Opened 23 months ago

Closed 3 weeks ago

#2388 closed defect (fixed)

assert failure at libavutil/imgutils.c:350

Reported by: bug Owned by: beastd
Priority: normal Component: mencoder
Version: HEAD Severity: normal
Keywords: crash Cc:
Blocked By: Blocking:
Reproduced by developer: no Analyzed by developer: no

Description

Hi again,

when running mencoder -ovc lavc -o out.mpeg ./crash, an assert failure is triggered. The following assertion failed.

Assertion ((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth failed at libavutil/imgutils.c:350

This was also tested on a "normal" installation in a natural environment. Please fix this issue, thanks. POC is appended.

Best Regards, Julian aka BitFriends

Attachments (1)

poc_assert.zip (545.0 KB ) - added by bug 23 months ago.

Download all attachments as: .zip

Change History (7)

by bug, 23 months ago

Attachment: poc_assert.zip added

comment:1 by reimar, 23 months ago

I am a little concerned about unintended consequences, but this fixes it:

--- libmpcodecs/mp_image.c	(revision 38369)
+++ libmpcodecs/mp_image.c	(working copy)
@@ -163,6 +163,11 @@
         mpi->bpp = mp_get_chroma_shift(out_fmt, &mpi->chroma_x_shift, &mpi->chroma_y_shift, NULL);
         mpi->chroma_width  = mpi->width  >> mpi->chroma_x_shift;
         mpi->chroma_height = mpi->height >> mpi->chroma_y_shift;
+        // ensure enough space for odd sizes
+        if ((mpi->chroma_width << mpi->chroma_x_shift) < mpi->width)
+            ++mpi->chroma_width;
+        if ((mpi->chroma_height << mpi->chroma_y_shift) < mpi->height)
+            ++mpi->chroma_height;
     }
     switch(out_fmt){
     case IMGFMT_I420:
@@ -241,7 +246,7 @@
         mpi->bpp=12;
         mpi->num_planes=2;
         mpi->chroma_width=(mpi->width>>0);
-        mpi->chroma_height=(mpi->height>>1);
+        mpi->chroma_height=(mpi->height+1)>>1;
         mpi->chroma_x_shift=0;
         mpi->chroma_y_shift=1;
         return;
Last edited 23 months ago by reimar (previous) (diff)

comment:2 by bug, 23 months ago

nice, thanks for the fix! I'll try to test it for unintended behavior in the next few days. Are those changes included in the recent subversion snapshot?

comment:3 by reimar, 23 months ago

No, I've not committed this one yet, it needs some more thinking and review before that.

comment:4 by beastd, 3 weeks ago

Status: newopen

comment:5 by beastd, 3 weeks ago

As far a I can tell the patch was committed in August 2022.

SVN-r38370:

mp_image: ensure sufficient space in chroma planes.

For odd sized dimensions.
Fixes trac issue #2388.

comment:6 by beastd, 3 weeks ago

Resolution: fixed
Status: openclosed

Closing as this problem should be fixed.

Feel free to re-open should your problem not be fixed.

Note: See TracTickets for help on using tickets.