[libav-bugs] [Bug 854] New: image2pipe ppm input corrupt when header spans fifo blocks

bugzilla-daemon at libav.org bugzilla-daemon at libav.org
Tue Apr 28 15:47:46 CEST 2015


            Bug ID: 854
           Summary: image2pipe ppm input corrupt when header spans fifo
           Product: Libav
           Version: 11
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: ---
         Component: general
          Assignee: bugzilla at libav.org
          Reporter: claude at mathr.co.uk

Created attachment 534
  --> https://bugzilla.libav.org/attachment.cgi?id=534&action=edit
shell script reproducing the bug

piping PPM streams to avconv can cause image corruption in the (unlikely but
possible) case that a frame header overlaps the fifo block size in such a way
that the partial header is almost valid

almost valid means that width and at least one (but not all) digits of the
height are parsed, and then the fifo block size boundary occurs.  somehow the
output frames remain the correct size, but with garbled image data.

avconv does sometimes output bold red messages stating "picture size ... is
invalid" or "invalid maxval ..." when this occurs, but some can be
false-positives (ie, the output is not always garbled when the messages occur).

attached is a test case that reliably reproduces the bug on my system.  i'll
attach the -v 9 -loglevel 99 output shortly.

the input file is 5006 bytes, and after 36 frames, the total length modulo 4096
(the fifo block size) is -8, which means the next block boundary occurs 8 bytes
into the header, in between the 0 and 4 of the height 104.  the 37th frame is
garbled from about 1/3 the way down (looks like 8 bytes are missing, with the
remaining data shifted).

bug initially filed here:

You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.libav.org/pipermail/libav-bugs/attachments/20150428/d59ad040/attachment-0001.html>

More information about the libav-bugs mailing list