[MPlayer-users] weird crash playing mp3's

[D Richard Felker III]

I just today experienced a strange crash playing a list of mp3's with
mplayer. When ending the eleventh file in the playlist (either by it
finishing, or by pressing enter), mplayer crashes because of an
invalid pointer stored in sh_audio. I'm not sure how or where it gets
corrupted. The issue seems very specific -- taking out lots of the
earlier files in the playlist, or removing the one that the crash
occurs on, makes the crash go away. In particular, playing file #11 by
itself works fine and does not cause mplayer to crash. But then,
removing files 5-10 causes the crash to occur earlier, on #3. So
perhaps some of the playtree code is overflowing buffers or messing up
the heap.

Here's the gdb stuff. If you need more details or want access to the
particular files I was using, lemme know.

Rich






Detected audio codec: [mp3] afm:mp3lib (mp3lib MPEG layer-2, layer-3)
Opening audio decoder: [mp3lib] MPEG layer-2, layer-3
AUDIO: 44100 Hz, 2 ch, sfmt: 0x10 (2 bps), ratio: 4000->176400 (32.0 kbit)
AO: [plugin] 44100Hz 2ch Signed 16-bit (Little-Endian)
[pl_volume] Software volume control in use.
Video: no video!!!
Start playing...
A:   0.7  3.1% 0%

Program received signal SIGSEGV, Segmentation fault.
uninit_audio (sh_audio=0x8359268) at dec_audio.c:141
141         if(sh_audio->a_in_buffer) free(sh_audio->a_in_buffer);
(gdb) bt
#0  uninit_audio (sh_audio=0x8359268) at dec_audio.c:141
#1  0x8051d09 in main (argc=16, argv=0xbffff764) at mplayer.c:2810
(gdb) print sh_audio
$1 = (sh_audio_t *) 0x8359268
(gdb) print *sh_audio
Cannot access memory at address 0x8359268.
(gdb) frame 1
#1  0x8051d09 in main (argc=16, argv=0xbffff764) at mplayer.c:2810
2810      if(sh_audio) uninit_audio(sh_audio);
(gdb) list
2805        if (vo_font) free_font_desc(vo_font);
2806        vo_font = NULL;
2807    #endif
2808
2809      current_module="uninit_acodec";
2810      if(sh_audio) uninit_audio(sh_audio);
2811      sh_audio=NULL;
2812
2813      current_module="uninit_vcodec";
2814      if(sh_video) uninit_video(sh_video);
(gdb)