[MPlayer-dev-eng] [PATCH] segfault fix when parsing fuzzed ogg files

[Pierre Lombard]

Hi,

I've just stumbled upon a few files at :
  http://sam.zoy.org/zzuf/

Every segfault reported there seems fixed in mplayer SVN but the 3
following cases cause problems here :

 => http://sam.zoy.org/zzuf/lol-mplayer.ogg
Segfaults - patch attached.

 => http://sam.zoy.org/zzuf/lol-mplayer.wmv
Does not segfault but mplayer gets stuck eating 100% CPU.

 => http://sam.zoy.org/zzuf/lol-mplayer.aac
Segfaults - null pointer use (see attached log).

Regards,
-- 
Pierre Lombard
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 20070708-tremor.diff
Type: text/x-diff
Size: 434 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/attachments/20070708/2b013364/attachment.diff>
-------------- next part --------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1224632624 (LWP 1571)]
0x0854275d in ifilter_bank (fb=0x896e010, window_sequence=0 '\0', window_shape=0 '\0', window_shape_prev=0 '\0', 
    freq_in=0xbfd30f10, time_out=0x0, overlap=0x0, object_type=2 '\002', frame_len=1024) at filtbank.c:221
221                 time_out[i]   = overlap[i]   + MUL_F(transf_buf[i],window_long_prev[i]);
(gdb) bt
#0  0x0854275d in ifilter_bank (fb=0x896e010, window_sequence=0 '\0', window_shape=0 '\0', window_shape_prev=0 '\0', 
    freq_in=0xbfd30f10, time_out=0x0, overlap=0x0, object_type=2 '\002', frame_len=1024) at filtbank.c:221
#1  0x0855fed1 in reconstruct_single_channel (hDecoder=0x897ffd8, ics=0xbfd32754, sce=0xbfd3274e, spec_data=0xbfd31f4e)
    at specrec.c:928
#2  0x0854e196 in decode_sce_lfe (hDecoder=0x897ffd8, hInfo=0x87ace20, ld=0xbfd37990, id_syn_ele=3 '\003') at syntax.c:596
#3  0x0854e3b5 in raw_data_block (hDecoder=0x897ffd8, hInfo=0x87ace20, ld=0xbfd37990, pce=0x8980645, drc=0x89808b0)
    at syntax.c:445
#4  0x08541401 in aac_frame_decode (hDecoder=0x897ffd8, hInfo=0x87ace20, 
    buffer=0x897edd0 "##\2000\237#\n######\2010#,\224\034\005\214\202a#HH\022\030\235^{#W{\222#U7######\211#'G#f##W\234###\217?\223\203#K?T,#\9\227##235##9\232\177Uwpo\225##N\004z#221#B##\231\a\022###cZE#\035\f7#220o+/#6\024~#\224#\224\034\r\234#\235##"##\231\205E#D####X#q##216####u#hl#5e\224\223#$c###231\231#k\235\213b#..., buffer_size=4196, 
    sample_buffer2=0x0, sample_buffer_size=0) at decoder.c:817
#5  0x0816e01d in decode_audio (sh=0x897ed10, buf=0x899da50 "~\005~\005####[#########w#<#<###U", minlen=4096, 
    maxlen=114688) at ad_faad.c:233
#6  0x08133e4f in decode_audio (sh_audio=0x897ed10, buf=0x8983fa0 "~\005~\005####[#########w#<#<###U", 
    minlen=4096, maxlen=<value optimized out>) at dec_audio.c:389
#7  0x080c5600 in main (argc=2, argv=0xbfd39c84) at mplayer.c:1789