Opened 11 years ago
Closed 11 years ago
#2988 closed defect (fixed)
lagarith: deadlock with fuzzed file
Reported by: | ami_stuff | Owned by: | |
---|---|---|---|
Priority: | important | Component: | avcodec |
Version: | git-master | Keywords: | lagarith deadlock |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description
http://www1.datafilehost.com/d/3bdcfcb5
(gdb) r -threads 1 -i ./lag_dead.avi -an -f null - Starting program: /media/sdb1/ffmpeg-HEAD-93439e8/ffmpeg_g -threads 1 -i ./lag_dead.avi -an -f null - [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". ffmpeg version 2.0-93439e8 Copyright (c) 2000-2013 the FFmpeg developers built on Sep 18 2013 23:23:15 with gcc 4.7 (Debian 4.7.2-5) configuration: --disable-yasm --enable-gpl --disable-ffprobe --disable-ffserver libavutil 52. 44.100 / 52. 44.100 libavcodec 55. 31.101 / 55. 31.101 libavformat 55. 18.100 / 55. 18.100 libavdevice 55. 3.100 / 55. 3.100 libavfilter 3. 86.101 / 3. 86.101 libswscale 2. 5.100 / 2. 5.100 libswresample 0. 17.103 / 0. 17.103 libpostproc 52. 3.100 / 52. 3.100 Input #0, avi, from './lag_dead.avi': Duration: 00:00:12.64, start: 0.000000, bitrate: 11792 kb/s Stream #0:0: Video: lagarith (LAGS / 0x5347414C), rgb24, 320x240, 23.97 tbr, 23.97 tbn, 23.97 tbc Stream #0:1: Audio: mp3 (U[0][0][0] / 0x0055), 44100 Hz, stereo, s16p, 128 kb/s [New Thread 0xb7df8b70 (LWP 29348)] [New Thread 0xb75f8b70 (LWP 29358)] [New Thread 0xb6df8b70 (LWP 29359)] [New Thread 0xb65f8b70 (LWP 29360)] [New Thread 0xb5df8b70 (LWP 29361)] [New Thread 0xb55f8b70 (LWP 29362)] [New Thread 0xb4df8b70 (LWP 29363)] [New Thread 0xb45f8b70 (LWP 29364)] [New Thread 0xb3df8b70 (LWP 29365)] Output #0, null, to 'pipe:': Metadata: encoder : Lavf55.18.100 Stream #0:0: Video: rawvideo (RGB[24] / 0x18424752), rgb24, 320x240, q=2-31, 200 kb/s, 90k tbn, 23.97 tbc Stream mapping: Stream #0:0 -> #0:0 (lagarith -> rawvideo) Press [q] to stop, [?] for help [null @ 0x912d660] Encoder did not produce proper pts, making some up. [lagarith @ 0x9115700] Output more bytes than length (37782 of 19423) [lagarith @ 0x9115700] Output more bytes than length (35329 of 35132) [lagarith @ 0x9115700] Output more bytes than length (64854 of 45184) [lagarith @ 0x9115700] Output more bytes than length (60043 of 38887) [lagarith @ 0x9115700] Output more bytes than length (66100 of 62328) [lagarith @ 0x9115700] Output more bytes than length (69529 of 43506) [lagarith @ 0x9115700] Output more bytes than length (67289 of 49185) [lagarith @ 0x9115700] Output more bytes than length (69864 of 66900) [lagarith @ 0x9115700] Output more bytes than length (73316 of 50540) [lagarith @ 0x9115700] Output more bytes than length (73777 of 71250) [lagarith @ 0x9115700] Output more bytes than length (67653 of 55390) [lagarith @ 0x9115700] Output more bytes than length (61829 of 56407) [lagarith @ 0x9115700] Output more bytes than length (62750 of 58310) [lagarith @ 0x9115700] Output more bytes than length (74119 of 73845) [lagarith @ 0x9115700] Output more bytes than length (73044 of 58280) [lagarith @ 0x9115700] Output more bytes than length (66727 of 58069) [lagarith @ 0x9115700] Output more bytes than length (74159 of 73981) [lagarith @ 0x9115700] Output more bytes than length (58709 of 58435) [lagarith @ 0x9115700] Output more bytes than length (73238 of 57110) [lagarith @ 0x9115700] Output more bytes than length (63193 of 58304) [lagarith @ 0x9115700] Output more bytes than length (64502 of 58819) [lagarith @ 0x9115700] Output more bytes than length (64549 of 61039) [lagarith @ 0x9115700] Output more bytes than length (71492 of 60032) [lagarith @ 0x9115700] Output