AVI demuxer crashes with specific file

[curaga]

Summary of the bug:

When trying to play the file "TF2017.HC.HDRip.XviD.AC3-EVO.avi", mplayer crashes. If I use -demuxer lavf or -saveidx, the file plays correctly.

The file can be downloaded from:
​http://rlsbb.ru/the-foreigner-2017-hc-hdrip-xvid-ac3-evo/

The mplayer build is a few months old, but there are no commits to libmpdemux/ in that time frame that could have any effect on this. This is the second file I've come across that shows this crash, so clearly some muxer creates these on purpose.

How to reproduce:

% mplayer -v  file.avi
MPlayer SVN-r37940-5.2.0 (C) 2000-2017 MPlayer Team
CPU vendor name: AuthenticAMD  max cpuid level: 6
CPU: AMD Phenom(tm) II X6 1055T Processor (Family: 16, Model: 10, Stepping: 0)
extended cpuid-level: 27
extended cache-info: 33587520
Detected cache-line size is 64 bytes
CPUflags:  MMX: 1 MMX2: 1 3DNow: 1 3DNowExt: 1 SSE: 1 SSE2: 1 SSE3: 1 SSSE3: 0 SSE4: 0 SSE4.2: 0 AVX: 0
Compiled for x86 CPU with extensions: MMX MMX2 3DNow 3DNowExt SSE SSE2 SSE3 CMOV
get_path('codecs.conf') -> '/home/celebear/.mplayer/codecs.conf'
Reading optional codecs config file /home/celebear/.mplayer/codecs.conf: No such file or directory
Reading optional codecs config file /etc/mplayer/codecs.conf: 225 audio & 464 video codecs
init_freetype
Using MMX (with tiny bit MMX2) Optimized OnScreenDisplay
get_path('fonts') -> '/home/celebear/.mplayer/fonts'
Configuration: --prefix=/usr --disable-real --disable-xanim --confdir=/etc/mplayer --enable-menu --disable-fribidi --disable-win32dll --disable-qtx --disable-vidix --disable-vidix-pcidb --extra-cflags=-I/usr/X11R7/include --extra-ldflags=-L/usr/X11R7/lib --disable-cddb --cc=/opt/gcc52/bin/gcc --disable-relocatable --enable-openssl-nondistributable --disable-mencoder --disable-pvr
CommandLine: '-v' 'TF2017.HC.HDRip.XviD.AC3-EVO.avi'
Using nanosleep() timing
get_path('input.conf') -> '/home/celebear/.mplayer/input.conf'
Reading optional input config file /home/celebear/.mplayer/input.conf: No such file or directory
Parsing input config file /etc/mplayer/input.conf
Input config file /etc/mplayer/input.conf parsed: 92 binds
get_path('TF2017.HC.HDRip.XviD.AC3-EVO.avi.conf') -> '/home/celebear/.mplayer/TF2017.HC.HDRip.XviD.AC3-EVO.avi.conf'

Playing TF2017.HC.HDRip.XviD.AC3-EVO.avi.
get_path('sub/') -> '/home/celebear/.mplayer/sub/'
[file] File size is 1475881242 bytes
STREAM: [file] TF2017.HC.HDRip.XviD.AC3-EVO.avi
STREAM: Description: File
STREAM: Author: Albeu
STREAM: Comment: based on the code from ??? (probably Arpi)
CACHE_PRE_INIT: 0 [0] 0  pre:3355443  eof:0
Cache fill:  0.00% (0 bytes)

