#10059 closed defect (fixed)

bonk deadlock/infinite loop with fuzzed file

Reported by: ami_stuff Owned by:
Priority: important Component: undetermined
Version: git-master Keywords:
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

(gdb) r -i mono_down_1_10_deadlock.bonk -f null -
Starting program: ffmpeg_g -i mono_down_1_10_deadlock.bonk -f null -
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
ffmpeg version N-109101-g822da7a317 Copyright (c) 2000-2022 the FFmpeg developers
  built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.1)
  configuration: 
  libavutil      57. 42.100 / 57. 42.100
  libavcodec     59. 52.102 / 59. 52.102
  libavformat    59. 34.101 / 59. 34.101
  libavdevice    59.  8.101 / 59.  8.101
  libavfilter     8. 50.100 /  8. 50.100
  libswscale      6.  8.112 /  6.  8.112
  libswresample   4.  9.100 /  4.  9.100
Guessed Channel Layout for Input Stream #0.0 : mono
Input #0, bonk, from 'mono_down_1_10_deadlock.bonk':
  Duration: 00:04:17.33, bitrate: 27 kb/s
  Stream #0:0: Audio: bonk, 96000 Hz, 1 channels, s16p
Stream mapping:
  Stream #0:0 -> #0:0 (bonk (native) -> pcm_s16le (native))
Press [q] to stop, [?] for help
[New Thread 0x7ffff6bdd700 (LWP 520378)]
[New Thread 0x7ffff63dc700 (LWP 520379)]
[New Thread 0x7ffff5bdb700 (LWP 520380)]
[New Thread 0x7ffff53da700 (LWP 520381)]
[New Thread 0x7ffff4bd9700 (LWP 520382)]
[New Thread 0x7fffeffff700 (LWP 520383)]
[New Thread 0x7fffef7fe700 (LWP 520384)]
[New Thread 0x7fffeeffd700 (LWP 520385)]
[New Thread 0x7fffee7fc700 (LWP 520386)]
Output #0, null, to 'pipe:':
  Metadata:
    encoder         : Lavf59.34.101
  Stream #0:0: Audio: pcm_s16le, 96000 Hz, mono, s16, 1536 kb/s
    Metadata:
      encoder         : Lavc59.52.102 pcm_s16le
[New Thread 0x7fffedffb700 (LWP 520387)]
Error while decoding stream #0:0: Invalid data found when processing input
    Last message repeated 1 times
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
Error while decoding stream #0:0: Invalid data found when processing input
size=N/A time=00:00:00.23 bitrate=N/A speed=0.00145x    
Thread 1 "ffmpeg_g" received signal SIGINT, Interrupt.
intlist_read (base_2_part=0, entries=282, buf=0x555557155a5c, s=0x555557151a00)
    at libavcodec/bonk.c:215
215	        if (pos >= entries) {
(gdb) bt
#0  intlist_read (base_2_part=0, entries=282, buf=0x555557155a5c, 
    s=0x555557151a00) at libavcodec/bonk.c:215
#1  bonk_decode (avctx=0x555557142600, frame=0x555557145280, 
    got_frame_ptr=0x7fffffffdb3c, pkt=<optimized out>) at libavcodec/bonk.c:332
#2  0x0000555555bb94f2 in decode_simple_internal (
    discarded_samples=<synthetic pointer>, frame=0x555557145280, 
    avctx=0x555557142600) at libavcodec/decode.c:307
#3  decode_simple_receive_frame (frame=<optimized out>, avctx=<optimized out>)
    at libavcodec/decode.c:563
#4  decode_receive_frame_internal (avctx=avctx@entry=0x555557142600, 
    frame=0x555557145280) at libavcodec/decode.c:584
#5  0x0000555555bba0a0 in avcodec_send_packet (avctx=0x555557142600, 
    avpkt=0x555557142c40) at libavcodec/decode.c:665
#6  0x000055555570fe73 in decode (pkt=0x555557142c40, 
    got_frame=0x7fffffffdc80, frame=0x5555571429c0, avctx=0x555557142600)
    at fftools/ffmpeg.c:1999
#7  decode_audio (ist=0x555557142400, pkt=0x555557142c40, 
    got_output=0x7fffffffdc80, decode_failed=0x7fffffffdc84)
    at fftools/ffmpeg.c:2042
#8  0x0000555555712e05 in process_input_packet (no_eof=0, pkt=<optimized out>, 
    ist=0x555557142400) at fftools/ffmpeg.c:2357
#9  process_input (file_index=<optimized out>) at fftools/ffmpeg.c:3723
#10 transcode_step () at fftools/ffmpeg.c:3858
--Type <RET> for more, q to quit, c to continue without paging--
#11 transcode () at fftools/ffmpeg.c:3905
#12 0x00005555556e9deb in main (argc=6, argv=0x7fffffffdf58)
    at fftools/ffmpeg.c:4052

Attachments (1)

mono_down_1_10_deadlock.bonk (854.1 KB ) - added by ami_stuff 17 months ago.

Download all attachments as: .zip

Change History (3)

by ami_stuff, 17 months ago

comment:1 by Carl Eugen Hoyos, 17 months ago

Priority: normalimportant
Version: unspecifiedgit-master

comment:2 by Elon Musk, 17 months ago

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.