lame 3.98.1 segfaults with -h

Does this happen to you with every file, or just one file?
Did it work with version 3.98?

It happens with any file. Even testcase.wav inside the source package. 3.98 worked. Distro is Fedora 9 (gcc 4.3.0).

Here is a backtrace:

#0 0x0013a5e9 in quantize_lines_xrpow (l=32, istep=4.23919682e+11,
xp=0xbfd6b578, pi=0x94b13f4) at takehiro.c:167
#1 0x0013aba0 in quantize_xrpow (xp=0xbfd6b788, pi=0x94b13f4,
istep=4.23919682e+11, cod_info=0x94b0af4, prev_noise=0x0) at takehiro.c:401
#2 0x0013b5e8 in count_bits (gfc=0x94a6530, xr=0xbfd6b578, gi=0x94b0af4,
prev_noise=0x0) at takehiro.c:769
#3 0x001328a5 in bin_search_StepSize (gfc=0x94a6530, cod_info=0x94b0af4,
desired_rate=2133, ch=0, xrpow=0xbfd6b578) at quantize.c:364
#4 0x0013378c in outer_loop (gfp=0x94a5b30, cod_info=0x94b0af4,
l3_xmin=0xbfd6be78, xrpow=0xbfd6b578, ch=0, targ_bits=2133)
at quantize.c:1017
#5 0x00136468 in CBR_iteration_loop (gfp=0x94a5b30, pe=0xbfd6bfb0,
ms_ener_ratio=0xbfd6bfc0, ratio=0xbfd6c790) at quantize.c:2017
#6 0x0011c50c in lame_encode_mp3_frame (gfp=0x94a5b30, inbuf_l=0x94a6540,
inbuf_r=0x94aa380, mp3buf=0xbfd6f4a8 "��", mp3buf_size=147456)
at encoder.c:531
#7 0x00123e61 in lame_encode_frame (gfp=0x94a5b30, inbuf_l=0x94a6540,
inbuf_r=0x94aa380, mp3buf=0xbfd6f4a8 "��", mp3buf_size=147456)
at lame.c:1439
#8 0x0012462d in lame_encode_buffer_sample_t (gfp=0x94a5b30,
buffer_l=0x94be428, buffer_r=0x94bf630, nsamples=0,
mp3buf=0xbfd6f4a8 "��", mp3buf_size=147456) at lame.c:1622
#9 0x00124a41 in lame_encode_buffer_int (gfp=0x94a5b30, buffer_l=0xbfd6d0a8,
buffer_r=0xbfd6e2a8, nsamples=1152, mp3buf=0xbfd6f4a8 "��",
mp3buf_size=147456) at lame.c:1744
#10 0x0804b933 in lame_encoder (gf=0x94a5b30, outf=0x94bc170, nogap=0,
inPath=0xbfe5b8e5 "testcase.wav", outPath=0xbfe5d8e7 "testcase.wav.mp3")
at main.c:485
#11 0x0804c4dc in main (argc=5, argv=0xbfe5e9a4) at main.c:855

valgrind output:

==14647== Conditional jump or move depends on uninitialised value(s)
==14647== at 0x405D6A2: count_bits (takehiro.c:786)
==14647== by 0x40548A4: bin_search_StepSize (quantize.c:364)
==14647== by 0x405578B: outer_loop (quantize.c:1017)
==14647== by 0x4058467: CBR_iteration_loop (quantize.c:2017)
==14647== by 0x403E50B: lame_encode_mp3_frame (encoder.c:531)
==14647== by 0x4045E60: lame_encode_frame (lame.c:1439)
==14647== by 0x404662C: lame_encode_buffer_sample_t (lame.c:1622)
==14647== by 0x4046A40: lame_encode_buffer_int (lame.c:1744)
==14647== by 0x804B932: lame_encoder (main.c:485)
==14647== by 0x804C4DB: main (main.c:855)
==14647==
==14647== Invalid read of size 4
==14647== at 0x405C5E9: quantize_lines_xrpow (takehiro.c:167)
==14647== by 0x405CB9F: quantize_xrpow (takehiro.c:401)
==14647== by 0x405D5E7: count_bits (takehiro.c:769)
==14647== by 0x40548A4: bin_search_StepSize (quantize.c:364)
==14647== by 0x405578B: outer_loop (quantize.c:1017)
==14647== by 0x4058467: CBR_iteration_loop (quantize.c:2017)
==14647== by 0x403E50B: lame_encode_mp3_frame (encoder.c:531)
==14647== by 0x4045E60: lame_encode_frame (lame.c:1439)
==14647== by 0x404662C: lame_encode_buffer_sample_t (lame.c:1622)
==14647== by 0x4046A40: lame_encode_buffer_int (lame.c:1744)
==14647== by 0x804B932: lame_encoder (main.c:485)
==14647== by 0x804C4DB: main (main.c:855)
==14647== Address 0x149186b4 is not stack'd, malloc'd or (recently) free'd
==14647==
==14647== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==14647== Access not within mapped region at address 0x149186B4
==14647== at 0x405C5E9: quantize_lines_xrpow (takehiro.c:167)
==14647== by 0x405CB9F: quantize_xrpow (takehiro.c:401)
==14647== by 0x405D5E7: count_bits (takehiro.c:769)
==14647== by 0x40548A4: bin_search_StepSize (quantize.c:364)
==14647== by 0x405578B: outer_loop (quantize.c:1017)
==14647== by 0x4058467: CBR_iteration_loop (quantize.c:2017)
==14647== by 0x403E50B: lame_encode_mp3_frame (encoder.c:531)
==14647== by 0x4045E60: lame_encode_frame (lame.c:1439)
==14647== by 0x404662C: lame_encode_buffer_sample_t (lame.c:1622)
==14647== by 0x4046A40: lame_encode_buffer_int (lame.c:1744)
==14647== by 0x804B932: lame_encoder (main.c:485)
==14647== by 0x804C4DB: main (main.c:855)

Try removing line 779 in takehiro.c:
j += width;

This works great! Thanks for the fast fix!

Ok, thanks for finding it.