[gstreamer-bugs] [Bug 573369] [gstfaad] Crashes using faad2-2.7 (memory corruption ?)

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=573369

  GStreamer | gst-plugins-bad | Ver: git




------- Comment #3 from Edward Hervey  2009-03-01 15:12 UTC -------
Created an attachment (id=129783)
 --> (http://bugzilla.gnome.org/attachment.cgi?id=129783&action=view)
Avoid stack screwup

The problem is that in faad2-2.7, somebody changed the *INTERNAL* prototype of
the DecInit2 method without changing the public '/usr/include' header.

previously:
int8_t NEAACDECAPI NeAACDecInit2(NeAACDecHandle hDecoder, uint8_t *pBuffer,
                                 uint32_t SizeOfDecoderSpecificInfo,
                                 uint32_t *samplerate, uint8_t *channels)

faad-2.7:
char NEAACDECAPI NeAACDecInit2(NeAACDecHandle hpDecoder,
                               unsigned char *pBuffer,
                               unsigned long SizeOfDecoderSpecificInfo,
                               unsigned long *samplerate,
                               unsigned char *channels)

While this looks very innocent, the problem is that we *WERE* passing it
previously a pointer to a guint32 value, which was coherent with the previous
(internal) prototype.

But on 64bit ... unsigned long is 64bit wide. So we're passing it a pointer to
a guint32 value, and it's assuming it's a 64bit value, ergo writing 8 bytes
instead of 4 at *samplerate... and writing over the stack.


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=573369.