Bug Hunter Diary

libavformat 52.23. 1 / 52.23. 1libavdevice 52. 1. 0 / 52. 1. 0built on Jan 24 2009 09:07:58, gcc: 4.3.3Program received signal SIGSEGV, Segmentation fault.0x0809c89d in fourxm_read_header (s=0xa836330, ap=0xbfb19674) atlibavformat/4xm.c:178178 fourxm->tracks[current_track].adpcm = AV_RL32(&header[i + 12]);FFmpeg crashed again while trying to parse the malformed mediafile. To see what exactly caused the crash, I asked the debugger to displaythe current register values as well as the last instruction executedby FFmpeg:(gdb) info registerseax 0xbbbbbbbb -1145324613ecx 0xa83f3e0 176419808edx 0x0 0ebx 0x806ab330 -2140490960esp 0xbfb194f0 0xbfb194f0ebp 0x855ffc0 0x855ffc0esi 0xa83f3a0 176419744edi 0xa83f330 176419632eip 0x809c89d 0x809c89d eflags 0x10206 [ PF IF RF ]cs 0x73 115ss 0x7b 123ds 0x7b 123es 0x7b 123fs 0x0 0gs 0x33 51(gdb) x/1i $eip0x809c89d : mov DWORD PTR [edx+ebp*1+0x10],eaxI also displayed the address where FFmpeg had attempted to storethe value of EAX:(gdb) x/1x $edx+$ebp+0x100x855ffd0 :0xb7dd4d40As expected, FFmpeg tried to write the value of EAX to the suppliedaddress (0x855ffd0) of memalign()’s GOT entry.(gdb) shell cat /proc/$(pidof ffmpeg_g)/maps08048000-0855f000 r-xp 00000000 08:01 101582 /home/tk/BHD/ffmpeg_relro/ffmpeg_g0855f000-08560000 r--p 00516000 08:01 101582 /home/tk/BHD/ffmpeg_relro/ffmpeg_g08560000-0856c000 rw-p 00517000 08:01 101582 /home/tk/BHD/ffmpeg_relro/ffmpeg_g0856c000-0888c000 rw-p 0856c000 00:00 00a834000-0a855000 rw-p 0a834000 00:00 0[heap]b7d60000-b7d61000 rw-p b7d60000 00:00 0b7d61000-b7ebd000 r-xp 00000000 08:01 148202 /lib/tls/i686/cmov/libc-2.9.sob7ebd000-b7ebe000 ---p 0015c000 08:01 148202 /lib/tls/i686/cmov/libc-2.9.so68 Chapter 4