Ticket #8149: gdb-integer-overflow

File gdb-integer-overflow, 12.9 KB (added by Suhwan, 7 years ago)
Line 
1GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
2Copyright (C) 2018 Free Software Foundation, Inc.
3License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
4This is free software: you are free to change and redistribute it.
5There is NO WARRANTY, to the extent permitted by law. Type "show copying"
6and "show warranty" for details.
7This GDB was configured as "x86_64-linux-gnu".
8Type "show configuration" for configuration details.
9For bug reporting instructions, please see:
10<http://www.gnu.org/software/gdb/bugs/>.
11Find the GDB manual and other documentation resources online at:
12<http://www.gnu.org/software/gdb/documentation/>.
13For help, type "help".
14Type "apropos word" to search for commands related to "word"...
15Reading symbols from ../ffmpeg/ffmpeg_g...done.
16(gdb) b avidec.c:1536
17Breakpoint 1 at 0x14170a4: file libavformat/avidec.c, line 1536.
18(gdb) r
19Starting program: ffmpeg_g -t 2 -stream_loop 14 -y -r 58 -i samples/samples.mplayerhq.hu/avi/\!AVI-demuxer-bugs/camcorder.avi -target dv -map 0 -vframes 91 -aframes 106 -r 16 -b:v 38k output/tmp.stl
20[Thread debugging using libthread_db enabled]
21Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
22ffmpeg version N-94906-gcb8d6a4e3e Copyright (c) 2000-2019 the FFmpeg developers
23 built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
24 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan
25 libavutil 56. 35.100 / 56. 35.100
26 libavcodec 58. 56.101 / 58. 56.101
27 libavformat 58. 32.104 / 58. 32.104
28 libavdevice 58. 9.100 / 58. 9.100
29 libavfilter 7. 58.102 / 7. 58.102
30 libswscale 5. 6.100 / 5. 6.100
31 libswresample 3. 6.100 / 3. 6.100
32
33Breakpoint 1, avi_read_packet (s=0x922d840, pkt=<optimized out>)
34 at libavformat/avidec.c:1536
351536 if (avi->dts_max - dts > 2*AV_TIME_BASE) {
36(gdb) n
37libavformat/avidec.c:1536:30: runtime error: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
381539 }else if (avi->dts_max < dts)
39(gdb) bt
40#0 avi_read_packet (s=0x922d840, pkt=<optimized out>) at libavformat/avidec.c:1539
41#1 0x00000000019d2131 in ff_read_packet (s=0x922d840, pkt=0x7fffffffd718)
42 at libavformat/utils.c:856
43#2 0x00000000019dc00f in read_frame_internal (s=0x922d840, pkt=0x7fffffffd978)
44 at libavformat/utils.c:1582
45#3 0x00000000019f2b52 in avformat_find_stream_info (ic=<optimized out>,
46 options=<optimized out>) at libavformat/utils.c:3786
47#4 0x0000000000431ffa in open_input_file (o=0x7fffffffdc28,
48 filename=0x7fffffffe5e4 "samples/samples.mplayerhq.hu/avi/!AVI-demuxer-bugs/camcorder.avi") at fftools/ffmpeg_opt.c:1126
49#5 0x000000000042fb4f in open_files (l=0x922d2d8, inout=0x5bfe384 "input",
50 open_file=0x430710 <open_input_file>) at fftools/ffmpeg_opt.c:3275
51#6 0x000000000042f840 in ffmpeg_parse_options (argc=<optimized out>,
52 argv=<optimized out>) at fftools/ffmpeg_opt.c:3315
53#7 0x0000000000489a24 in main (argc=23, argv=0x7fffffffe268)
54 at fftools/ffmpeg.c:4872
55(gdb) disass $pc-32,$pc+32
56Dump of assembler code from 0x1417d9a to 0x1417dda:
57 0x0000000001417d9a <avi_read_packet+21690>: jb 0x1417e04 <avi_read_packet+21796>
58 0x0000000001417d9c <avi_read_packet+21692>: add %edi,%edi
59 0x0000000001417d9e <avi_read_packet+21694>: mov 0x70(%rsp),%rcx
60 0x0000000001417da3 <avi_read_packet+21699>: mov 0x48(%rsp),%rax
61 0x0000000001417da8 <avi_read_packet+21704>: mov 0x38(%rsp),%rdi
62 0x0000000001417dad <avi_read_packet+21709>: cmp $0x1e8481,%rbx
63 0x0000000001417db4 <avi_read_packet+21716>: jge 0x14170e8 <avi_read_packet+18440>
64=> 0x0000000001417dba <avi_read_packet+21722>: cmpb $0x0,0x17(%rsp)
65 0x0000000001417dbf <avi_read_packet+21727>: je 0x1417e3e <avi_read_packet+21854>
66 0x0000000001417dc1 <avi_read_packet+21729>: test $0x7,%r15b
67 0x0000000001417dc5 <avi_read_packet+21733>: jne 0x1417e5a <avi_read_packet+21882>
68 0x0000000001417dcb <avi_read_packet+21739>: cmp %r14,(%r15)
69 0x0000000001417dce <avi_read_packet+21742>: jge 0x1417de8 <avi_read_packet+21768>
70 0x0000000001417dd0 <avi_read_packet+21744>: cmpb $0x0,0x17(%rsp)
71 0x0000000001417dd5 <avi_read_packet+21749>: je 0x1417e7a <avi_read_packet+21914>
72End of assembler dump.