more bytes than length (74125 of 60959) [lagarith @ 0x9115700] Output more bytes than length (75277 of 62888) [lagarith @ 0x9115700] Output more bytes than length (72403 of 63728) [lagarith @ 0x9115700] Output more bytes than length (73299 of 63077) [lagarith @ 0x9115700] Output more bytes than length (72965 of 64939) [lagarith @ 0x9115700] Output more bytes than length (70962 of 64303) [lagarith @ 0x9115700] Output more bytes than length (67532 of 63599) [lagarith @ 0x9115700] Output more bytes than length (66794 of 65814) [lagarith @ 0x9115700] Output more bytes than length (66145 of 63825) [lagarith @ 0x9115700] Output more bytes than length (68295 of 65973) [lagarith @ 0x9115700] Output more bytes than length (70459 of 65774) [lagarith @ 0x9115700] Output more bytes than length (71333 of 63724) [lagarith @ 0x9115700] Output more bytes than length (74713 of 65084) [lagarith @ 0x9115700] Output more bytes than length (68773 of 64264) [lagarith @ 0x9115700] Output more bytes than length (74221 of 66178) [lagarith @ 0x9115700] Output more bytes than length (74631 of 64317) [lagarith @ 0x9115700] Output more bytes than length (66600 of 65695) [lagarith @ 0x9115700] Output more bytes than length (74335 of 64942) [lagarith @ 0x9115700] Output more bytes than length (69509 of 64829) [lagarith @ 0x9115700] Output more bytes than length (64790 of 64609) [lagarith @ 0x9115700] Output more bytes than length (66053 of 64991) [lagarith @ 0x9115700] Output more bytes than length (70132 of 64683) [lagarith @ 0x9115700] Output more bytes than length (69997 of 65854) [lagarith @ 0x9115700] Output more bytes than length (72845 of 66008) [lagarith @ 0x9115700] Output more bytes than length (70350 of 65553) [lagarith @ 0x9115700] Output more bytes than length (66931 of 65324) [lagarith @ 0x9115700] Output more bytes than length (69976 of 66483) [lagarith @ 0x9115700] Output more bytes than length (75089 of 65171) [lagarith @ 0x9115700] Output more bytes than length (69621 of 66588) [lagarith @ 0x9115700] Output more bytes than length (75441 of 65492) [lagarith @ 0x9115700] Output more bytes than length (70025 of 66617) [lagarith @ 0x9115700] Output more bytes than length (67376 of 65872) [lagarith @ 0x9115700] Output more bytes than length (73645 of 65392) [lagarith @ 0x9115700] Output more bytes than length (71592 of 66371) [lagarith @ 0x9115700] Output more bytes than length (74085 of 66426) [lagarith @ 0x9115700] Output more bytes than length (68993 of 65191) [lagarith @ 0x9115700] Output more bytes than length (73096 of 66387) [lagarith @ 0x9115700] Output more bytes than length (70503 of 65957) [lagarith @ 0x9115700] Output more bytes than length (74741 of 66068) [lagarith @ 0x9115700] Output more bytes than length (75228 of 65259) [lagarith @ 0x9115700] Output more bytes than length (72494 of 65564) [lagarith @ 0x9115700] Output more bytes than length (66241 of 64710) [lagarith @ 0x9115700] Output more bytes than length (67241 of 65784) [lagarith @ 0x9115700] Output more bytes than length (74050 of 64704) [lagarith @ 0x9115700] Output more bytes than length (65834 of 65478) [lagarith @ 0x9115700] Output more bytes than length (71417 of 65454) [lagarith @ 0x9115700] Output more bytes than length (68331 of 64615) [lagarith @ 0x9115700] Output more bytes than length (73994 of 65275) [lagarith @ 0x9115700] Output more bytes than length (73171 of 65315) [lagarith @ 0x9115700] Output more bytes than length (72063 of 64467) [lagarith @ 0x9115700] Output more bytes than length (74275 of 64731) [lagarith @ 0x9115700] Output more bytes than length (70500 of 65569) [lagarith @ 