Heap buffer overflow in picture_CopyPixels
- VLC version: 2.2.1 Terry Pratchett (Weatherwax) (revision 2.2.1-0-ga425c42)
- OS: ArchLinux
- File: https://drive.google.com/file/d/0BwfOHcwoYd-1OHVjS3JCenJwSzg/view?usp=sharing (166 MB, md5 a79afd1c1e40debf5036e32ab0deaf28, created on a Mac with QuickTime).
Steps to reproduce:
- Open the file with VLC, e.g. "vlc Lyrics.mov"
- VLC crashes.
If you run a debugger (e.g. GDB), break on misc/picture.c:333, continue 2x at the breakpoints. After the third breakpoint, VLC will crash, presumably due to a buffer overflow.
During debugging, I found p_dst->i_visible_pitch = 1680
and p_dst->i_pitch = 1024
, which looks odd to me (see end of report for full GDB debugging session).
https://github.com/videolan/vlc/blob/6d888d8c3cd534c858c1dc41564396840c06639b/src/misc/picture.c#L322-L357 (plane_CopyPixels)
i_width = ... = p_dst->i_visible_pitch = 1680 //
...
for( i_line = i_height; i_line--; )
{
memcpy( p_out, p_in, i_width ); // = mcpy(p_out, p_in, 1680)
p_in += p_src->i_pitch; // = p_in += 1024
p_out += p_dst->i_pitch; // = p_out += 1024
}
This piece of code seems to copy the pixels line by line, and seems to assume that each line occupies i_pitch
bytes and that per line i_width
bytes should be copied. But the number of copied bytes exceeds the number of bytes per line.
Assuming that the p_in
and p_out
are allocated with i_width*(i_height-1)
bytes, a buffer overflow will eventually happen.
If I use set i_width = 0
and c
in GDB, then VLC doesn't crash any more and the first frame is shown (but clipped). If I choose set i_width = 1
or even higher, then VLC continues to crash.
It may be relevant that the captured video size (3360x2100) is significantly larger than my screen size (1600x900 (depth 24)).
I tried to reproduce on Ubuntu 14.04 (vlc 2.1.6), but the bug did not occur over there (even with varying screen sizes).
$ vlc --version
VLC media player 2.2.1 Terry Pratchett (Weatherwax) (revision 2.2.1-0-ga425c42)
VLC version 2.2.1 Terry Pratchett (Weatherwax) (2.2.1-0-ga425c42)
Compiled by arch on builder (Oct 11 2015 21:49:09)
Compiler: gcc version 5.2.0 (GCC)
(built using sources as specified in https://projects.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/vlc&id=9ee094882fc3c8a282eeb5feefd18846ec20310a)
$ ffmpeg -i Lyrics.mov
Input [#0](https://code.videolan.org/videolan/vlc/-/issues/0), mov,mp4,m4a,3gp,3g2,mj2, from 'Lyrics.mov':
Metadata:
major_brand : qt
minor_version : 0
compatible_brands: qt
creation_time : 2015-10-11 18:04:25
Duration: 00:02:01.47, start: -1.094667, bitrate: 11397 kb/s
Stream [#0](https://code.videolan.org/videolan/vlc/-/issues/0):0(und): Video: h264 (Main) (avc1 / 0x31637661), yuv420p(tv, bt709), 3360x2100 [SAR 1:1 DAR 8:5], 11293 kb/s, 15.49 fps, 60 tbr, 6k tbn, 50 tbc (default)
Metadata:
creation_time : 2015-10-11 18:04:25
handler_name : Core Media Data Handler
encoder : H.264
$ gdb -ex 'dir /tmp/vlc-2.2.1/src:/tmp/vlc-2.2.1/modules' -ex 'break misc/picture.c:333' --args vlc -I dummy /tmp/Lyrics.mov -vvv
GNU gdb (GDB) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from vlc...Reading symbols from /usr/lib/debug/usr/bin/vlc.debug...done.
done.
Source directories searched: /tmp/vlc-2.2.1/src:/tmp/vlc-2.2.1/modules:/tmp/SRC:$cdir:$cwd
No source file named misc/picture.c.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (misc/picture.c:333) pending.