73(gdb) info all-registers
74rax 0x922e780 153282432
75rbx 0x8000000000000000 -9223372036854775808
76rcx 0x922e7c0 153282496
77rdx 0x6d 109
78rsi 0x7fffffffd330 140737488343856
79rdi 0x922d840 153278528
80rbp 0x0 0x0
81rsp 0x7fffffffd340 0x7fffffffd340
82r8 0x1 1
83r9 0x0 0
84r10 0x0 0
85r11 0x202 514
86r12 0x7fffffffd760 140737488344928
87r13 0x922fc01 153287681
88r14 0x8000000000000000 -9223372036854775808
89r15 0x922e7d8 153282520
90rip 0x1417dba 0x1417dba <avi_read_packet+21722>
91eflags 0xa12 [ AF IF OF ]
92cs 0x33 51
93ss 0x2b 43
94ds 0x0 0
95es 0x0 0
96fs 0x0 0
97gs 0x0 0
98st0 0 (raw 0x00000000000000000000)
99st1 0 (raw 0x00000000000000000000)
100st2 0 (raw 0x00000000000000000000)
101st3 0 (raw 0x00000000000000000000)
102st4 0 (raw 0x00000000000000000000)
103st5 0 (raw 0x00000000000000000000)
104st6 0 (raw 0x00000000000000000000)
105st7 0 (raw 0x00000000000000000000)
106fctrl 0xffff 65535
107fstat 0xffff 65535
108ftag 0xaaaa 43690
109fiseg 0x1 1
110fioff 0x0 0
111foseg 0x5598 21912
112fooff 0xa 10
113fop 0x7ff 2047
114mxcsr 0x1fa0 [ PE IM DM ZM OM UM PM ]
115---Type <return> to continue, or q <return> to quit---
116bndcfgu {raw = 0x0, config = {base = 0x0, reserved = 0x0, preserved = 0x0,
117 enabled = 0x0}} {raw = 0x0, config = {base = 0, reserved = 0,
118 preserved = 0, enabled = 0}}
119bndstatus {raw = 0x0, status = {bde = 0x0, error = 0x0}} {raw = 0x0,
120 status = {bde = 0, error = 0}}
121ymm0 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
122 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x8, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0,
123 0xd0, 0xcf, 0xff, 0xff, 0xff, 0x7f, 0x0 <repeats 18 times>}, v16_int16 = {0x8,
124 0x0, 0x30, 0x0, 0xcfd0, 0xffff, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
125 0x0, 0x0}, v8_int32 = {0x8, 0x30, 0xffffcfd0, 0x7fff, 0x0, 0x0, 0x0, 0x0},
126 v4_int64 = {0x3000000008, 0x7fffffffcfd0, 0x0, 0x0}, v2_int128 = {
127 0x7fffffffcfd00000003000000008, 0x0}}
128ymm1 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
129 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
130 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
131 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
132ymm2 {v8_float = {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
133 0x1, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x3f,
134 0x0 <repeats 24 times>}, v16_int16 = {0x0, 0x0, 0x0, 0x3ff0,
135 0x0 <repeats 12 times>}, v8_int32 = {0x0, 0x3ff00000, 0x0, 0x0, 0x0, 0x0, 0x0,
136 0x0}, v4_int64 = {0x3ff0000000000000, 0x0, 0x0, 0x0}, v2_int128 = {
137 0x3ff0000000000000, 0x0}}
138ymm3 {v8_float = {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
139 0x1, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x3f,
140 0x0 <repeats 24 times>}, v16_int16 = {0x0, 0x0, 0x0, 0x3ff0,
141 0x0 <repeats 12 times>}, v8_int32 = {0x0, 0x3ff00000, 0x0, 0x0, 0x0, 0x0, 0x0,
142 0x0}, v4_int64 = {0x3ff0000000000000, 0x0, 0x0, 0x0}, v2_int128 = {
143 0x3ff0000000000000, 0x0}}
144ymm4 {v8_float = {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
145 0x1, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x3f,
146 0x0 <repeats 24 times>}, v16_int16 = {0x0, 0x0, 0x0, 0x3ff0,
147 0x0 <repeats 12 times>}, v8_int32 = {0x0, 0x3ff00000, 0x0, 0x0, 0x0, 0x0, 0x0,
148 0x0}, v4_int64 = {0x3ff0000000000000, 0x0, 0x0, 0x0}, v2_int128 = {
149 0x3ff0000000000000, 0x0}}
150ymm5 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
151 0x8000000000000000, 0x8000000000000000, 0x0, 0x0}, v32_int8 = {
152 0xff <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0xffff, 0xffff,
153 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
154 0x0, 0x0}, v8_int32 = {0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x0,
155 0x0, 0x0, 0x0}, v4_int64 = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0},
156 v2_int128 = {0xffffffffffffffffffffffffffffffff, 0x0}}
