[Crash]For this .mp3 file, valgrind reports InvalidRead, UninitValue, UninitCondition, and Mplayer crashe.

[xuecongli@…]

This bug was found as part of the metafuzz project, see ​http://www.metafuzz.com

[Crash]For this .mp3 file, valgrind reports InvalidRead, UninitValue, UninitCondition, and Mplayer crashe.

System Info:

MPlayer dev-SVN-r27418-4.1.2 (C) 2000-2008 MPlayer Team
CPU: Intel Pentium 4/Celeron 4 Northwood. Pentium 4 EE/Xeon Prestonia,Gallatin (Family: 15, Model: 2, Stepping: 7)
CPUflags: MMX: 1 MMX2: 1 3DNow: 0 3DNow2: 0 SSE: 1 SSE2: 1
Compiled for x86 CPU with extensions: MMX MMX2 3DNow 3DNowEx SSE SSE2

Playing 32-in_the_end.mp3.

##############################################################

to reproduce:
wget ​http://www.metafuzz.com/testcases/378068-32-1292935739-SyscallParam.tgz
tar xzf 378068-32-1292935739-SyscallParam.tgz
valgrind mplayer 32-in_the_end.mp3

::::::::::::::::::::Valgrind result:::::::::::::::::::::::::::::

==4342== Memcheck, a memory error detector.
==4342== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==4342== Using LibVEX rev 1715, a library for dynamic binary translation.
==4342== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==4342== Using valgrind-3.2.2, a dynamic binary instrumentation framework.
==4342== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==4342== For more details, rerun with: -v
==4342==
==4342== My PID = 4342, parent PID = 4341. Prog and args are:
==4342== mplayer
==4342== 32-in_the_end.mp3
==4342==
==4342== Conditional jump or move depends on uninitialised value(s)
==4342== Stack hash: 4126823808
==4342== at 0x400A65C: (within /lib/ld-2.7.so)
==4342== by 0x4003125: (within /lib/ld-2.7.so)
==4342== by 0x40138EC: (within /lib/ld-2.7.so)
==4342== by 0x4000C3D: (within /lib/ld-2.7.so)
==4342== by 0x4000816: (within /lib/ld-2.7.so)
==4342==
==4342== Conditional jump or move depends on uninitialised value(s)
==4342== Stack hash: 4228028502
==4342== at 0x400A692: (within /lib/ld-2.7.so)
==4342== by 0x4003125: (within /lib/ld-2.7.so)
==4342== by 0x40138EC: (within /lib/ld-2.7.so)
==4342== by 0x4000C3D: (within /lib/ld-2.7.so)
==4342== by 0x4000816: (within /lib/ld-2.7.so)
==4342==
==4342== Conditional jump or move depends on uninitialised value(s)
==4342== Stack hash: 936347057
==4342== at 0x400B19D: (within /lib/ld-2.7.so)
==4342== by 0x4003125: (within /lib/ld-2.7.so)
==4342== by 0x40138EC: (within /lib/ld-2.7.so)
==4342== by 0x4000C3D: (within /lib/ld-2.7.so)
==4342== by 0x4000816: (within /lib/ld-2.7.so)
==4342==
==4342== Conditional jump or move depends on uninitialised value(s)
==4342== Stack hash: 3629006124
==4342== at 0x400A542: (within /lib/ld-2.7.so)
==4342== by 0x4003383: (within /lib/ld-2.7.so)
==4342== by 0x40138EC: (within /lib/ld-2.7.so)
==4342== by 0x4000C3D: (within /lib/ld-2.7.so)
==4342== by 0x4000816: (within /lib/ld-2.7.so)
==4342==
==4342== Conditional jump or move depends on uninitialised value(s)
==4342== Stack hash: 3643999412
==4342== at 0x400A54A: (within /lib/ld-2.7.so)
==4342== by 0x4003383: (within /lib/ld-2.7.so)
==4342== by 0x40138EC: (within /lib/ld-2.7.so)
==4342== by 0x4000C3D: (within /lib/ld-2.7.so)
==4342== by 0x4000816: (within /lib/ld-2.7.so)
==4342==
==4342== Conditional jump or move depends on uninitialised value(s)
==4342== Stack hash: 4258724220
==4342== at 0x400A692: (within /lib/ld-2.7.so)
==4342== by 0x4003383: (within /lib/ld-2.7.so)
==4342== by 0x40138EC: (within /lib/ld-2.7.so)
==4342== by 0x4000C3D: (within /lib/ld-2.7.so)
==4342== by 0x4000816: (within /lib/ld-2.7.so)
==4342==
==4342== Use of uninitialised value of size 4
