[Bug 680558] rtpmparobustdepay: invalid memory access with mp3 rtsp stream

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=680558
  GStreamer | gst-plugins-good | 0.11.x

--- Comment #4 from Tim-Philipp Müller <t.i.m at zen.co.uk> 2012-08-04 11:22:45 UTC ---
So for one it looks like the byte writer is created with a fixed size, but then
we put_data_unchecked() more data into it than we allocated:

 Invalid write of size 2
    at 0x4C2A743: memcpy (mc_replace_strmem.c:838)
    by 0xB0E5D4B: gst_byte_writer_put_data_unchecked (gstbytewriter.h:255)
    by 0xB0E789A: gst_rtp_mpa_robust_depay_push_mp3_frames
(gstrtpmparobustdepay.c:599)
    by 0xB0E79E7: gst_rtp_mpa_robust_depay_submit_adu
(gstrtpmparobustdepay.c:636)
    by 0xB0E7E42: gst_rtp_mpa_robust_depay_process (gstrtpmparobustdepay.c:733)
    by 0x8F60A36: gst_rtp_base_depayload_chain (gstrtpbasedepayload.c:332)
  Address 0x6d612c4 is 1,044 bytes inside a block of size 1,045 alloc'd
    at 0x4C28BED: malloc (vg_replace_malloc.c:263)
    by 0x57C9DE0: g_malloc (gmem.c:159)
    by 0x8D36BD9: gst_byte_writer_new_with_size (gstbytewriter.c:77)
    by 0xB0E71E7: gst_rtp_mpa_robust_depay_push_mp3_frames
(gstrtpmparobustdepay.c:528)
    by 0xB0E79E7: gst_rtp_mpa_robust_depay_submit_adu
(gstrtpmparobustdepay.c:636)
    by 0xB0E7E42: gst_rtp_mpa_robust_depay_process (gstrtpmparobustdepay.c:733)
    by 0x8F60A36: gst_rtp_base_depayload_chain (gstrtpbasedepayload.c:332)

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.