Bug#556198: mpd: segfault when trying to play a m4a (AAC-LC) file

[Max Kellermann]

On 2009/11/15 10:35, Reinhard Tartler <siretart at tauware.de> wrote:
> > This originates from the function avcodec_decode_audio2() called by
> > MPD in src/decoder/ffmpeg_plugin.c, ffmpeg_send_packet().
> 
> how did you find this out?

By stepping with gdb through test/run_decoder (MPD compiled with
--enable-test).

> > With valgrind, this problem does not occur.  libavformat
> > 0.svn20080206-18 (Lenny) is unaffected, same for svn r20416
> > (2009-10-29).
> 
> I guess this is svn from trunk?

Yes.  But I'm actually not sure if that's comparable, because I'm not
sure if I have compiled it with SSE.

> It seems to me that the output buffer is simply not aligned, which makes
> mpd crash when using the MMX optimized functions of ffmpeg. If I'm
> right, the crash should just disappear if you disable
> /usr/lib/i686/cmov/libavcodec.so.52, so that mpd falls back to the
> non-MMX capable version /usr/lib/libavcodec.so.52.

Indeed, I have written an alignment patch for the stable branch, it
fixes the problem here:

 http://git.musicpd.org/cgit/master/mpd.git/commit/?h=v0.15.x&id=77b95d08a55a35bc966b9a9096cd926c315d49b8

(For the master branch, I'll probably use posix_memalign() instead of
this hack - but that would be too much change for the stable branch)

In addition to MPD's failure to obey the documented libavcodec
specification, I consider the actual crash a bug in libavcodec:

 "@return On error a negative value is returned"

Max