aacdec: Invalid read reported by valgrind
Submitted by Guillaume Desmottes @gdesmott
Link to original bug (#747110)
Description
Running this test with valgrind reports invalid reads in libav:
gst-validate-launcher -t validate.file.media_check.tron_en_ge_aac_h264_ts -v
==17017== Thread 6 multiqueue0:src_:
==17017== Invalid read of size 4
==17017== at 0xBAC045C: decode_spectrum_and_dequant (.c:1586)
==17017== by 0xBAC045C: decode_ics.constprop.26 (aacdec.c:1882)
==17017== by 0xBAC15C7: decode_cpe (aacdec.c:1993)
==17017== by 0xBAC2447: aac_decode_frame_int (aacdec.c:2816)
==17017== by 0xBAC3377: aac_decode_frame (aacdec.c:2950)
==17017== by 0xB9D2385: avcodec_decode_audio4 (utils.c:1657)
==17017== by 0xB66716D: gst_ffmpegauddec_audio_frame.isra.0 (gstavauddec.c:475)
==17017== by 0xB6676D1: gst_ffmpegauddec_frame (gstavauddec.c:630)
==17017== by 0xB667F0F: gst_ffmpegauddec_handle_frame (gstavauddec.c:751)
==17017== by 0x50C432D: gst_audio_decoder_push_buffers (gstaudiodecoder.c:1482)
==17017== by 0x50C486A: gst_audio_decoder_chain_forward (gstaudiodecoder.c:1596)
==17017== by 0x50C631B: gst_audio_decoder_chain (gstaudiodecoder.c:1854)
==17017== by 0x5A9223D: gst_pad_chain_data_unchecked (gstpad.c:3977)
==17017== by 0x5A92EEC: gst_pad_push_data (gstpad.c:4210)
==17017== by 0x5A9347B: gst_pad_push (gstpad.c:4321)
==17017== by 0x57B4FA6: gst_base_parse_push_frame (gstbaseparse.c:2332)
==17017== by 0x57B3EEC: gst_base_parse_handle_and_push_frame (gstbaseparse.c:2164)
==17017== by 0x57B587C: gst_base_parse_finish_frame (gstbaseparse.c:2489)
==17017== by 0xABB6B90: gst_aac_parse_handle_frame (gstaacparse.c:1330)
==17017== by 0x57B3163: gst_base_parse_handle_buffer (gstbaseparse.c:1978)
==17017== by 0x57B8231: gst_base_parse_chain (gstbaseparse.c:3018)
==17017== Address 0x62690c7 is 279 bytes inside a block of size 281 alloc'd
==17017== at 0x4A08BCF: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==17017== by 0x3EBB04F405: g_malloc (gmem.c:97)
==17017== by 0x8B06C9B: gst_ts_demux_parse_pes_header (tsdemux.c:1830)
==17017== by 0x8B06C9B: gst_ts_demux_queue_data (tsdemux.c:1889)
==17017== by 0x8B06C9B: gst_ts_demux_handle_packet (tsdemux.c:2257)
==17017== by 0x8B06C9B: gst_ts_demux_push (tsdemux.c:2332)
==17017== by 0x8AFFEDF: mpegts_base_chain (mpegtsbase.c:1162)
==17017== by 0x8B00149: mpegts_base_loop (mpegtsbase.c:1341)
==17017== by 0x5AC7894: gst_task_func (gsttask.c:331)
==17017== by 0x5AC8970: default_func (gsttaskpool.c:68)
==17017== by 0x3EBB070D67: g_thread_pool_thread_proxy (gthreadpool.c:307)
==17017== by 0x3EBB0703D4: g_thread_proxy (gthread.c:764)
==17017== by 0x3EB8807529: start_thread (pthread_create.c:310)
==17017== by 0x3EB850022C: clone (clone.S:109)