==4342== Stack hash: 2621627734
==4342== at 0x81E57A6: MP3_DecodeFrame (layer2.c:167)
==4342== by 0x80DA2F8: decode_audio (dec_audio.c:383)
==4342== by 0x80798C8: main (mplayer.c:2044)
==4342==
==4342== Use of uninitialised value of size 4
==4342== Stack hash: 2620462715
==4342== at 0x81E5453: MP3_DecodeFrame (layer2.c:178)
==4342== by 0x80DA2F8: decode_audio (dec_audio.c:383)
==4342== by 0x80798C8: main (mplayer.c:2044)
==4342==
==4342== Use of uninitialised value of size 4
==4342== Stack hash: 2620491464
==4342== at 0x81E5468: MP3_DecodeFrame (layer2.c:179)
==4342== by 0x80DA2F8: decode_audio (dec_audio.c:383)
==4342== by 0x80798C8: main (mplayer.c:2044)
==4342==
==4342== Use of uninitialised value of size 4
==4342== Stack hash: 2620516106
==4342== at 0x81E547A: MP3_DecodeFrame (layer2.c:180)
==4342== by 0x80DA2F8: decode_audio (dec_audio.c:383)
==4342== by 0x80798C8: main (mplayer.c:2044)
==4342==
==4342== Invalid read of size 4
==4342== Stack hash: 880003731
==4342== at 0x81E339A: do_layer3 (layer3.c:1157)
==4342== by 0x8165551: demux_open_vqf (demux_vqf.c:38)
==4342== Address 0xBE963000 is not stack'd, malloc'd or (recently) free'd
==4342==
==4342== Invalid read of size 4
==4342== Stack hash: 897284585
==4342== at 0x417FBC4: (within /lib/libc-2.7.so)
==4342== by 0x417F806: (within /lib/libc-2.7.so)
==4342== by 0x4180023: libc_freeres (in /lib/libc-2.7.so)
==4342== by 0x401D1F6: _vgnU_freeres (vg_preloaded.c:60)
==4342== by 0x40ADBC7: exit (in /lib/libc-2.7.so)
==4342== by 0x80768F3: exit_sighandler (mplayer.c:816)
==4342== by 0x40AAE37: (within /lib/libc-2.7.so)
==4342== by 0x8165551: demux_open_vqf (demux_vqf.c:38)
==4342== Address 0x10 is not stack'd, malloc'd or (recently) free'd
==4342==
==4342== Process terminating with default action of signal 11 (SIGSEGV)
==4342== Access not within mapped region at address 0x10
==4342== Stack hash: 897284585
==4342== at 0x417FBC4: (within /lib/libc-2.7.so)
==4342== by 0x417F806: (within /lib/libc-2.7.so)
==4342== by 0x4180023: libc_freeres (in /lib/libc-2.7.so)
==4342== by 0x401D1F6: _vgnU_freeres (vg_preloaded.c:60)
==4342== by 0x40ADBC7: exit (in /lib/libc-2.7.so)
==4342== by 0x80768F3: exit_sighandler (mplayer.c:816)
==4342== by 0x40AAE37: (within /lib/libc-2.7.so)
==4342== by 0x8165551: demux_open_vqf (demux_vqf.c:38)
==4342==
==4342== ERROR SUMMARY: 249 errors from 12 contexts (suppressed: 0 from 0)
==4342== malloc/free: in use at exit: 205,105 bytes in 2,217 blocks.
==4342== malloc/free: 22,972 allocs, 20,755 frees, 6,719,429 bytes allocated.
==4342== For counts of detected errors, rerun with: -v
==4342== searching for pointers to 2,217 not-freed blocks.
==4342== checked 3,129,932 bytes.
==4342==
==4342== LEAK SUMMARY:
==4342== definitely lost: 0 bytes in 0 blocks.
==4342== possibly lost: 0 bytes in 0 blocks.
==4342== still reachable: 205,105 bytes in 2,217 blocks.
==4342== suppressed: 0 bytes in 0 blocks.
==4342== Reachable blocks (those to which a pointer was found) are not shown.
==4342== To see them, rerun with: --leak-check=full --show-reachable=yes
MPlayer interrupted by signal 11 in module: decode_audio

• MPlayer crashed by bad usage of CPU/FPU/RAM. Recompile MPlayer with --enable-debug and make a 'gdb' backtrace and disassembly. Details in DOCS/HTML/en/bugreports_what.html#bugreports_crash.
• MPlayer crashed. This shouldn't happen. It can be a bug in the MPlayer code _or_ in your drivers _or_ in your gcc version. If you think it's MPlayer's fault, please read DOCS/HTML/en/bugreports.html and follow the instructions there. We can't and won't help unless you provide this information when reporting a possible bug.

