sdb1/ffmpeg/ffmpeg_g -i atrac3_fuzz.omg -acodec tta /home/aaa/out4.mkv
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
ffmpeg version 3.0.git Copyright (c) 2000-2016 the FFmpeg developers
  built with gcc 4.8 (Ubuntu 4.8.4-2ubuntu1~14.04.1)
  configuration: --disable-ffplay --disable-ffprobe --disable-ffserver --enable-gpl
  libavutil      55. 19.100 / 55. 19.100
  libavcodec     57. 28.103 / 57. 28.103
  libavformat    57. 28.102 / 57. 28.102
  libavdevice    57.  0.101 / 57.  0.101
  libavfilter     6. 39.102 /  6. 39.102
  libswscale      4.  0.100 /  4.  0.100
  libswresample   2.  0.101 /  2.  0.101
  libpostproc    54.  0.100 / 54.  0.100
[oma @ 0x9710200] Estimating duration from bitrate, this may be inaccurate
Input #0, oma, from 'atrac3_fuzz.omg':
  Metadata:
    TLEN            : 23423
  Duration: 00:00:23.45, start: 0.000000, bitrate: 105 kb/s
    Stream #0:0: Audio: atrac3, 44100 Hz, stereo, fltp, 104 kb/s
[New Thread 0xb7d94b40 (LWP 16929)]
[New Thread 0xb7593b40 (LWP 16930)]
[New Thread 0xb6d92b40 (LWP 16931)]
[New Thread 0xb6591b40 (LWP 16932)]
[New Thread 0xb5d90b40 (LWP 16933)]
Output #0, matroska, to '/home/aaa/out4.mkv':
  Metadata:
    TLEN            : 23423
    encoder         : Lavf57.28.102
    Stream #0:0: Audio: tta, 44100 Hz, stereo, s32 (24 bit), 128 kb/s
    Metadata:
      encoder         : Lavc57.28.103 tta
Stream mapping:
  Stream #0:0 -> #0:0 (atrac3 (native) -> tta (native))
Press [q] to stop, [?] for help
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Sound Unit id != 0x28.
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Frame decoding error!
Error while decoding stream #0:0: Invalid data found when processing input
Internal error, put_bits buffer too small
    Last message repeated 214 times
Assertion s->buf_ptr < s->buf_end failed at libavcodec/put_bits.h:108

Program received signal SIGABRT, Aborted.
0xb7fdccb0 in ?? ()
(gdb) bt
Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0x23:

Attachments (1)

atrac3_fuzz.omg​ (300.9 KB ) - added by ami_stuff 8 years ago.

Download all attachments as: .zip

Change History (3)

by ami_stuff, 8 years ago

Attachment: atrac3_fuzz.omg​ added

comment:1 by Carl Eugen Hoyos, 8 years ago

Component: undetermined → avcodec
Keywords: tta crash abort added
Priority: normal → important
Reproduced by developer: set
Status: new → open
Version: unspecified → git-master

comment:2 by Michael Niedermayer, 8 years ago

Resolution: → fixed
Status: open → closed

Fixed in 005c61c6b8982f977e415aa69d2d2b42e6b7f3f2

Note: See TracTickets for help on using tickets.