157---Type <return> to continue, or q <return> to quit---
158ymm6 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
159 0x8000000000000000, 0x8000000000000000, 0x0, 0x0}, v32_int8 = {0x2, 0xff,
160 0x13, 0xff, 0xff, 0xff, 0xff, 0xf0, 0x3, 0xff, 0x13, 0xff, 0xff, 0xff, 0xff,
161 0xf0, 0x0 <repeats 16 times>}, v16_int16 = {0xff02, 0xff13, 0xffff, 0xf0ff,
162 0xff03, 0xff13, 0xffff, 0xf0ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
163 v8_int32 = {0xff13ff02, 0xf0ffffff, 0xff13ff03, 0xf0ffffff, 0x0, 0x0, 0x0, 0x0},
164 v4_int64 = {0xf0ffffffff13ff02, 0xf0ffffffff13ff03, 0x0, 0x0}, v2_int128 = {
165 0xf0ffffffff13ff03f0ffffffff13ff02, 0x0}}
166ymm7 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
167 0x8000000000000000, 0x0, 0x0, 0x0}, v32_int8 = {0xff <repeats 12 times>, 0x3f,
168 0x7, 0x0, 0x80, 0x0 <repeats 16 times>}, v16_int16 = {0xffff, 0xffff, 0xffff,
169 0xffff, 0xffff, 0xffff, 0x73f, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
170 0x0}, v8_int32 = {0xffffffff, 0xffffffff, 0xffffffff, 0x8000073f, 0x0, 0x0,
171 0x0, 0x0}, v4_int64 = {0xffffffffffffffff, 0x8000073fffffffff, 0x0, 0x0},
172 v2_int128 = {0x8000073fffffffffffffffffffffffff, 0x0}}
173ymm8 {v8_float = {0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x0,
174 0x0, 0x0, 0x0}, v4_double = {0x7fffffffffffffff, 0x7fffffffffffffff, 0x0,
175 0x0}, v32_int8 = {0x0, 0x70, 0x72, 0x6f, 0x67, 0x72, 0x65, 0x73, 0x73, 0x3d,
176 0x25, 0x73, 0xa, 0x0, 0x63, 0x6f, 0x0 <repeats 16 times>}, v16_int16 = {
177 0x7000, 0x6f72, 0x7267, 0x7365, 0x3d73, 0x7325, 0xa, 0x6f63, 0x0, 0x0, 0x0,
178 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x6f727000, 0x73657267, 0x73253d73,
179 0x6f63000a, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x736572676f727000,
180 0x6f63000a73253d73, 0x0, 0x0}, v2_int128 = {
181 0x6f63000a73253d73736572676f727000, 0x0}}
182ymm9 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
183 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
184 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
185 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
186ymm10 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
187 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
188 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
189 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
190ymm11 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
191 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
192 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
193 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
194ymm12 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
195 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
196 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
197 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
198ymm13 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
199---Type <return> to continue, or q <return> to quit---
200 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
201 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
202 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
203ymm14 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
204 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
205 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
206 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
207ymm15 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {
208 0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {
209 0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
210 v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}}
211bnd0 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1
212bnd1 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1
213bnd2 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1
214bnd3 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1 {lbound = 0x0, ubound = 0xffffffffffffffff} : size -1
215