[MPlayer-users] segfault on Alpha in libmpdemux/demux_mov.c

[Andrew A. Gill]

On Wed, 3 Mar 2004, Ivan Kalvachev wrote:

> Andrew A. Gill said:
> > On Tue, 2 Mar 2004, Andrew A. Gill wrote:
> >
> >> I'm getting a segfault on a DEC Alpha with the Sorenson codec.
> >>
> >> I've traced the issue to the following line:
> >>
> >> 	trak->chunks=realloc(trak->chunks,sizeof(mov_chunk_t)*len);
> >
> > More info.  at the line directly above this one,
> > 	trak->chunks = 0
> > 	sizeof(mov_chunk_t) = 24
> > 	len =  368
> >
> > Now, I'm not entirely sure, but isn't the first argument of
> > realloc() supposed to be a pointer?  And isn't  not in
> > userspace?
> 0 probably meen the special pointer NULL;
> If i remember right realloc may take pointer NULL as input,
> it which case it will (m)alloc the data with the given len.
> (just like features of using realloc as free() if size=0 is given)
> I suppose that the system library doesn't do that.
> So make an check for NULL pointer and malloc it.

Sigh.  Well, that's not it.

It also barfs on

	trak->chunks=malloc(sizeof(mov_chunk_t)*len);

Once again,

	sizeof(mov_chunk_t) = 24
	len =  368

so it essentially segfaults on

	trak->chunks=malloc(8832)                           // 1

So I changed that line to that, and now (say it with me y'all),
it segfaults before it even gets to that line.  Lousy optimiser!
So I added more tracking code, and it segfaults at another
realloc().  Lather, rinse, repeat.

Now it's back to the first point, and segfaulting on // 1.

So presumably, the problem is in the lvalue.  This is odd,
because the lvalue looks fine to me.  Arrow operator returns
pointer, right?

-- 
|Andrew A. Gill                       |I posted to Silent-Tristero and|
|<superluser at frontiernet.net>         |all I got was this stupid sig! |
|alt.tv.simpsons CBG-FAQ author       |                               |
|                          (Report all obscene mail to Le Maitre Pots)|
|Yet: <http://www.needsfoodbadly.com>                 Temporary sig: --

Help!