(gdb) r
Starting program: /usr/bin/vlc -I dummy /tmp/Lyrics.mov -vvv
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
VLC media player 2.2.1 Terry Pratchett (Weatherwax) (revision 2.2.1-0-ga425c42)
[0000000000605158] core libvlc debug: VLC media player - 2.2.1 Terry Pratchett (Weatherwax)
[0000000000605158] core libvlc debug: Copyright © 1996-2015 the VideoLAN team
[0000000000605158] core libvlc debug: revision 2.2.1-0-ga425c42
[0000000000605158] core libvlc debug: configured with ./configure '--prefix=/usr' '--sysconfdir=/etc' '--disable-rpath' '--enable-faad' '--enable-nls' '--enable-lirc' '--enable-ncurses' '--enable-realrtsp' '--enable-aa' '--enable-vcdx' '--enable-upnp' '--enable-opus' '--enable-sftp' 'LUAC=/usr/bin/luac' 'LUA_LIBS=-llua -lm' 'RCC=/usr/bin/rcc-qt4' 'CFLAGS=-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -g -fvar-tracking-assignments -ggdb -g -fvar-tracking-assignments -ggdb -I/usr/include/samba-4.0' 'LDFLAGS=-Wl,-O1,--sort-common,--as-needed,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2 -I/usr/include/samba-4.0' 'CXXFLAGS=-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -g -fvar-tracking-assignments -ggdb -g -fvar-tracking-assignments -ggdb'
[0000000000605158] core libvlc debug: searching plug-in modules
[0000000000605158] core libvlc debug: loading plugins cache file /usr/lib/vlc/plugins/plugins.dat
[0000000000605158] core libvlc debug: recursively browsing `/usr/lib/vlc/plugins'
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/access/libvcdx_plugin.so' (libvcdinfo.so.0: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/access/libgnomevfs_plugin.so' (libgnomevfs-2.so.0: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/visualization/libgoom_plugin.so' (libgoom2.so.0: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/visualization/libprojectm_plugin.so' (libprojectM.so.2: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/codec/libtwolame_plugin.so' (libtwolame.so.0: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/codec/libx265_plugin.so' (libx265.so.68: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc warning: cannot load module `/usr/lib/vlc/plugins/control/liblirc_plugin.so' (liblirc_client.so.0: cannot open shared object file: No such file or directory)
[0000000000605158] core libvlc debug: saving plugins cache /usr/lib/vlc/plugins/plugins.dat
[0000000000605158] core libvlc debug: plug-ins loaded: 453 modules
[0000000000605158] core libvlc debug: opening config file (/home/username/.config/vlc/vlcrc)
[0000000000605158] core libvlc debug: translation test: code is "C"
[0000000000605158] core libvlc debug: CPU has capabilities MMX MMXEXT SSE SSE2 SSE3 SSSE3 SSE4.1 SSE4.2 FPU
[00000000006d3928] core input debug: Creating an input for 'Media Library'
[00000000006d3928] core input debug: Input is a meta file: disabling unneeded options
[00000000006d3928] core input debug: using timeshift granularity of 50 MiB, in path '/tmp'
[00000000006d3928] core input debug: `file/xspf-open:///home/username/.local/share/vlc/ml.xspf' gives access `file' demux `xspf-open' path `/home/username/.local/share/vlc/ml.xspf'
[00000000006d3928] core input debug: creating demux: access='file' demux='xspf-open' location='/home/username/.local/share/vlc/ml.xspf' file='/home/username/.local/share/vlc/ml.xspf'
[00000000006d8538] core demux debug: looking for access_demux module matching "file": 19 candidates
[00000000006d8538] core demux debug: no access_demux modules matched
[00000000006d3928] core input debug: creating access 'file' location='/home/username/.local/share/vlc/ml.xspf', path='/home/username/.local/share/vlc/ml.xspf'
[00000000006d8538] core access debug: looking for access module matching "file": 24 candidates
[00000000006d8538] filesystem access debug: opening file `/home/username/.local/share/vlc/ml.xspf'
[00000000006d8538] core access debug: using access module "filesystem"
[00000000006deca8] core stream debug: Using stream method for AStream*
[00000000006deca8] core stream debug: starting pre-buffering
[00000000006deca8] core stream debug: received first data after 0 ms
[00000000006deca8] core stream debug: pre-buffering done 296 bytes in 0s - 3284 KiB/s
