Segmentation fault on function av_log_default_callback

[fizz]

Summary of the bug: Segmentation fault on function av_log_default_callback
How to reproduce:

system： ubuntu20.04

git last commit：
commit 66e9888bf418984a274beddbc3e87e9f1b8f5077 (HEAD -> master, origin/master, origin/HEAD)
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Jan 8 03:11:02 2025 +0100

use this command to compile:
./configure --enable-debug=2 --disable-optimizations --disable-stripping
make -j4

use this command to reproduce: valgrind ./ffmpeg -i POC_FILE /dev/null

information from valgrind:

==30384== Memcheck, a memory error detector
==30384== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==30384== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==30384== Command: ./ffmpeg -i ./bugs/ffmpeg_av_log_default_callback /dev/null
==30384==

ffmpeg version N-118312-g66e9888bf4 Copyright (c) 2000-2025 the FFmpeg developers
  built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
  configuration: --enable-debug=2 --disable-optimizations --disable-stripping
  libavutil      59. 55.100 / 59. 55.100
  libavcodec     61. 31.100 / 61. 31.100
  libavformat    61.  9.106 / 61.  9.106
  libavdevice    61.  4.100 / 61.  4.100
  libavfilter    10.  6.101 / 10.  6.101
  libswscale      8. 13.100 /  8. 13.100
  libswresample   5.  4.100 /  5.  4.100
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x64cb8c0] Broken file, trak/mdat not at top-level
==30384==    at 0x3AAC487: VALGRIND_PRINTF_BACKTRACE.constprop.0 (valgrind.h:6306)
==30384==    by 0x3AADE74: av_log_default_callback (log.c:404)
==30384==    by 0x3AAF4F4: av_log (log.c:418)
==30384==    by 0x1172CF2: mov_read_default (mov.c:9366)
==30384==    by 0x11EAA54: ff_mov_read_stsd_entries (mov.c:3090)
==30384==    by 0x11EC565: mov_read_stsd (mov.c:3153)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x11CA1FC: mov_read_trak (mov.c:5122)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384== Invalid read of size 4
==30384==    at 0x11CC28F: mov_read_trak (mov.c:5208)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x1173128: mov_read_moov (mov.c:1565)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x11CC6AE: mov_read_header (mov.c:10458)
==30384==    by 0xFABB15: avformat_open_input (demux.c:308)
==30384==    by 0x42BAE0: ifile_open (ffmpeg_demux.c:1727)
==30384==    by 0x48384C: open_files.isra.0 (ffmpeg_opt.c:1363)
==30384==    by 0x48A3AD: ffmpeg_parse_options (ffmpeg_opt.c:1412)
==30384==    by 0x410A38: main (ffmpeg.c:974)
==30384==  Address 0x4 is not stack'd, malloc'd or (recently) free'd
==30384==
==30384==
==30384== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==30384==  Access not within mapped region at address 0x4
==30384==    at 0x11CC28F: mov_read_trak (mov.c:5208)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x1173128: mov_read_moov (mov.c:1565)
==30384==    by 0x1171E25: mov_read_default (mov.c:9414)
==30384==    by 0x11CC6AE: mov_read_header (mov.c:10458)
==30384==    by 0xFABB15: avformat_open_input (demux.c:308)
==30384==    by 0x42BAE0: ifile_open (ffmpeg_demux.c:1727)
==30384==    by 0x48384C: open_files.isra.0 (ffmpeg_opt.c:1363)
==30384==    by 0x48A3AD: ffmpeg_parse_options (ffmpeg_opt.c:1412)
==30384==    by 0x410A38: main (ffmpeg.c:974)
==30384==  If you believe this happened as a result of a stack
==30384==  overflow in your program's main thread (unlikely but
==30384==  possible), you can try to increase the size of the
==30384==  main thread stack using the --main-stacksize= flag.
==30384==  The main thread stack size used in this run was 8388608.
==30384==
==30384== HEAP SUMMARY:
==30384==     in use at exit: 40,137 bytes in 63 blocks
==30384==   total heap usage: 107 allocs, 44 frees, 80,533 bytes allocated
==30384==
==30384== LEAK SUMMARY:
==30384==    definitely lost: 0 bytes in 0 blocks
==30384==    indirectly lost: 0 bytes in 0 blocks
==30384==      possibly lost: 0 bytes in 0 blocks
==30384==    still reachable: 40,137 bytes in 63 blocks
==30384==         suppressed: 0 bytes in 0 blocks
==30384== Rerun with --leak-check=full to see details of leaked memory
==30384==
==30384== For lists of detected and suppressed errors, rerun with: -s
==30384== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

[fizz]

it is the POC_FILE

[James]

Can't reproduce on current master. As with #11483, probably fixed during the past month or so.