[Openquicktime-devel] segfault in oqt_update_tables()

[Jean-Francois P. <pan...@co...>]

If you try to encode an audio track where the number of samples is an 
exact multiple of the underlying "chunk size", you end up segfaulting in 
oqt_update_tables(). The following recipe:

sox -t raw -r 48000 -c 2 -s -w /dev/zero foo.wav trim 0 1
ppmmake black 720 480 > black.ppm
oqtencoder -d . -V mjpa -s foo.wav foo.mov

will generate a second of silence in foo.wav, and when you try to encode 
it with oqtencoder, you get:

#0  0x4006408f in oqt_update_tables (file=0x8059b30, trak=0x805cd58, 
url=0x0,
    offset=1228808, chunk=5, sample=4, num_samples=0, sample_size=0,
    num_frames=1, frame_size_array=0x0) at trak.c:459
#1  0x40052be5 in oqt_write_audio_data (file=0x8059b30, track=0,
    output=0x8086688 "", bytes=0, num_samples=0, num_frames=1,
    frame_size_array=0x0) at codecs.c:972
#2  0x40052f42 in oqt_encode_audio (file=0x8059b30, track=0, input=0x0,
    input_samples=0) at codecs.c:1108
#3  0x0804b7ed in main (argc=8, argv=0xbfffd7e4) at oqtencoder.c:1086
#4  0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6

The offending code is the following:

if(sample_size && num_frames <=1)
        oqt_update_stsz(&(trak->mdia.minf.stbl.stsz), sample, sample_size);
else {
      int i;
       oqt_stsz_t *stsz = &(trak->mdia.minf.stbl.stsz);
       int cur_total_entries = stsz->total_entries;
       for(i = cur_total_entries; i < cur_total_entries+num_frames; i++) {
              oqt_update_stsz(stsz, i, 
frame_size_array[i-cur_total_entries]);
                                                     ^^^ nil pointer 
deref ^^^
       }
}

The problem is that in all cases, oqt_update_tables() ends up called 
with frame_size_array set to NULL and num_frames set to 1, so clearly 
the "else" part of the if() statement is wrong (since it ends up 
dereferencing a nil pointer). That being said, I don't know that code 
sufficiently to determine what is the correct thing to do.

JF