[FFmpeg-devel] H.264 crash on conformance vector: CVFC1_Sony_C.jsv

[Mike Melanson]

Hi,

This H.264 conformance vector crashes FFmpeg: CVFC1_Sony_C.jsv;
downloadable from:

http://samples.mplayerhq.hu/fate-suite/h264-conformance/

I compiled FFmpeg with gcc 4.2.2 on both x86_32 and PPC and the behavior
is the same. For example:

$ ./ffmpeg -f h264 -i
/tmp/fate/samples/h264-conformance/CVFC1_Sony_C.jsv -f framecrc -
FFmpeg version SVN-r11604, Copyright (c) 2000-2008 Fabrice Bellard, et al.
  configuration: --cc=ccache /usr/local/gcc-4.2.2/bin/gcc
  libavutil version: 49.6.0
  libavcodec version: 51.49.0
  libavformat version: 52.5.0
  libavdevice version: 52.0.0
  built on Jan 24 2008 09:50:36, gcc: 4.2.2
[h264 @ 0x10418cf8]insane cropping not completely supported, this could
look slightly wrong ...
[h264 @ 0x10418cf8]insane cropping not completely supported, this could
look slightly wrong ...
[h264 @ 0x10418cf8]left block unavailable for requested intra4x4 mode -1
at 0 1
[h264 @ 0x10418cf8]error while decoding MB 0 1
[h264 @ 0x10418cf8]top block unavailable for requested intra mode at 1 5
[h264 @ 0x10418cf8]error while decoding MB 1 5
[h264 @ 0x10418cf8]dquant out of range (-28) at 3 10
[h264 @ 0x10418cf8]error while decoding MB 3 10
[h264 @ 0x10418cf8]first_mb_in_slice overflow
[h264 @ 0x10418cf8]decode_slice_header error
[h264 @ 0x10418cf8]concealing 209 DC, 209 AC, 209 MV errors
Segmentation fault


This is what gdb reports on both platforms:

Program received signal SIGSEGV, Segmentation fault.
ff_emulated_edge_mc (buf=0x105768a8 "", src=<value optimized out>,
    linesize=352, block_w=17, block_h=17, src_x=<value optimized out>,
    src_y=<value optimized out>, w=<value optimized out>, h=176)
    at mpegvideo.c:1444
1444                buf[x + y*linesize]= src[x + y*linesize];
(gdb) bt
#0  ff_emulated_edge_mc (buf=0x105768a8 "", src=<value optimized out>,
    linesize=352, block_w=17, block_h=17, src_x=<value optimized out>,
    src_y=<value optimized out>, w=<value optimized out>, h=176)
    at mpegvideo.c:1444
#1  0x100b4678 in MPV_motion (s=<value optimized out>,
    dest_y=0x1057da00 '\200' <repeats 200 times>...,
    dest_cb=0x1058d6a8 '\200' <repeats 200 times>...,
    dest_cr=0x10591e68 '\200' <repeats 200 times>...,
    dir=<value optimized out>, ref_picture=0x30052110, pix_op=0x30052a44,
    qpix_op=0x30052de8) at mpegvideo_common.h:485
#2  0x100b74b0 in MPV_decode_mb (s=0x30052020, block=0x1056f9a0)
    at mpegvideo.c:1971
#3  0x1032ef04 in guess_mv (s=0x30052020) at error_resilience.c:39
#4  0x10330c14 in ff_er_frame_end (s=0x30052020) at error_resilience.c:935
#5  0x101d1594 in decode_frame (avctx=0x10523090, data=0x7fb60990,
    data_size=0x7fb60688, buf=0x10547540 "", buf_size=27671) at h264.c:7706
#6  0x100bce60 in avcodec_decode_video (avctx=0x10523090,
    picture=<value optimized out>, got_picture_ptr=<value optimized out>,
    buf=<value optimized out>, buf_size=<value optimized out>) at
utils.c:945
#7  0x1002bac4 in av_find_stream_info (ic=0x10519f00) at utils.c:1691
#8  0x10016c4c in opt_input_file (
    filename=0x7fb621a9
"/tmp/fate/samples/h264-conformance/CVFC1_Sony_C.jsv")
    at ffmpeg.c:2693
#9  0x1001f608 in parse_options (argc=8, argv=0x7fb61ff4,
options=0x10353448,
    parse_arg_function=0x10017e38 <opt_output_file>) at cmdutils.c:116
#10 0x1001c328 in main (argc=8, argv=0x7fb61ff4) at ffmpeg.c:3915

-- 
	-Mike Melanson