[00000000006dfdb8] core stream debug: looking for stream_filter module matching "any": 9 candidates
[00000000006dfdb8] core stream debug: no stream_filter modules matched
[00000000006dfdb8] core stream debug: looking for stream_filter module matching "record": 9 candidates
[00000000006dfdb8] core stream debug: using stream_filter module "record"
[00000000006d3928] core input debug: creating demux: access='file' demux='xspf-open' location='/home/username/.local/share/vlc/ml.xspf' file='/home/username/.local/share/vlc/ml.xspf'
[0000000000703618] core demux debug: looking for demux module matching "xspf-open": 65 candidates
[0000000000703618] xspf demux debug: using XSPF playlist reader
[0000000000703618] core demux debug: using demux module "playlist"
[0000000000704028] core demux meta debug: looking for meta reader module matching "any": 2 candidates
[0000000000704028] lua demux meta debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/reader
[0000000000704028] lua demux meta debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/reader
[0000000000704028] lua demux meta debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/reader/filename.luac
[0000000000704028] lua demux meta debug: Trying Lua scripts in /usr/share/vlc/lua/meta/reader
[0000000000704028] core demux meta debug: no meta reader modules matched
[00000000006d3928] core input debug: `file/xspf-open:///home/username/.local/share/vlc/ml.xspf' successfully opened
[000000000070be28] core xml reader debug: looking for xml reader module matching "any": 1 candidates
[000000000070be28] core xml reader debug: using xml reader module "xml"
[0000000000703618] xspf demux debug: parsed 0 tracks successfully
[00000000006d3928] core input debug: EOF reached
[0000000000703618] core demux debug: removing module "playlist"
[00000000006dfdb8] core stream debug: removing module "record"
[00000000006d8538] core access debug: removing module "filesystem"
[0000000000619668] core playlist debug: creating audio output
[00000000007122c8] core audio output debug: looking for audio output module matching "any": 6 candidates
[00000000007122c8] pulse audio output debug: using library version 7.0.0
[00000000007122c8] pulse audio output debug: (compiled with version 7.0.0, protocol 30)
[New Thread 0x7fffedea7700 (LWP 28551)]
[00000000007122c8] pulse audio output debug: connected locally to /run/user/1000/pulse/native as client [#874](https://code.videolan.org/videolan/vlc/-/issues/874)
[00000000007122c8] pulse audio output debug: using protocol 30, server protocol 30
[00000000007122c8] pulse audio output debug: adding sink 0: alsa_output.pci-0000_00_1b.0.analog-stereo (Built-in Audio Analog Stereo)
[00000000007122c8] core audio output debug: using audio output module "pulse"
[0000000000619668] core playlist debug: keeping audio output
[New Thread 0x7ffff7f24700 (LWP 28552)]
[0000000000619668] core playlist debug: adding item `Lyrics.mov' ( file:///tmp/Lyrics.mov )
[New Thread 0x7fffed6a6700 (LWP 28553)]
[00007fffdc000958] core input debug: Creating an input for 'Lyrics.mov'
[000000000073a838] core interface debug: looking for interface module matching "hotkeys,none": 18 candidates
[000000000073a838] core interface debug: using interface module "hotkeys"
[000000000073b2b8] core interface debug: looking for interface module matching "globalhotkeys,none": 18 candidates
[000000000073b2b8] core interface debug: using interface module "xcb_hotkeys"
[000000000073b828] core interface debug: looking for interface module matching "dbus,none": 18 candidates
[000000000073b828] dbus interface debug: listening on dbus as: org.mpris.MediaPlayer2.vlc
[0000000000619668] core playlist debug: meta ok for (null), need to fetch art
[New Thread 0x7fffecb56700 (LWP 28554)]
[New Thread 0x7fffeca55700 (LWP 28555)]
[000000000073b828] core interface debug: using interface module "dbus"
[00000000007402c8] core interface debug: looking for interface module matching "dummy": 18 candidates
[Thread 0x7fffed6a6700 (LWP 28553) exited]
[00007fffdc004068] core art finder debug: looking for meta fetcher module matching "any": 1 candidates
[00007fffdc004068] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/fetcher
[00000000007402c8] dummy interface: using the dummy interface module...