0x9115700] Output more bytes than length (66618 of 64894) [lagarith @ 0x9115700] Output more bytes than length (73763 of 65549) [lagarith @ 0x9115700] Output more bytes than length (74007 of 64323) [lagarith @ 0x9115700] Output more bytes than length (72930 of 65614) [lagarith @ 0x9115700] Output more bytes than length (69258 of 65641) [lagarith @ 0x9115700] Output more bytes than length (68916 of 64782) [lagarith @ 0x9115700] Output more bytes than length (71015 of 65791) [lagarith @ 0x9115700] Output more bytes than length (72934 of 64746) [lagarith @ 0x9115700] Output more bytes than length (72546 of 65905) [lagarith @ 0x9115700] Output more bytes than length (72939 of 65428) [lagarith @ 0x9115700] Output more bytes than length (71051 of 66387) [lagarith @ 0x9115700] Output more bytes than length (73681 of 65007) [lagarith @ 0x9115700] Output more bytes than length (75417 of 66332) [lagarith @ 0x9115700] Output more bytes than length (75517 of 64995) [lagarith @ 0x9115700] Output more bytes than length (72486 of 65943) [lagarith @ 0x9115700] Output more bytes than length (72428 of 66055) [lagarith @ 0x9115700] Output more bytes than length (75534 of 64465) [lagarith @ 0x9115700] Output more bytes than length (70580 of 65738) [lagarith @ 0x9115700] Output more bytes than length (73918 of 66225) [lagarith @ 0x9115700] Output more bytes than length (65740 of 65604) [lagarith @ 0x9115700] Output more bytes than length (73689 of 66297) [lagarith @ 0x9115700] Output more bytes than length (74054 of 66938) [lagarith @ 0x9115700] Output more bytes than length (71784 of 64809) [lagarith @ 0x9115700] Output more bytes than length (73251 of 66246) [lagarith @ 0x9115700] Output more bytes than length (73138 of 64595) [lagarith @ 0x9115700] Output more bytes than length (66127 of 65566) [lagarith @ 0x9115700] Output more bytes than length (67241 of 64812) [lagarith @ 0x9115700] Output more bytes than length (69105 of 64817) [lagarith @ 0x9115700] Output more bytes than length (66978 of 65717) [lagarith @ 0x9115700] Output more bytes than length (74194 of 64689) [lagarith @ 0x9115700] Output more bytes than length (74244 of 65381) [lagarith @ 0x9115700] Output more bytes than length (73917 of 65278) [lagarith @ 0x9115700] Output more bytes than length (71668 of 64582) [lagarith @ 0x9115700] Output more bytes than length (69316 of 65286) [lagarith @ 0x9115700] Output more bytes than length (68573 of 65318) [lagarith @ 0x9115700] Output more bytes than length (74315 of 64460) [lagarith @ 0x9115700] Output more bytes than length (66470 of 64955) [lagarith @ 0x9115700] Output more bytes than length (74261 of 64851) [lagarith @ 0x9115700] Output more bytes than length (71509 of 65097) [lagarith @ 0x9115700] Output more bytes than length (70673 of 64879) [lagarith @ 0x9115700] Output more bytes than length (73180 of 64386) [lagarith @ 0x9115700] Output more bytes than length (69602 of 65721) [lagarith @ 0x9115700] Output more bytes than length (67477 of 64521) [lagarith @ 0x9115700] Output more bytes than length (72897 of 64304) [lagarith @ 0x9115700] Output more bytes than length (71095 of 65875) [lagarith @ 0x9115700] Output more bytes than length (68710 of 64254) [lagarith @ 0x9115700] Output more bytes than length (66489 of 65361) [lagarith @ 0x9115700] Output more bytes than length (71364 of 64119) [lagarith @ 0x9115700] Output more bytes than length (70291 of 65427) [lagarith @ 0x9115700] Output more bytes than length (71906 of 57929) [lagarith @ 0x9115700] Output more bytes than length (65744 of 59272) [lagarith @ 0x9115700] Output more bytes than length (66039 of 61104) [lagarith @ 0x9115700] Output more bytes than length (74532 of 74462) [lagarith @ 0x9115700] Output more bytes than length (75345 of 60535) [lagarith @ 0x9115700] Output more bytes than length (59386 of 58870) [lagarith @ 0x9115700] Output more bytes than length (61251 of 59578) [lagarith @ 0x9115700] Output more bytes than length (71944 of 61364) [lagarith @ 0x9115700] Output more bytes than length (75340 of 59308) [lagarith @ 0x9115700] Output more bytes than length (73979 of 59575) [lagarith @ 0x9115700] Output more bytes than length (70127 of 62329) [lagarith @ 0x9115700] Output more bytes than length (75427 of 75038) [lagarith @ 0x9115700] Output more bytes than length (71056 of 61949) [lagarith @ 0x9115700] Output more bytes than length (75241 of 61778) [lagarith @ 0x9115700] Output more bytes than length (71056 of 62142) [lagarith @ 0x9115700] Output more bytes than length (73525 of 61248) [lagarith @ 0x9115700] Output more bytes than length (66422 of 62589) [lagarith @ 0x9115700] Output more bytes than length (64569 of 61220) [lagarith @ 0x9115700] Output more bytes than length (70728 of 63406) [lagarith @ 0x9115700] Output more bytes than length (71570 of 63221) [lagarith @ 0x9115700] Output more bytes than length (74290 of 63976) [lagarith @ 0x9115700] Output more bytes than length (73919 of 64592) [lagarith @ 0x9115700] Output more bytes than length (69116 of 61974) [lagarith @ 0x9115700] Output more bytes than length (72021 of 64402) [lagarith @ 0x9115700] Output more bytes than length (70851 of 61922) [lagarith @ 0x9115700] Output more bytes than length (68670 of 64754) [lagarith @ 0x9115700] Output more bytes than length (72344 of 62780) [lagarith @ 0x9115700] Output more bytes than length (71735 of 63111) [lagarith @ 0x9115700] Output more bytes than length (70318 of 64538) [lagarith @ 0x9115700] Output more bytes than length (69371 of 63770) [lagarith @ 0x9115700] Output more bytes than length (75491 of 64543) [lagarith @ 0x9115700] Output more bytes than length (73004 of 63232) [lagarith @ 0x9115700] Output more bytes than length (74168 of 62999) [lagarith @ 0x9115700] Output more bytes than length (67456 of 64469) [lagarith @ 0x9115700] Output more bytes than length (67704 of 63256) [lagarith @ 0x9115700] Output more bytes than length (71081 of 63966) [lagarith @ 0x9115700] Output more bytes than length (66806 of 63884) [lagarith @ 0x9115700] Output more bytes than length (75327 of 62655) [lagarith @ 0x9115700] Output more bytes than length (75709 of 75130) [lagarith @ 0x9115700] Output more bytes than length (74622 of 63685) [lagarith @ 0x9115700] Output more bytes than length (69587 of 63246) [lagarith @ 0x9115700] Output more bytes than length (72260 of 63525) [lagarith @ 0x9115700] Output more bytes than length (67629 of 63357) [lagarith @ 0x9115700] Output more bytes than length (65796 of 61774) [lagarith @ 0x9115700] Output more bytes than length (75026 of 74712) [lagarith @ 0x9115700] Output more bytes than length (74368 of 63681) [lagarith @ 0x9115700] Output more bytes than length (74482 of 61850) [lagarith @ 0x9115700] Output more bytes than length (75292 of 74707) [lagarith @ 0x9115700] Output more bytes than length (70924 of 61343) [lagarith @ 0x9115700] Output more bytes than length (74595 of 74494) [lagarith @ 0x9115700] Output more bytes than length (71481 of 62650) [lagarith @ 0x9115700] Output more bytes than length (73109 of 61571) [lagarith @ 0x9115700] Output more bytes than length (74656 of 74401) [lagarith @ 0x9115700] Output more bytes than length (74019 of 73907) [lagarith @ 0x9115700] Output more bytes than length (69878 of 