smv: deadlock with fuzzed file

[ami_stuff]

​http://www1.datafilehost.com/d/7e21f32b

(gdb) r -threads 1 -i deadlock.smv -vn -f null -
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /media/sdb1/ffmpeg-HEAD-93439e8/ffmpeg_g -threads 1 -i deadlock.smv -vn -f null -
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
ffmpeg version 2.0-93439e8 Copyright (c) 2000-2013 the FFmpeg developers
  built on Sep 18 2013 23:23:15 with gcc 4.7 (Debian 4.7.2-5)
  configuration: --disable-yasm --enable-gpl --disable-ffprobe --disable-ffserver
  libavutil      52. 44.100 / 52. 44.100
  libavcodec     55. 31.101 / 55. 31.101
  libavformat    55. 18.100 / 55. 18.100
  libavdevice    55.  3.100 / 55.  3.100
  libavfilter     3. 86.101 /  3. 86.101
  libswscale      2.  5.100 /  2.  5.100
  libswresample   0. 17.103 /  0. 17.103
  libpostproc    52.  3.100 / 52.  3.100
[NULL @ 0x9115d20] [IMGUTILS @ 0xbfffee44] Picture size 162x8405112 is invalid
[NULL @ 0x9115d20] Ignoring invalid width/height values
[mjpeg @ 0x9117cc0] huffman table decode error
[wav @ 0x9114e40] decoding for stream 1 failed
[wav @ 0x9114e40] Could not find codec parameters for stream 1 (Video: smv, yuvj420p): unspecified size
Consider increasing the value for the 'analyzeduration' and 'probesize' options
Guessed Channel Layout for  Input Stream #0.0 : mono
Input #0, wav, from 'deadlock.smv':
  Duration: 291:32:23.00, start: 0.000000, bitrate: 0 kb/s
    Stream #0:0: Audio: adpcm_ima_wav ([17][0][0][0] / 0x0011), 22050 Hz, mono, s16p, 88 kb/s
    Stream #0:1: Video: smv, yuvj420p, 2 fps, 2 tbr, 2 tbn, 2 tbc
[New Thread 0xb7df8b70 (LWP 23716)]
[New Thread 0xb75f8b70 (LWP 23717)]
[New Thread 0xb6df8b70 (LWP 23718)]
[New Thread 0xb65f8b70 (LWP 23719)]
[New Thread 0xb5df8b70 (LWP 23720)]
[New Thread 0xb55f8b70 (LWP 23721)]
[New Thread 0xb4df8b70 (LWP 23722)]
[New Thread 0xb45f8b70 (LWP 23723)]
[New Thread 0xb3df8b70 (LWP 23724)]
Output #0, null, to 'pipe:':
  Metadata:
    encoder         : Lavf55.18.100
    Stream #0:0: Audio: pcm_s16le, 22050 Hz, mono, s16, 352 kb/s
Stream mapping:
  Stream #0:0 -> #0:0 (adpcm_ima_wav -> pcm_s16le)
Press [q] to stop, [?] for help
size=N/A time=00:00:00.00 bitrate=N/A    
Program received signal SIGINT, Interrupt.
0xb7f8ed41 in read () at ../sysdeps/unix/syscall-template.S:82
82	../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) bt
#0  0xb7f8ed41 in read () at ../sysdeps/unix/syscall-template.S:82
#1  0x08167cfe in file_read (h=0x9115380, 
    buf=0x911d4c8 "\tJ\001\377\330\377", <incomplete sequence \340>, 
    size=<optimized out>) at libavformat/file.c:86
#2  0x0815169d in retry_transfer_wrapper (transfer_func=0x8167cd0 <file_read>, 
    size_min=1, size=32768, 
    buf=0x911d4c8 "\tJ\001\377\330\377", <incomplete sequence \340>, 
    h=0x9115380) at libavformat/avio.c:278
#3  ffurl_read (h=0x9115380, 
    buf=0x911d4c8 "\tJ\001\377\330\377", <incomplete sequence \340>, 
    size=32768) at libavformat/avio.c:309
#4  0x0815226a in fill_buffer (s=s@entry=0x911d440)
    at libavformat/aviobuf.c:428
#5  0x081553df in avio_r8 (s=0x911d440) at libavformat/aviobuf.c:474
#6  avio_rl16 (s=0x911d440) at libavformat/aviobuf.c:580
#7  avio_rl24 (s=0x911d440) at libavformat/aviobuf.c:588
#8  0x08246a4e in wav_read_packet (s=0x9114e40, pkt=0xbffff338)
    at libavformat/wavdec.c:485
#9  0x082377e7 in ff_read_packet (s=s@entry=0x9114e40, 
    pkt=pkt@entry=0xbffff338) at libavformat/utils.c:658
#10 0x0823a129 in read_frame_internal (s=s@entry=0x9114e40, 
    pkt=pkt@entry=0xbffff6e8) at libavformat/utils.c:1316
#11 0x0823ad6a in av_read_frame (s=0x9114e40, pkt=pkt@entry=0xbffff6e8)
---Type <return> to continue, or q <return> to quit---
    at libavformat/utils.c:1420
#12 0x080b6eb6 in get_input_packet (pkt=0xbffff6c8, f=0x911b380)
    at ffmpeg.c:2878
#13 process_input (file_index=0) at ffmpeg.c:2915
#14 0x080a3043 in transcode_step () at ffmpeg.c:3185
#15 transcode () at ffmpeg.c:3237
#16 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3415
(gdb) 

[Carl Eugen Hoyos]

Originally a regression since 14ec9d2, behaviour changed in 2a91038.

[Michael Niedermayer]

Fixed in e02495372240ad826a8a6b2ecb035bf001b64344