[00000000007402c8] core interface debug: using interface module "dummy"
[0000000000619668] core playlist debug: processing request item: null, node: Playlist, skip: 0
[0000000000619668] core playlist debug: rebuilding array of current - root Playlist
[0000000000619668] core playlist debug: rebuild done - 1 items, index -1
[0000000000619668] core playlist debug: starting playback of the new playlist item
[0000000000619668] core playlist debug: resyncing on Lyrics.mov
[0000000000619668] core playlist debug: Lyrics.mov is at 0
[0000000000619668] core playlist debug: creating new input thread
[00007fffd40009b8] core input debug: Creating an input for 'Lyrics.mov'
[New Thread 0x7fffed6a6700 (LWP 28556)]
[0000000000619668] core playlist debug: requesting art for Lyrics.mov
[00007fffd40009b8] core input debug: using timeshift granularity of 50 MiB, in path '/tmp'
[New Thread 0x7fffec752700 (LWP 28557)]
[00007fffd40009b8] core input debug: `file:///tmp/Lyrics.mov' gives access `file' demux `' path `/tmp/Lyrics.mov'
[00007fffd40009b8] core input debug: specified demux `any'
[00007fffd40009b8] core input debug: creating demux: access='file' demux='any' location='/tmp/Lyrics.mov' file='/tmp/Lyrics.mov'
[00007fffd8000e28] core demux debug: looking for access_demux module matching "file": 19 candidates
[00007fffdc004068] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/fetcher
[00007fffd8000e28] core demux debug: no access_demux modules matched
[00007fffd40009b8] core input debug: creating access 'file' location='/tmp/Lyrics.mov', path='/tmp/Lyrics.mov'
[00007fffdc004068] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/fetcher/tvrage.luac
[00007fffd8000e28] core access debug: looking for access module matching "file": 24 candidates
[00007fffd8000e28] filesystem access debug: opening file `/tmp/Lyrics.mov'
[00007fffd8000e28] core access debug: using access module "filesystem"
[00007fffd8001148] core stream debug: Using stream method for AStream*
[00007fffd8001148] core stream debug: starting pre-buffering
[00007fffd8001148] core stream debug: received first data after 0 ms
[00007fffd8001148] core stream debug: pre-buffering done 1024 bytes in 0s - 37037 KiB/s
[00007fffd8c014d8] core stream debug: looking for stream_filter module matching "any": 9 candidates
[00007fffd8c014d8] core stream debug: no stream_filter modules matched
[00007fffd8c014d8] core stream debug: looking for stream_filter module matching "record": 9 candidates
[00007fffd8c014d8] core stream debug: using stream_filter module "record"
[00007fffd40009b8] core input debug: creating demux: access='file' demux='any' location='/tmp/Lyrics.mov' file='/tmp/Lyrics.mov'
[00007fffd8c01718] core demux debug: looking for demux module matching "mp4": 65 candidates
[00007fffd8c014d8] mp4 stream warning: unknown box type tapt (incompletely loaded)
[00007fffd0000958] core art finder debug: looking for meta fetcher module matching "any": 1 candidates
[00007fffd8c014d8] mp4 stream warning: unknown box type hdlr (incompletely loaded)
[00007fffd8c014d8] mp4 stream warning: unknown box type alis (incompletely loaded)
[00007fffd8c014d8] mp4 stream warning: unknown box type colr (incompletely loaded)
[00007fffd8c014d8] mp4 stream debug: found an empty box (null size)
[00007fffd8c014d8] mp4 stream warning: unknown box type cslg (incompletely loaded)
[00007fffd8c01718] mp4 demux debug: added fragment moov
[00007fffd8c014d8] mp4 stream debug: dumping root Box "root"
[00007fffd8c014d8] mp4 stream debug: | + ftyp size 20 offset 0
[00007fffd8c014d8] mp4 stream debug: | + wide size 8 offset 20
[00007fffd8c014d8] mp4 stream debug: | + mdat size 173025986 offset 28
[00007fffd8c014d8] mp4 stream debug: | + moov size 38919 offset 173026014
[00007fffd8c014d8] mp4 stream debug: | | + mvhd size 108 offset 173026022
[00007fffd8c014d8] mp4 stream debug: | | + trak size 38434 offset 173026130