_

gdb Backtrace

/home/user/bug_report/core: No such file or directory.
[Thread debugging using libthread_db enabled]
MPlayer dev-SVN-r27418-4.1.2 (C) 2000-2008 MPlayer Team
CPU: Dual-Core AMD Opteron(tm) Processor 2218 HE (Family: 15, Model: 65, Stepping: 3)
CPUflags: MMX: 1 MMX2: 1 3DNow: 1 3DNow2: 1 SSE: 1 SSE2: 1
Compiled for x86 CPU with extensions: MMX MMX2 3DNow 3DNowEx SSE SSE2
get_path('codecs.conf') -> '/root/.mplayer/codecs.conf'
Reading /root/.mplayer/codecs.conf: Can't open '/root/.mplayer/codecs.conf': No such file or directory
Reading /usr/local/etc/mplayer/codecs.conf: Can't open '/usr/local/etc/mplayer/codecs.conf': No such file or directory
Using built-in default codecs.conf.
Configuration: --enable-debug=3
CommandLine: '-v' '32-in_the_end.mp3'
get_path('font/font.desc') -> '/root/.mplayer/font/font.desc'
font: can't open file: /root/.mplayer/font/font.desc
font: can't open file: /usr/local/share/mplayer/font/font.desc
Using MMX (with tiny bit MMX2) Optimized OnScreenDisplay
Using nanosleep() timing
get_path('input.conf') -> '/root/.mplayer/input.conf'
Can't open input config file /root/.mplayer/input.conf: No such file or directory
Can't open input config file /usr/local/etc/mplayer/input.conf: No such file or directory
Falling back on default (hardcoded) input config
get_path('32-in_the_end.mp3.conf') -> '/root/.mplayer/32-in_the_end.mp3.conf'

Playing 32-in_the_end.mp3.
get_path('sub/') -> '/root/.mplayer/sub/'
[file] File size is 3460830 bytes
STREAM: [file] 32-in_the_end.mp3
STREAM: Description: File
STREAM: Author: Albeu
STREAM: Comment: based on the code from ??? (probably Arpi)
LAVF_check: MPEG audio
Checking for YUV4MPEG2
ASF_check: not ASF guid!
Checking for NuppelVideo
Checking for REAL
Checking for SMJPEG
Searching demuxer type for filename 32-in_the_end.mp3 ext: .mp3
Trying demuxer 17 based on filename extension
==> Found audio stream: 0
demux_audio: seeking from 0x34CEDE to start pos 0x0
demux_audio: audio data 0x0 - 0x34CE5E
Audio only file format detected.
Clip info:

Title: In The nd
Artist: [Linkin Park]
Album:
Year:
Comment:
Genre: Unknown

==========================================================================
Opening audio decoder: [mp3lib] MPEG layer-2, layer-3
dec_audio: Allocating 4608 + 65536 = 70144 bytes for output buffer.
mp3lib: using 3DNow!Ex optimized decore!
MP3lib: init layer2&3 finished, tables done

