Bug#805109: libavresample2: Segfaults when trying to play certain song

[Andreas Cadhalpun]

Control: tags -1 moreinfo

Hi Helge,

On 14.11.2015 21:08, Helge Kreutzmann wrote:
> I use cmus a lot and it has never crashed. However, now I can
> reproducibly crash cmus with a SegFault.

Can you share the file reproducing this crash?

> I rebuild cmus and libavresample2 with "nostrip" and ran cmus in gdb.
> When issuing "bt full" I get the following:
> (gdb) bt full
> #0  0x000003be29620e2b in ff_audio_data_free (a=0xc1) at
> /scr/build/debian/NEU-LIBA/libav-11.4/libavresample/audio_data.c:218
> No locals.
> #1  0x000003be29629db2 in avresample_close (avr=0x21) at

This avr pointer is clearly invalid. It looks like there has been
a NULL pointer dereference before.

Thus this looks like a bug in cmus, passing a reference to an invalid
pointer to avresample_free.

Best regards,
Andreas