[00007fffd8c014d8] mp4 stream debug: | | | + tkhd size 92 offset 173026138
[00007fffd8c014d8] mp4 stream debug: | | | + tapt size 68 offset 173026230
[00007fffd8c014d8] mp4 stream debug: | | | + edts size 36 offset 173026298
[00007fffd8c014d8] mp4 stream debug: | | | | + elst size 28 offset 173026306
[00007fffd8c014d8] mp4 stream debug: | | | + mdia size 38084 offset 173026334
[00007fffd8c014d8] mp4 stream debug: | | | | + mdhd size 32 offset 173026342
[00007fffd8c014d8] mp4 stream debug: | | | | + hdlr size 49 offset 173026374
[00007fffd8c014d8] mp4 stream debug: | | | | + minf size 37995 offset 173026423
[00007fffd8c014d8] mp4 stream debug: | | | | | + vmhd size 20 offset 173026431
[00007fffd8c014d8] mp4 stream debug: | | | | | + hdlr size 56 offset 173026451
[00007fffd8c014d8] mp4 stream debug: | | | | | + dinf size 36 offset 173026507
[00007fffd8c014d8] mp4 stream debug: | | | | | | + dref size 28 offset 173026515
[00007fffd8c014d8] mp4 stream debug: | | | | | | | + alis size 12 offset 173026531
[00007fffd8c014d8] mp4 stream debug: | | | | | + stbl size 37875 offset 173026543
[00007fffd8c014d8] mp4 stream debug: | | | | | | + stsd size 200 offset 173026551
[00007fffd8c014d8] mp4 stream debug: | | | | | | | + avc1 size 184 offset 173026567
[00007fffd8c014d8] mp4 stream debug: | | | | | | | | + avcC size 60 offset 173026653
[00007fffd8c014d8] mp4 stream debug: | | | | | | | | + colr size 18 offset 173026713
[00007fffd8c014d8] mp4 stream debug: | | | | | | | | + pasp size 16 offset 173026731
[00007fffd8c014d8] mp4 stream debug: | | | | | | + stts size 10408 offset 173026751
[00007fffd8c014d8] mp4 stream debug: | | | | | | + ctts size 14456 offset 173037159
[00007fffd8c014d8] mp4 stream debug: | | | | | | + cslg size 32 offset 173051615
[00007fffd8c014d8] mp4 stream debug: | | | | | | + stss size 400 offset 173051647
[00007fffd8c014d8] mp4 stream debug: | | | | | | + sdtp size 1911 offset 173052047
[00007fffd8c014d8] mp4 stream debug: | | | | | | + stsc size 1996 offset 173053958
[00007fffd8c014d8] mp4 stream debug: | | | | | | + stsz size 7616 offset 173055954
[00007fffd8c014d8] mp4 stream debug: | | | | | | + stco size 848 offset 173063570
[00007fffd8c014d8] mp4 stream debug: | | | + meta size 146 offset 173064418
[00007fffd8c014d8] mp4 stream debug: | | + meta size 369 offset 173064564
[00007fffd8c01718] mp4 demux debug: Apple QuickTime file
[00007fffd8c01718] mp4 demux debug: found 1 tracks
[00007fffd8c01718] mp4 demux warning: elst box found
[00007fffd8c01718] mp4 demux debug: - [0] duration=121472ms media time=1094ms) rate=1.0
[00007fffd8c01718] mp4 demux debug: track[Id 0x1] read 208 chunk
[00007fffd8c01718] mp4 demux warning: STTS table of 1299 entries
[00007fffd8c01718] mp4 demux warning: CTTS table of 1805 entries
[00007fffd8c01718] mp4 demux debug: track[Id 0x1] read 1899 samples length:122s
[00007fffd40009b8] core input debug: selecting program id=0
[00007fffd8c01718] mp4 demux debug: adding track[Id 0x1] video (enable) language undef
[00007fffd8c01718] mp4 demux debug: fragment offset 173026014, data 36<->173026014, duration 0
[00007fffd8c01718] core demux debug: using demux module "mp4"
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/fetcher
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/fetcher
[00007fffdc004068] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/fetcher/tvrage.luac
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/fetcher/tvrage.luac
[00007fffdc004068] lua art finder debug: Trying Lua scripts in /usr/share/vlc/lua/meta/fetcher
[00007fffdc004068] core art finder debug: no meta fetcher modules matched
[0000000000619668] core playlist debug: searching art for Lyrics.mov
[00007fffdcc04c08] core art finder debug: looking for art finder module matching "any": 2 candidates
[00007fffd40009b8] core input debug: looking for a subtitle file in /tmp/
[00007fffd8c1e078] core decoder debug: looking for decoder module matching "any": 44 candidates