libavformat version 57.72.101 (internal)
Configuration: --enable-gpl --enable-postproc
LAVF_check: AVI (Audio Video Interleaved)
AVI file format detected.
list_end=0xFFAE
======= AVI Header =======
us/frame: 41667  (fps=24.000)
max bytes/sec: 0
padding: 0
MainAVIHeader.dwFlags: (272) HAS_INDEX IS_INTERLEAVED
frames  total: 231   initial: 0
streams: 2
Suggested BufferSize: 0
Size:  720 x 304
==========================
list_end=0x1C4
==> Found video stream: 0
[aviheader] Video stream found, -vid 0
====== STREAM Header =====
Type: vids   FCC: xvid (64697678)
Flags: 0
Priority: 0   Language: 0
InitialFrames: 0
Rate: 10000000/416667 = 24.000
Start: 0   Len: 161655
Suggested BufferSize: 355382
Quality 10000
Sample size: 0
==========================
Found 'bih', 40 bytes of 40
======= VIDEO Format ======
  biSize 40
  biWidth 720
  biHeight 304
  biPlanes 1
  biBitCount 24
  biCompression 1145656920='XVID'
  biSizeImage 1313280
===========================
Regenerating keyframe table for MPEG-4 video.
====== AVI Super Index Header ========
  FCC (indx) dwSize (232) wLongsPerEntry(4)
  bIndexSubType (0) bIndexType (0)
  nEntriesInUse (13) dwChunkId (00dc)
  dwReserved[0] (0) dwReserved[1] (0) dwReserved[2] (0)
===========================
ODML (00dc): [0] 0x0000000000119fc8 0x0758 231
ODML (00dc): [1] 0x000000000807b298 0x1cf70 14826
ODML (00dc): [2] 0x0000000010760bbc 0x1d5a0 15024
ODML (00dc): [3] 0x0000000018b020f8 0x1d428 14977
ODML (00dc): [4] 0x0000000020f3b816 0x1d660 15048
ODML (00dc): [5] 0x000000002927aef2 0x1d2a0 14928
ODML (00dc): [6] 0x000000003131023e 0x1d790 15086
ODML (00dc): [7] 0x000000003970dfe8 0x1d4b0 14994
ODML (00dc): [8] 0x000000003e9603d0 0x117e8 8953
ODML (00dc): [9] 0x0000000041c8ee96 0xb9f8 5947
ODML (00dc): [10] 0x000000004a1e50b0 0x1d648 15045
ODML (00dc): [11] 0x0000000051d08e50 0x1d868 15113
ODML (00dc): [12] 0x0000000057f5d30c 0x166f8 11483
list_end=0x336
==> Found audio stream: 1
[aviheader] Audio stream found, -aid 1
====== STREAM Header =====
Type: auds   FCC:  (0)
Flags: 0
Priority: 0   Language: 0
InitialFrames: 0
Rate: 24000/1 = 24000.000
Start: 0   Len: 161654784
Suggested BufferSize: 3072
Quality -1
Sample size: 1
==========================
Found 'wf', 18 bytes of 18
======= WAVE Format =======
Format Tag: 8192 (0x2000)
Channels: 2
Samplerate: 48000
avg byte/sec: 24000
Block align: 1
bits/sample: 0
cbSize: 0
==========================================================================
====== AVI Super Index Header ========
  FCC (indx) dwSize (232) wLongsPerEntry(4)
  bIndexSubType (0) bIndexType (0)
  nEntriesInUse (13) dwChunkId (01wb)
  dwReserved[0] (0) dwReserved[1] (0) dwReserved[2] (0)
===========================
ODML (01wb): [0] 0x000000000011a720 0x04f0 236544
ODML (01wb): [1] 0x0000000008098208 0x12dc0 14825472
ODML (01wb): [2] 0x000000001077e15c 0x131c8 15023616
ODML (01wb): [3] 0x0000000018b1f520 0x130d8 14977536
ODML (01wb): [4] 0x0000000020f58e76 0x13248 15048192
ODML (01wb): [5] 0x0000000029298192 0x12fd8 14928384
ODML (01wb): [6] 0x000000003132d9ce 0x13308 15085056
ODML (01wb): [7] 0x000000003972b498 0x13130 14994432
ODML (01wb): [8] 0x000000003e971bb8 0xb648 8953344
ODML (01wb): [9] 0x0000000041c9a88e 0x7918 5945856
ODML (01wb): [10] 0x000000004a2026f8 0x13238 15045120
ODML (01wb): [11] 0x0000000051d266b8 0x133a0 15114240
ODML (01wb): [12] 0x0000000057f73a04 0xe9a0 11476992
list_end=0x442
AVI: dmlh found (size=248) (total_frames=161655)
list_end=0x10056
hdr=Software  size=41
Software  : AVI-Mux GUI 1.17.8.3, Feb 16 201019:42:50
hdr=Title  size=11
Title     : Tf2017 Hc
hdr=Comments  size=7
Comments  : {name}
list_end=0x10086
list_end=0x11B14C
Found movie at 0x1053C - 0x11B14C
Reading INDEX block, 385 chunks for 231 frames (fpos=1159508).
Additional RIFF header...
list_end=0x3E97D73C
Found movie at 0x1053C - 0x3E97D73C
Additional RIFF header...
list_end=0x57F828E0
Found movie at 0x1053C - 0x57F828E0
AVI: ODML: Building ODML index (2 superindexchunks).
====== AVI Standard Index Header ========
  FCC (iÄŽÉ) dwSize (-1173230585) wLongsPerEntry(44683)
  bIndexSubType (75) bIndexType (26)
  nEntriesInUse (1539944810) dwChunkId (ŒSrŽ)
  qwBaseOffset (0xDEB548623A006E82) dwReserved3 (372092170)
===========================
====== AVI Standard Index Header ========
  FCC (ËŠv) dwSize (-987597003) wLongsPerEntry(56252)
  bIndexSubType (6) bIndexType (238)
  nEntriesInUse (-1456633648) dwChunkId (LÖ‚)
  qwBaseOffset (0xC8E1841AEC506DA3) dwReserved3 (-2058891878)
===========================


MPlayer interrupted by signal 11 in module: demux_open
- MPlayer crashed by bad usage of CPU/FPU/RAM.
  Recompile MPlayer with --enable-debug and make a 'gdb' backtrace and
  disassembly. Details in DOCS/HTML/en/bugreports_what.html#bugreports_crash.
- MPlayer crashed. This shouldn't happen.
  It can be a bug in the MPlayer code _or_ in your drivers _or_ in your
  gcc version. If you think it's MPlayer's fault, please read
  DOCS/HTML/en/bugreports.html and follow the instructions there. We can't and
  won't help unless you provide this information when reporting a possible bug

[compn]

sample is 404 and missing crash dump