60831) [lagarith @ 0x9115700] Output more bytes than length (74053 of 73771) [lagarith @ 0x9115700] Output more bytes than length (72075 of 61845) [lagarith @ 0x9115700] Output more bytes than length (69149 of 59924) [lagarith @ 0x9115700] Output more bytes than length (73274 of 72955) [lagarith @ 0x9115700] Output more bytes than length (73540 of 73108) [lagarith @ 0x9115700] Output more bytes than length (69189 of 60058) [lagarith @ 0x9115700] Output more bytes than length (62613 of 59990) [lagarith @ 0x9115700] Output more bytes than length (69336 of 59860) [lagarith @ 0x9115700] Output more bytes than length (72459 of 69228) [lagarith @ 0x9115700] Output more bytes than length (70967 of 53216) [lagarith @ 0x9115700] Output more bytes than length (71639 of 70673) [lagarith @ 0x9115700] Output more bytes than length (55710 of 55026) [lagarith @ 0x9115700] Output more bytes than length (71727 of 70940) [lagarith @ 0x9115700] Output more bytes than length (71507 of 54513) [lagarith @ 0x9115700] Output more bytes than length (68472 of 55343) [lagarith @ 0x9115700] Output more bytes than length (73399 of 71993) [lagarith @ 0x9115700] Output more bytes than length (73190 of 72216) [lagarith @ 0x9115700] Output more bytes than length (72159 of 56754) [lagarith @ 0x9115700] Output more bytes than length (74032 of 72319) [lagarith @ 0x9115700] Output more bytes than length (70776 of 57259) [lagarith @ 0x9115700] Output more bytes than length (72547 of 56999) [lagarith @ 0x9115700] Output more bytes than length (73450 of 72571) [lagarith @ 0x9115700] Output more bytes than length (73217 of 58617) [lagarith @ 0x9115700] Output more bytes than length (73550 of 72383) [lagarith @ 0x9115700] Output more bytes than length (64145 of 58351) [lagarith @ 0x9115700] Output more bytes than length (73940 of 72788) [lagarith @ 0x9115700] Output more bytes than length (68244 of 58253) [lagarith @ 0x9115700] Output more bytes than length (68976 of 58250) [lagarith @ 0x9115700] Output more bytes than length (74733 of 72529) [lagarith @ 0x9115700] Output more bytes than length (74175 of 58931) [lagarith @ 0x9115700] Output more bytes than length (74450 of 72188) [lagarith @ 0x9115700] Output more bytes than length (60705 of 58672) [lagarith @ 0x9115700] Output more bytes than length (74868 of 57682) [lagarith @ 0x9115700] Output more bytes than length (71914 of 71814) [lagarith @ 0x9115700] Output more bytes than length (71106 of 57792) [lagarith @ 0x9115700] Output more bytes than length (71677 of 56302) [lagarith @ 0x9115700] Output more bytes than length (73897 of 71123) [lagarith @ 0x9115700] Output more bytes than length (58792 of 55886) [lagarith @ 0x9115700] Output more bytes than length (74346 of 55747) [lagarith @ 0x9115700] Output more bytes than length (73471 of 71148) [lagarith @ 0x9115700] Output more bytes than length (60387 of 56057) [lagarith @ 0x9115700] Output more bytes than length (65666 of 55900) [lagarith @ 0x9115700] Output more bytes than length (59917 of 55675) [lagarith @ 0x9115700] Output more bytes than length (73365 of 71207) [lagarith @ 0x9115700] Output more bytes than length (64637 of 55046) [lagarith @ 0x9115700] Output more bytes than length (62913 of 55415) [lagarith @ 0x9115700] Output more bytes than length (73338 of 71200) [lagarith @ 0x9115700] Output more bytes than length (57842 of 54596) [lagarith @ 0x9115700] Output more bytes than length (60431 of 55415) [lagarith @ 0x9115700] Output more bytes than length (67579 of 54886) [lagarith @ 0x9115700] Output more bytes than length (70310 of 55995) [lagarith @ 0x9115700] Output more bytes than length (73159 