[00007fffdcc04c08] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/art
[00007fffdcc04c08] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/art
[00007fffdcc04c08] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/00_musicbrainz.luac
[00007fffd0000958] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/fetcher/tvrage.luac
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/share/vlc/lua/meta/fetcher
[00007fffd0000958] core art finder debug: no meta fetcher modules matched
[0000000000605158] core libvlc debug: searching art for Lyrics.mov
[00007fffdcc04c08] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/00_musicbrainz.luac
[00007fffd0000958] core art finder debug: looking for art finder module matching "any": 2 candidates
[00007fffdcc04c08] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/01_googleimage.luac
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/art
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/art
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/00_musicbrainz.luac
[00007fffdcc04c08] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/01_googleimage.luac
[00007fffdcc04c08] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/02_frenchtv.luac
[00007fffd0000958] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/00_musicbrainz.luac
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/01_googleimage.luac
[00007fffdcc04c08] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/02_frenchtv.luac
[00007fffdcc04c08] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/03_lastfm.luac
[00007fffd0000958] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/01_googleimage.luac
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/02_frenchtv.luac
[00007fffdcc04c08] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/03_lastfm.luac
[00007fffdcc04c08] lua art finder debug: Trying Lua scripts in /usr/share/vlc/lua/meta/art
[00007fffdcc04c08] core art finder debug: no art finder modules matched
[00007fffdcc05db8] core art finder debug: looking for meta fetcher module matching "any": 1 candidates
[00007fffd0000958] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/02_frenchtv.luac
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/03_lastfm.luac
[00007fffdcc05db8] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/fetcher
[00007fffdcc05db8] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/fetcher
[00007fffdcc05db8] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/fetcher/tvrage.luac
[00007fffd0000958] lua art finder debug: skipping script (unmatched scope) /usr/lib/vlc/lua/meta/art/03_lastfm.luac
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/share/vlc/lua/meta/art
[00007fffd0000958] core art finder debug: no art finder modules matched
[00007fffd0000958] core art finder debug: looking for meta fetcher module matching "any": 1 candidates
[00007fffdcc05db8] core art finder debug: using meta fetcher module "lua"
[00007fffdcc05db8] core art finder debug: removing module "lua"
[0000000000619668] core playlist debug: searching art for Lyrics.mov
[00007fffdcc05db8] core art finder debug: looking for art finder module matching "any": 2 candidates
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/fetcher
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/fetcher
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/fetcher/tvrage.luac
[00007fffdcc05db8] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/art
[00007fffdcc05db8] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/art
[00007fffdcc05db8] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/00_musicbrainz.luac
[00007fffd0000958] core art finder debug: using meta fetcher module "lua"
[00007fffd0000958] core art finder debug: removing module "lua"
[0000000000605158] core libvlc debug: searching art for Lyrics.mov
[00007fffd0000958] core art finder debug: looking for art finder module matching "any": 2 candidates
