[MPlayer-dev-eng] weird bug in libmpeg2

[Gianluigi Tiesi]

On Mon, Aug 02, 2010 at 11:29:45PM -0700, Andrew Wason wrote:
> On Mon, Aug 2, 2010 at 1:22 PM, Gianluigi Tiesi <mplayer at netfarm.it> wrote:
> > Hi,
> > I've got a difficult to trace bug in libmpeg2
> > I've a sample in upload ftp 'mpeg12-crash.ts'
> >
> > the bug is triggered using -vc mpeg12 decoder
> 
> 
> Try the patch attached to bug 1734 and see if it fixes it:
> http://bugzilla.mplayerhq.hu/show_bug.cgi?id=1734
> 
> 

nope ref is still uninit

Program received signal SIGSEGV, Segmentation fault.
0x0822c81a in MC_put1_16 (height=16, dest=0xf79e2020 "", ref=0xc019f5df <Address 0xc019f5df out of bounds>, stride=720) at libmpeg2/motion_comp_mmx.c:544
544             movq_m2r (*ref, mm0);


valgrind says:

==28586== Conditional jump or move depends on uninitialised value(s)
==28586==    at 0x8218898: mpeg2_set_buf (decode.c:349)
==28586==    by 0x821778F: decode (vd_libmpeg2.c:245)
==28586==    by 0x811409E: decode_video (dec_video.c:412)
==28586==    by 0x80B1698: update_video (mplayer.c:2420)
==28586==    by 0x80B5FFB: main (mplayer.c:3816)
==28586==  Uninitialised value was created by a heap allocation
==28586==    at 0x79CAC4C: malloc (vg_replace_malloc.c:195)
==28586==    by 0x8217CF5: mpeg2_malloc (alloc.c:43)
==28586==    by 0x8218B2B: mpeg2_init (decode.c:424)
==28586==    by 0x8217C6F: init (vd_libmpeg2.c:110)
==28586==    by 0x8114805: init_video (dec_video.c:311)
==28586==    by 0x81149E0: init_best_video_codec (dec_video.c:349)
==28586==    by 0x80B2A66: reinit_video_chain (mplayer.c:2336)
==28586==    by 0x80B508D: main (mplayer.c:3628)
==28586==

the code added in the patch is not reached at all

Regards

-- 
Gianluigi Tiesi <sherpya at netfarm.it>
EDP Project Leader
Netfarm S.r.l. - http://www.netfarm.it/
Free Software: http://oss.netfarm.it/