MPEG 1.0, Layer III, 44100 Hz 128 kbit Joint-Stereo, BPF: 417
Channels: 2, copyright: Yes, original: Yes, CRC: No, emphasis: 0
AUDIO: 44100 Hz, 2 ch, s16le, 128.0 kbit/9.07% (ratio: 16000->176400)
Selected audio codec: [mp3] afm: mp3lib (mp3lib MPEG layer-2, layer-3)
==========================================================================
Building audio filter chain for 44100Hz/2ch/s16le -> 0Hz/0ch/??...
[libaf] Adding filter dummy
[dummy] Was reinitialized: 44100Hz/2ch/s16le
[dummy] Was reinitialized: 44100Hz/2ch/s16le
Trying every known audio driver...
ao2: 44100 Hz 2 chans s16le
audio_setup: using '/dev/dsp' dsp device
audio_setup: using '/dev/mixer' mixer device
audio_setup: using 'pcm' mixer device
[AO OSS] audio_setup: Can't open audio device /dev/dsp: No such device or address
DVB card number must be between 1 and 4
AO: [null] 44100Hz 2ch s16le (2 bytes per sample)
AO: Description: Null audio output
AO: Author: Tobias Diedrich <ranma+mplayer@…>
Building audio filter chain for 44100Hz/2ch/s16le -> 44100Hz/2ch/s16le...
[dummy] Was reinitialized: 44100Hz/2ch/s16le
[dummy] Was reinitialized: 44100Hz/2ch/s16le
Video: no video
Freeing 0 unused video chunks.
Starting playback...
Increasing filtered audio buffer size from 0 to 37888
A: 125.5 (02:05.4) of 216.0 (03:36.0) 0.4%
Program received signal SIGSEGV, Segmentation fault.
0x081e339a in do_layer3 (fr=0x87591a0, single=-1) at mp3lib/layer3.c:1157
1157 register real bu = *--xr2,bd = *xr1;
#0 0x081e339a in do_layer3 (fr=0x87591a0, single=-1) at mp3lib/layer3.c:1157
#1 0x08165552 in demux_open_vqf (demuxer=0x0) at libmpdemux/demux_vqf.c:38
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
Dump of assembler code from 0x81e337a to 0x81e33ba:
0x081e337a <do_layer3+2330>: fdivr %st(7),%st
0x081e337c <do_layer3+2332>: decl 0xf484041(%ebx)
0x081e3382 <do_layer3+2338>: test %al,%bh
0x081e3384 <do_layer3+2340>: add (%eax),%al
0x081e3386 <do_layer3+2342>: add %cl,-0x272763(%ebx)
0x081e338c <do_layer3+2348>: decl -0x7626763a(%ecx)
0x081e3392 <do_layer3+2354>: fidivl (%ecx)
0x081e3394 <do_layer3+2356>: rolb shxd9,0x2d904ea(%ebx)
0x081e339b <do_layer3+2363>: add %ebx,%ecx
0x081e339d <do_layer3+2365>: add shx85,%al
0x081e339f <do_layer3+2367>: pusha
0x081e33a0 <do_layer3+2368>: sub shxcad80876,%eax
0x081e33a5 <do_layer3+2373>: flds 0x8762d40(,%eax,4)
0x081e33ac <do_layer3+2380>: fmul %st(2),%st
0x081e33ae <do_layer3+2382>: fsubrp %st,%st(1)
0x081e33b0 <do_layer3+2384>: fstps (%edx)
0x081e33b2 <do_layer3+2386>: fmuls 0x8762d60(,%eax,4)
0x081e33b9 <do_layer3+2393>: fxch %st(1)
End of assembler dump.
eax 0x6 6
ecx 0xbfffd000 -1073754112
edx 0xbfffcfcc -1073754164
ebx 0xbfffcfe8 -1073754136
esp 0xbfff7910 0xbfff7910
ebp 0xbfffa128 0xbfffa128
esi 0xffffff0f -241
edi 0x0 0
eip 0x81e339a 0x81e339a <do_layer3+2362>
eflags 0x210296 [ PF AF SF IF RF ID ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
st0 9.3241867560323044017422944307327271e-09 (raw 0x3fe4a030350000000000)
st1 -nan(0x8001800180018001) (raw 0xffff8001800180018001)
st2 -nan(0x7fff7fff7fff7fff) (raw 0xffff7fff7fff7fff7fff)
st3 -nan(0xc20fe000126980) (raw 0xffff00c20fe000126980)
st4 -nan(0x22ea00b003d03e90) (raw 0xffff22ea00b003d03e90)
st5 -0 (raw 0x80000000000000000000)
st6 13109.035698911757208406925201416016 (raw 0x400cccd4248e416a0000)
st7 -537.47045153413637308403849601745605 (raw 0xc008865e1be0c05e0000)
fctrl 0x37f 895
fstat 0x3832 14386
ftag 0x3fff 16383
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
xmm0 {v4_float = {0x0, 0x0, 0x0, 0xc2960000}, v2_double = {0x0, 0x8000000000000000}, v16_int8 = {0xfd, 0xa3, 0xb6, 0xed, 0x77, 0xff, 0xfb,

0x92, 0x6c, 0x83, 0x1, 0x4, 0x4b, 0x61, 0xd9, 0x53}, v8_int16 = {0xa3fd, 0xedb6, 0xff77, 0x92fb, 0x836c, 0x401, 0x614b, 0x53d9}, v4_int32 = {
0xedb6a3fd, 0x92fbff77, 0x401836c, 0x53d9614b}, v2_int64 = {0x92fbff77edb6a3fd, 0x53d9614b0401836c}, uint128 = 0x53d9614b0401836c92fbff77edb6a3fd}

xmm1 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0xc, 0x33, 0x26, 0x35, 0x61, 0xfb, 0x4d, 0x2f, 0x2, 0x22, 0x8f,