[00007fffdcc05db8] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/01_googleimage.luac
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/art
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/art
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/00_musicbrainz.luac
[00007fffd8c1e078] avcodec decoder debug: CPU flags: 0x010013db
[00007fffdcc05db8] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/02_frenchtv.luac
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/01_googleimage.luac
[00007fffd8c1e078] avcodec decoder debug: trying to use direct rendering
[00007fffd8c1e078] avcodec decoder debug: allowing 4 thread(s) for decoding
[New Thread 0x7fffc2d35700 (LWP 28558)]
[New Thread 0x7fffc2534700 (LWP 28559)]
[00007fffdcc05db8] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/03_lastfm.luac
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/02_frenchtv.luac
[New Thread 0x7fffc1d33700 (LWP 28560)]
[New Thread 0x7fffc1532700 (LWP 28561)]
[00007fffd8c1e078] avcodec decoder debug: avcodec codec (H264 - MPEG-4 AVC (part 10)) started
[00007fffd8c1e078] avcodec decoder debug: using frame thread mode with 4 threads
[00007fffd8c1e078] core decoder debug: using decoder module "avcodec"
[New Thread 0x7fffe0113700 (LWP 28562)]
[00007fffd8db4f48] core demux meta debug: looking for meta reader module matching "any": 2 candidates
[00007fffdcc05db8] lua art finder debug: Trying Lua scripts in /usr/share/vlc/lua/meta/art
[00007fffdcc05db8] core art finder debug: no art finder modules matched
[0000000000619668] core playlist debug: art not found for Lyrics.mov
[Thread 0x7fffeca55700 (LWP 28555) exited]
[00007fffd0000958] lua art finder debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/art/03_lastfm.luac
[00007fffd8db4f48] lua demux meta debug: Trying Lua scripts in /home/username/.local/share/vlc/lua/meta/reader
[00007fffd8db4f48] lua demux meta debug: Trying Lua scripts in /usr/lib/vlc/lua/meta/reader
[00007fffd8db4f48] lua demux meta debug: Trying Lua playlist script /usr/lib/vlc/lua/meta/reader/filename.luac
[00007fffd0000958] lua art finder debug: Trying Lua scripts in /usr/share/vlc/lua/meta/art
[00007fffd0000958] core art finder debug: no art finder modules matched
[0000000000605158] core libvlc debug: art not found for Lyrics.mov
[00007fffd8db4f48] lua demux meta debug: Trying Lua scripts in /usr/share/vlc/lua/meta/reader
[00007fffd8db4f48] core demux meta debug: no meta reader modules matched
[Thread 0x7fffec752700 (LWP 28557) exited]
[00007fffd40009b8] core input debug: `file:///tmp/Lyrics.mov' successfully opened
[00007fffd8c01718] mp4 demux debug: elst (0) gives 0ms (movie)-> 1094ms (track)
[00007fffd8c01718] mp4 demux debug: track[Id 0x1] using Sync Sample Box (stss)
[00007fffd8c01718] mp4 demux debug: stss gives 12 --> 0 (sample number)
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 0%
[00007fffd40009b8] core input debug: Buffering 7%
[00007fffd40009b8] core input debug: Buffering 24%
[00007fffd40009b8] core input debug: Buffering 62%
[00007fffd40009b8] core input debug: Buffering 79%
[00007fffd40009b8] core input debug: Stream buffering done (305 ms in 1 ms)
[00007fffd8c1e078] avcodec decoder debug: available hardware decoder output format 109 (vdpau)
[00007fffd8c1e078] avcodec decoder debug: available hardware decoder output format 53 (vaapi_vld)
[00007fffd8c1e078] avcodec decoder debug: available software decoder output format 0 (yuv420p)
[00007fffdcc04c08] core generic debug: looking for hw decoder module matching "any": 4 candidates
Failed to open VDPAU backend libvdpau_va_gl.so: cannot open shared object file: No such file or directory
[00007fffdcc04c08] core generic debug: no hw decoder modules matched
[00007fffdc0025a8] core spu text debug: looking for text renderer module matching "any": 3 candidates
[00007fffdc0025a8] freetype spu text debug: Building font databases.
