Re: [Openquicktime-devel] segfault in oqt_update_tables()

[Nicholas H. <nj...@ec...>]

Argh, yeah.

Takes quite a lot of getting into this code in order to understand it !

Haven't really got time to study it in detail at the moment.

Yann has a lot of changes to the main OQT library, which I never got 
a change to integrate into CVS - this may well get fixed by it.



You got a newer version I can try hacking into CVS again Yann ?


Cheers,

nick.



>If you try to encode an audio track where the number of samples is 
>an exact multiple of the underlying "chunk size", you end up 
>segfaulting in oqt_update_tables(). The following recipe:
>
>sox -t raw -r 48000 -c 2 -s -w /dev/zero foo.wav trim 0 1
>ppmmake black 720 480 > black.ppm
>oqtencoder -d . -V mjpa -s foo.wav foo.mov
>
>will generate a second of silence in foo.wav, and when you try to 
>encode it with oqtencoder, you get:
>
>#0  0x4006408f in oqt_update_tables (file=0x8059b30, trak=0x805cd58, url=0x0,
>    offset=1228808, chunk=5, sample=4, num_samples=0, sample_size=0,
>    num_frames=1, frame_size_array=0x0) at trak.c:459
>#1  0x40052be5 in oqt_write_audio_data (file=0x8059b30, track=0,
>    output=0x8086688 "", bytes=0, num_samples=0, num_frames=1,
>    frame_size_array=0x0) at codecs.c:972
>#2  0x40052f42 in oqt_encode_audio (file=0x8059b30, track=0, input=0x0,
>    input_samples=0) at codecs.c:1108
>#3  0x0804b7ed in main (argc=8, argv=0xbfffd7e4) at oqtencoder.c:1086
>#4  0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6
>
>The offending code is the following:
>
>if(sample_size && num_frames <=1)
>        oqt_update_stsz(&(trak->mdia.minf.stbl.stsz), sample, sample_size);
>else {
>      int i;
>       oqt_stsz_t *stsz = &(trak->mdia.minf.stbl.stsz);
>       int cur_total_entries = stsz->total_entries;
>       for(i = cur_total_entries; i < cur_total_entries+num_frames; i++) {
>              oqt_update_stsz(stsz, i, frame_size_array[i-cur_total_entries]);
>                                                     ^^^ nil pointer deref ^^^
>       }
>}
>
>The problem is that in all cases, oqt_update_tables() ends up called 
>with frame_size_array set to NULL and num_frames set to 1, so 
>clearly the "else" part of the if() statement is wrong (since it 
>ends up dereferencing a nil pointer). That being said, I don't know 
>that code sufficiently to determine what is the correct thing to do.
>
>JF
>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: Oracle 10g
>Get certified on the hottest thing ever to hit the market... Oracle 
>10g. Take an Oracle 10g class now, and we'll give you the exam FREE.
>http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
>_______________________________________________
>Openquicktime-devel mailing list
>Ope...@li...
>https://lists.sourceforge.net/lists/listinfo/openquicktime-devel