Valgrind reports invalid read at dct36

[zlai88@…]

The mp3 file t850_delta.mp3 (in the .tgz archive at the url above) caused
an error in the latest version of Mplayer. Valgrind reports invalid read at dct36.

This is reproducible on Linux Debian Etch, with the latest Subversion head
mplayer (r27184). The machine used is VMWare Player.

Reproduce as follows:
wget ​http://www.eecs.berkeley.edu/~zhl210/248168-0-8131969280-result256.tgz
tar xzf 248168-0-8131969280-result256.tgz
Valgrind mplayer t850_delta.mp3

Here is the output from Valgrind:

==9292== Memcheck, a memory error detector.
==9292== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==9292== Using LibVEX rev 1854, a library for dynamic binary translation.
==9292== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==9292== Using valgrind-3.3.1, a dynamic binary instrumentation framework.
==9292== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==9292== For more details, rerun with: -v
==9292==
==9292== My PID = 9292, parent PID = 2881. Prog and args are:
==9292== mplayer
==9292== t850_delta.mp3
==9292==
==9292== Invalid read of size 4
==9292== Stack hash: 3602433950
==9292== at 0x81E041B: dct36 (dct36.c:169)
==9292== by 0x81E496D: do_layer3 (layer3.c:1212)
==9292== by 0x81E6055: MP3_DecodeFrame (sr1.c:539)
==9292== by 0x80D8424: decode_audio (dec_audio.c:383)
==9292== by 0x8075E59: main (mplayer.c:2044)
==9292== Address 0xd451f1fc is not stack'd, malloc'd or (recently) free'd
==9292==
==9292== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 17 from 1)
==9292== malloc/free: in use at exit: 231,953 bytes in 2,205 blocks.

==9292==
==9292== Invalid read of size 4
==9292== Stack hash: 3602433950
==9292== at 0x81E041B: dct36 (dct36.c:169)
==9292== by 0x81E496D: do_layer3 (layer3.c:1212)
==9292== by 0x81E6055: MP3_DecodeFrame (sr1.c:539)
==9292== by 0x80D8424: decode_audio (dec_audio.c:383)
==9292== by 0x8075E59: main (mplayer.c:2044)
==9292== Address 0xd451f1fc is not stack'd, malloc'd or (recently) free'd
==9292==
==9292== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 17 from 1)
==9292== malloc/free: in use at exit: 231,953 bytes in 2,205 blocks.
==9292== malloc/free: 3,682 allocs, 1,477 frees, 1,750,754 bytes allocated.
==9292== For counts of detected errors, rerun with: -v
==9292== searching for pointers to 2,205 not-freed blocks.
==9292== checked 2,949,460 bytes.
==9292==
==9292== LEAK SUMMARY:
==9292== definitely lost: 0 bytes in 0 blocks.
==9292== possibly lost: 0 bytes in 0 blocks.
==9292== still reachable: 231,953 bytes in 2,205 blocks.
==9292== suppressed: 0 bytes in 0 blocks.
==9292== Rerun with --leak-check=full to see details of leaked memory.

This bug was found as part of the SUPERB-TRUST 2008 project.

[reimar]

* This bug has been marked as a duplicate of bug 1117 *