ffplay: vc1 crash 2

[ami_stuff]

​http://www.datafilehost.com/d/48281e16

It happens after pressing "v" key a few times.

(gdb) r wvp2.wmv
Starting program: D:\MinGW\msys\1.0\ffmpeg\ffplay_g.exe wvp2.wmv
[New Thread 1840.0xb54]
[New Thread 1840.0xff0]
[New Thread 1840.0x710]
[New Thread 1840.0x388]
[New Thread 1840.0xfb8]
[New Thread 1840.0xed8]
[New Thread 1840.0xba4]
[New Thread 1840.0xd80]
[New Thread 1840.0xb44]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1840.0xb44]
0x0086eca0 in vc1_decode_sprites (gb=0x5f0c704, v=0x5f0b000)
    at libavcodec/vc1dec.c:5487
5487        if (!s->current_picture.f->data[0]) {
(gdb) bt
#0  0x0086eca0 in vc1_decode_sprites (gb=0x5f0c704, v=0x5f0b000)
    at libavcodec/vc1dec.c:5487
#1  vc1_decode_frame (avctx=0x5ed7ce0, data=0x6c38020, got_frame=0x740ff08,
    avpkt=0x740fbb8) at libavcodec/vc1dec.c:6220
#2  0x005db846 in avcodec_decode_video2 (avctx=0x5ed7ce0, picture=0x6c38020,
    got_picture_ptr=0x740ff08, avpkt=0x740fe58) at libavcodec/utils.c:2264
#3  0x0040cc23 in get_video_frame (serial=<optimized out>,
    pkt=<optimized out>, frame=<optimized out>, is=<optimized out>)
    at ffplay.c:1694
#4  video_thread (arg=0x5b90040) at ffplay.c:1974
#5  0x681097d2 in SDL_RunThread (data=0x5ea8058)
    at ./src/thread/SDL_thread.c:204
#6  0x681327cf in RunThread (data=0x5ed7c98)
    at ./src/thread/win32/SDL_systhread.c:74
#7  RunThreadViaBeginThreadEx (data=0x5ed7c98)
    at ./src/thread/win32/SDL_systhread.c:95
#8  0x77c2a3b0 in msvcrt!_endthreadex () from C:\WINDOWS\system32\msvcrt.dll
#9  0x7c80b729 in KERNEL32!GetModuleFileNameA ()
   from C:\WINDOWS\system32\kernel32.dll
#10 0x00000000 in ?? ()
(gdb)

[Carl Eugen Hoyos]

==1745== Invalid read of size 8
==1745==    at 0x9D3CD5: vc1_decode_frame (vc1dec.c:5487)
==1745==    by 0x9A3327: avcodec_decode_video2 (utils.c:2264)
==1745==    by 0x472A07: video_thread (ffplay.c:1694)
==1745==    by 0x4E46BC7: ??? (in /usr/lib64/libSDL-1.2.so.0.11.4)
==1745==    by 0x4E86478: ??? (in /usr/lib64/libSDL-1.2.so.0.11.4)
==1745==    by 0x50D50DA: start_thread (in /lib64/libpthread-2.18.so)
==1745==    by 0x5AFA90C: clone (in /lib64/libc-2.18.so)
==1745==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

[Michael Niedermayer]

Fixed in 30f680ee0a2707af9a649a0aa3fd951d18a25c05