[MPlayer-users] Mplayer crashes in module decode_video

[Simon Conrad-Armes]

Hi,

I have this avi, grabbed from my Matrix DVD, which segfaults mplayer 
(1.0pre1-3.2.2) and also the version in CVS. I traced it to 
libmpcodecs/vd_libmpeg2.c, in the decode function, but I cannot figure 
out why null is passed to decode. If anyone wants to have a look, I have 
narrowed the avi to the guilty frames and the avi can be downloaded at 
http://curnomatic.dk/transfer/test.avi (2175 KB).

NOTE: The avi was generated from MPEG2 frames copied by transcode, and 
copied into the avi with mencoder. The same frames are copied correctly 
with mplayer's own demuxer. The bug (if any) is that mplayer actually 
can crash, a rarity in itself.

The gdb backtrace:

#0  decode (sh=0x82ab588, data=0x0, len=0, flags=0) at vd_libmpeg2.c:104
#1  0x080b7871 in decode_video (sh_video=0x82ab588, start=0x82eca7c 
"$Ë.\b`Ë.\b", in_size=137284220, drop_frame=0) at dec_video.c:304
#2  0x0806d2c9 in main (argc=2, argv=0xbffff7c4) at mplayer.c:2077
#3  0x405587f7 in __libc_start_main () from /lib/i686/libc.so.6

The verbose run and a patch that shows the problem with debug output is 
attached

Curne
-- 
If a vegetarian eats vegetables,          Cell Phairony Inc.
what does a humanitarian eat?       curne at curnomatic.dk

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: test.avi.log
URL: <http://lists.mplayerhq.hu/pipermail/mplayer-users/attachments/20031001/d55255e4/attachment.asc>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: tmp.diff
URL: <http://lists.mplayerhq.hu/pipermail/mplayer-users/attachments/20031001/d55255e4/attachment.txt>