0x15, 0x6d, 0x61, 0x4c, 0x30}, v8_int16 = {0x330c, 0x3526, 0xfb61, 0x2f4d, 0x2202, 0x158f, 0x616d, 0x304c}, v4_int32 = {0x3526330c, 0x2f4dfb61,
0x158f2202, 0x304c616d}, v2_int64 = {0x2f4dfb613526330c, 0x304c616d158f2202}, uint128 = 0x304c616d158f22022f4dfb613526330c}

xmm2 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x8000000000000000}, v16_int8 = {0x4d, 0x90, 0xac, 0xa, 0xac, 0xe8, 0xf6, 0x14, 0xca,

0xc, 0x2d, 0x9f, 0xe9, 0x1c, 0x60, 0x73}, v8_int16 = {0x904d, 0xaac, 0xe8ac, 0x14f6, 0xcca, 0x9f2d, 0x1ce9, 0x7360}, v4_int32 = {0xaac904d,
0x14f6e8ac, 0x9f2d0cca, 0x73601ce9}, v2_int64 = {0x14f6e8ac0aac904d, 0x73601ce99f2d0cca}, uint128 = 0x73601ce99f2d0cca14f6e8ac0aac904d}

xmm3 {v4_float = {0x55351e8, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x3d, 0x6a, 0xaa, 0x4c, 0xd2, 0x18, 0xa0, 0x23, 0xa1, 0xa6,

0x30, 0xa6, 0xe, 0x3a, 0x81, 0x95}, v8_int16 = {0x6a3d, 0x4caa, 0x18d2, 0x23a0, 0xa6a1, 0xa630, 0x3a0e, 0x9581}, v4_int32 = {0x4caa6a3d, 0x23a018d2,
0xa630a6a1, 0x95813a0e}, v2_int64 = {0x23a018d24caa6a3d, 0x95813a0ea630a6a1}, uint128 = 0x95813a0ea630a6a123a018d24caa6a3d}

xmm4 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,

0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}

xmm5 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,

0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}

xmm6 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,

0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}

xmm7 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,

0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}

mxcsr 0x1fa0 [ PE IM DM ZM OM UM PM ]
mm0 {uint64 = 0x865e1be0c05e0000, v2_int32 = {0xc05e0000, 0x865e1be0}, v4_int16 = {0x0, 0xc05e, 0x1be0, 0x865e}, v8_int8 = {0x0, 0x0, 0x5e,

0xc0, 0xe0, 0x1b, 0x5e, 0x86}}

mm1 {uint64 = 0xa030350000000000, v2_int32 = {0x0, 0xa0303500}, v4_int16 = {0x0, 0x0, 0x3500, 0xa030}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0,

0x35, 0x30, 0xa0}}

mm2 {uint64 = 0x8001800180018001, v2_int32 = {0x80018001, 0x80018001}, v4_int16 = {0x8001, 0x8001, 0x8001, 0x8001}, v8_int8 = {0x1, 0x80, 0x1,

0x80, 0x1, 0x80, 0x1, 0x80}}

mm3 {uint64 = 0x7fff7fff7fff7fff, v2_int32 = {0x7fff7fff, 0x7fff7fff}, v4_int16 = {0x7fff, 0x7fff, 0x7fff, 0x7fff}, v8_int8 = {0xff, 0x7f,

0xff, 0x7f, 0xff, 0x7f, 0xff, 0x7f}}

mm4 {uint64 = 0xc20fe000126980, v2_int32 = {0x126980, 0xc20fe0}, v4_int16 = {0x6980, 0x12, 0xfe0, 0xc2}, v8_int8 = {0x80, 0x69, 0x12, 0x0,

0xe0, 0xf, 0xc2, 0x0}}

mm5 {uint64 = 0x22ea00b003d03e90, v2_int32 = {0x3d03e90, 0x22ea00b0}, v4_int16 = {0x3e90, 0x3d0, 0xb0, 0x22ea}, v8_int8 = {0x90, 0x3e, 0xd0,

0x3, 0xb0, 0x0, 0xea, 0x22}}

mm6 {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0, 0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm7 {uint64 = 0xccd4248e416a0000, v2_int32 = {0x416a0000, 0xccd4248e}, v4_int16 = {0x0, 0x416a, 0x248e, 0xccd4}, v8_int8 = {0x0, 0x0, 0x6a,

0x41, 0x8e, 0x24, 0xd4, 0xcc}}

The program is running. Quit anyway (and kill it)? (y or n) [answered Y; input not from terminal]