of 71135) [lagarith @ 0x9115700] Output more bytes than length (68617 of 56709) [lagarith @ 0x9115700] Output more bytes than length (72906 of 71170) [lagarith @ 0x9115700] Output more bytes than length (68652 of 55222) [lagarith @ 0x9115700] Output more bytes than length (73358 of 71749) [lagarith @ 0x9115700] Output more bytes than length (62221 of 56130) [lagarith @ 0x9115700] Output more bytes than length (70822 of 57076) [lagarith @ 0x9115700] Output more bytes than length (72945 of 71849) [lagarith @ 0x9115700] Output more bytes than length (66125 of 56033) [lagarith @ 0x9115700] Output more bytes than length (62663 of 57024) [lagarith @ 0x9115700] Output more bytes than length (73309 of 72052) [lagarith @ 0x9115700] Output more bytes than length (73552 of 72520) [lagarith @ 0x9115700] Output more bytes than length (69224 of 56082) [lagarith @ 0x9115700] Output more bytes than length (73821 of 73365) [lagarith @ 0x9115700] Output more bytes than length (66335 of 57921) [lagarith @ 0x9115700] Output more bytes than length (71947 of 57185) [lagarith @ 0x9115700] Output more bytes than length (69735 of 57890) [lagarith @ 0x9115700] Output more bytes than length (72133 of 57867) [lagarith @ 0x9115700] Output more bytes than length (65008 of 57995) [lagarith @ 0x9115700] Output more bytes than length (73770 of 73161) [lagarith @ 0x9115700] Output more bytes than length (61706 of 58001) [lagarith @ 0x9115700] Output more bytes than length (74221 of 72819) Program received signal SIGINT, Interrupt. lag_read_prob_header (gb=0xbfffec44, rac=0xbfffec58) at libavcodec/lagarith.c:194 194 if (rac->prob[i]) { (gdb) bt #0 lag_read_prob_header (gb=0xbfffec44, rac=0xbfffec58) at libavcodec/lagarith.c:194 #1 lag_decode_arith_plane (l=l@entry=0x912eca0, dst=0x9191920 "\b\b\n\v\r\r\f\f\f\f\f\r\f\r", '\n' <repeats 18 times>, "\f\f\f\f\f\f\f\f\v\v\f\v\v\v", '\f' <repeats 16 times>, "\v\f\f\f\f\f", '\v' <repeats 24 times>, "\016\016\016\016\016\016\016\016\017\017\017\016\016\017\f\f\016\017", '\016' <repeats 18 times>, "\r\r\r\r\r\r\r\r\r\r\017\017\017\017\017\017\016\016\016\016\016\016\016\016\r\r\v\v\v\v\v\v", '\r' <repeats 15 times>, "\016\r\r\r\r\016", '\r' <repeats 14 times>, "\f\f\f\017\017"..., width=320, height=240, stride=-320, src=src@entry=0x91d4ee0 "\003\357", <incomplete sequence \341>, src_size=15455) at libavcodec/lagarith.c:437 #2 0x0851e751 in lag_decode_frame (avctx=0x9115700, data=0x912fe80, got_frame=0xbffff4e4, avpkt=0xbffff288) at libavcodec/lagarith.c:616 #3 0x0867a5de in avcodec_decode_video2 (avctx=0x9115700, picture=picture@entry=0x912fe80, got_picture_ptr=got_picture_ptr@entry=0xbffff4e4, avpkt=avpkt@entry=0xbffff730) at libavcodec/utils.c:1995 #4 0x080b394d in decode_video (ist=ist@entry=0x91194a0, pkt=pkt@entry=0xbffff730, got_output=got_output@entry=0xbffff4e4) at ffmpeg.c:1668 #5 0x080b786a in output_packet (pkt=0xbffff6c8, ist=0x91194a0) at ffmpeg.c:1866 ---Type <return> to continue, or q <return> to quit--- #6 process_input (file_index=2) at ffmpeg.c:3089 #7 0x080a3043 in transcode_step () at ffmpeg.c:3185 #8 transcode () at ffmpeg.c:3237 #9 main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3415 (gdb)
Change History (2)
comment:1 by , 11 years ago
Component: | undetermined → avcodec |
---|---|
Keywords: | lagarith deadlock added |
Priority: | normal → important |
Reproduced by developer: | set |
Status: | new → open |
Version: | unspecified → git-master |
comment:2 by , 11 years ago
Resolution: | → fixed |
---|---|
Status: | open → closed |
Note:
See TracTickets
for help on using tickets.
Fixed in 45f0623ae3fabfb4be18fe3e81390e78717f3cd0