GNOME Bugzilla – Bug 683517
Crash in bmp_decode_frame() when decoding unusual bmp file
Last modified: 2012-10-27 21:12:22 UTC
Created attachment 223672 [details] Causes the crash. $ gdb --args gst-discoverer-1.0.exe extractortmp.nlc5JE GNU gdb (GDB) 7.5 Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i686-pc-mingw32". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /mingw/bin/gst-discoverer-1.0.exe...done. (gdb) r Starting program: /mingw/bin/gst-discoverer-1.0.exe extractortmp.nlc5JE [New Thread 13664.0x179c] [New Thread 13664.0x1c20] [New Thread 13664.0x3718] Analyzing file:///extractortmp.nlc5JE [New Thread 13664.0x1db8] [New Thread 13664.0x1930] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 13664.0x1db8] 0x0318ed8c in bmp_decode_frame (avctx=0x2bec6e0, data=0x2bea380, data_size=0x2fff9ec, avpkt=0x2fff980) at libavcodec/bmp.c:231 231 memset(p->data[1], 0, 1024); (gdb) p p $1 = (AVFrame *) 0x2becb00 (gdb) p p->data $2 = {0x2c020a0 '\200' <repeats 200 times>..., 0x0, 0x0, 0x0} (gdb) p *p $3 = {data = {0x2c020a0 '\200' <repeats 200 times>..., 0x0, 0x0, 0x0}, linesize = {64, 0, 0, 0}, base = {0x2c020a0 '\200' <repeats 200 times>..., 0x0, 0x0, 0x0}, key_frame = 1, pict_type = AV_PICTURE_TYPE_I, pts = -9223372036854775808, coded_picture_number = 0, display_picture_number = 0, quality = 0, age = 0, reference = 0, qscale_table = 0x0, qstride = 0, mbskip_table = 0x0, motion_val = {0x0, 0x0}, mb_type = 0x0, motion_subsample_log2 = 0 '\000', opaque = 0x2bef080, error = {0, 0, 0, 0}, type = 1, repeat_pict = 0, qscale_type = 0, interlaced_frame = 0, top_field_first = 0, pan_scan = 0x0, palette_has_changed = 0, buffer_hints = 0, dct_coeff = 0x0, ref_index = {0x0, 0x0}, reordered_opaque = 0, hwaccel_picture_private = 0x0, pkt_pts = 0, pkt_dts = 0, owner = 0x0, thread_opaque = 0x0, nb_samples = 0, extended_data = 0x2becb00, sample_aspect_ratio = {num = 0, den = 1}, width = 0, height = 0, format = -1} (gdb) p *p->data[1] Cannot access memory at address 0x0 (gdb) bt
+ Trace 230812
Fixed in http://git.libav.org/?p=libav.git;a=commit;h=8b78c2969a5b7dca939d93bf525aa2bcd737b5d9
Required libav version was bumped to newer release that includes the fix for this.