[gstreamer-bugs] [Bug 397229] demuxer/decoder bugs exposed by file fuzzing

[GStreamer (bugzilla.gnome.org)]

Do not reply to this via email (we are currently unable to handle email
responses and they get discarded).  You can add comments to this bug at
http://bugzilla.gnome.org/show_bug.cgi?id=397229

  GStreamer | gst-plugins | Ver: HEAD CVS





------- Comment #2 from Stefan Kost (gstreamer, gtkdoc dev)  2007-01-16 13:00 UTC -------
better trace:
0:00:06.371188000 24437 0x815dc28 LOG               oggdemux
gstoggdemux.c:2300:gst_ogg_demux_read_chain:<oggdemux0> read bos pages, init
decoder now
0:00:06.371236000 24437 0x815dc28 LOG               oggdemux
gstoggdemux.c:2321:gst_ogg_demux_read_chain:<oggdemux0> serial = 745681227,
streams = 1
0:00:06.371284000 24437 0x815dc28 LOG               oggdemux
gstoggdemux.c:2336:gst_ogg_demux_read_chain:<oggdemux0> submitting page for
stream 0
0:00:04.850123000 25505 0x815dad0 LOG               oggdemux
gstoggdemux.c:1184:gst_ogg_pad_submit_page:<oggdemux0>
pagein(0x816e128,0xb7824274)
Caught SIGSEGV accessing address 0x8195000
*** glibc detected *** /usr/bin/gst-launch-0.10: malloc(): memory corruption:
0x0818a5b8 ***

this call then segfaults
  if (ogg_stream_pagein (&pad->stream, page) != 0)
    goto choked;

Filed upstream as https://trac.xiph.org/ticket/1118


-- 
Configure bugmail: http://bugzilla.gnome.org/userprefs.cgi?tab=email