[Ffmpeg-devel] [BUG] Crash when providing -coder ac parameter

[Benoit Fouet]

Hi,

Limin Wang wrote:
> Hi,
>   
>> Hi,
>>
>> I've noticed that providing the -coder ac parameter causes FFmpeg to 
>> segfault:
>> takis at issaris:/usr/local/src/rw/ffmpeg$ ./ffmpeg -i 
>> /mnt/video/test-704x576.avi -vcodec ffv1 -coder ac /tmp/test.avi
>> FFmpeg version SVN-r8548, Copyright (c) 2000-2007 Fabrice Bellard, et al.
>>   configuration: --enable-gpl --enable-x11grab
>>   libavutil version: 49.4.0
>>   libavcodec version: 51.40.2
>>   libavformat version: 51.11.0
>>   built on Mar 29 2007 14:38:46, gcc: 4.1.2 (Ubuntu 4.1.2-0ubuntu4)
>> Input #0, avi, from '/mnt/video/test-704x576.avi':
>>   Duration: 00:00:04.0, start: 0.000000, bitrate: 68141 kb/s
>>   Stream #0.0: Video: ffvhuff, yuv420p, 704x576, 25.00 fps(r)
>> Segmentation fault (core dumped)
>>
>> It appears that it is not a problem with the AC coder by itself, but 
>> purely a parameter parsing problem.
>>
>> I haven't really looked at the cause yet, but I wanted to send the 
>> bugreport first, in case others would not want to miss the joy of 
>> searching for it ;-)
>>
>>     
>
> Attached patch should fix the bug, please review it. After the fix, it'll
> report "unrecognized option '-coder'" which it's caused by you input wrong
> parameter. After the patch, the following "!unit ||" can be removed. Maybe
> it should be another patch?
>
> Thanks,
> Limin
>   
> ------------------------------------------------------------------------
>
> Index: libavcodec/opt.c
> ===================================================================
> --- libavcodec/opt.c	(revision 8540)
> +++ libavcodec/opt.c	(working copy)
> @@ -35,6 +35,8 @@
>      AVClass *c= *(AVClass**)v; //FIXME silly way of storing AVClass
>      const AVOption *o= c->option;
>  
> +    if( !name || !unit )
> +        return NULL;
>   
this will break almost every option such as flags, dct, ...
(i cant find a way to describe them)
btw, running the regression tests would surely fail on the first line !

>      for(;o && o->name; o++){
>          if(!strcmp(o->name, name) && (!unit || !strcmp(o->unit, unit)) && (o->flags & mask) == flags )
>              return o;
>   
Ben