[00007fffdc0025a8] freetype spu text debug: Took 0 microseconds
[00007fffdc0025a8] freetype spu text debug: Using Serif Bold as font from file /usr/share/fonts/TTF/DejaVuSans.ttf
[00007fffdc0025a8] freetype spu text debug: Using Monospace as mono-font from file /usr/share/fonts/TTF/DejaVuSansMono.ttf
[00007fffdc0025a8] freetype spu text debug: using fontsize: 2
[00007fffdc0025a8] core spu text debug: using text renderer module "freetype"
[00007fffdc35a518] core scale debug: looking for video filter2 module matching "any": 63 candidates
[00007fffdc35a518] swscale scale debug: 32x32 (32x32) chroma: YUVA -> 16x16 (16x16) chroma: RGBA with scaling using Bicubic (good quality)
[00007fffdc35a518] core scale debug: using video filter2 module "swscale"
[00007fffdc382ce8] core scale debug: looking for video filter2 module matching "any": 63 candidates
[00007fffdc382ce8] yuvp scale debug: YUVP to YUVA converter
[00007fffdc382ce8] core scale debug: using video filter2 module "yuvp"
[00007fffdcc0fd58] core video output debug: Deinterlacing available
[00007fffdcc0fd58] core video output debug: deinterlace 0, mode blend, is_needed 0
[New Thread 0x7fffec752700 (LWP 28563)]
[00007fffdcc0fd58] core video output debug: Opening vout display wrapper
[00007fffb8001268] core vout display debug: looking for vout display module matching "any": 13 candidates
[00007fffb8001eb8] core window debug: looking for vout window xid module matching "any": 4 candidates
[New Thread 0x7fffeca55700 (LWP 28564)]
[00007fffb8001eb8] core window debug: using vout window xid module "xcb_window"
[00007fffb8004f98] core inhibit debug: looking for inhibit module matching "any": 2 candidates
[00007fffb8004f98] dbus_screensaver inhibit debug: found service org.freedesktop.ScreenSaver
[00007fffb8004f98] core inhibit debug: using inhibit module "dbus_screensaver"
[00007fffb8001268] xcb vout display debug: connected to X11.0 server
[00007fffb8001268] xcb vout display debug: vendor : The X.Org Foundation
[00007fffb8001268] xcb vout display debug: version: 11702000
[00007fffb8001268] xcb vout display debug: using screen 0x99
Failed to open VDPAU backend libvdpau_va_gl.so: cannot open shared object file: No such file or directory
[00007fffb8001268] vdpau_display vout display debug: device creation failure: error 1
[00007fffdcc0fd58] core video output debug: Reusing previous vout window
[00007fffb8001268] xcb vout display debug: connected to X11.0 server
[00007fffb8001268] xcb vout display debug: vendor : The X.Org Foundation
[00007fffb8001268] xcb vout display debug: version: 11702000
[00007fffb8001268] xcb vout display debug: using screen 0x99
[00007fffb8001268] xcb_xv vout display debug: using XVideo extension v2.2
[00007fffb8001268] xcb_xv vout display debug: using adaptor Intel(R) Textured Video
[00007fffb8001268] xcb_xv vout display debug: using port 75
[00007fffb8001268] xcb_xv vout display debug: using image format 0x30323449
[00007fffb8001268] xcb_xv vout display debug: using X11 visual ID 0x21 (depth: 24)
[00007fffb8001268] xcb_xv vout display debug: using X11 window 0x02e00000
[00007fffb8001268] xcb_xv vout display debug: using X11 graphic context 0x02e00002
[00007fffb8001268] core vout display debug: VoutDisplayEvent 'fullscreen' 0
[00007fffb8001268] core vout display debug: VoutDisplayEvent 'resize' 1600x843 window
[00007fffb8001268] core vout display debug: using vout display module "xcb_xv"
[00007fffb8001268] core vout display debug: A filter to adapt decoder to display is needed
[00007fffb8013298] core filter debug: looking for video filter2 module matching "any": 63 candidates
[00007fffb8013298] swscale filter debug: 3360x2100 (3360x2114) chroma: I420 -> 3360x2100 (2048x2048) chroma: I420 with scaling using Bicubic (good quality)
[00007fffb8013298] core filter debug: using video filter2 module "swscale"
[00007fffb8001268] core vout display debug: Filter 'Swscale' (0x7fffb8013298) appended to chain
[00007fffdcc0fd58] core video output debug: original format sz 3360x2114, of (0,0), vsz 3360x2100, 4cc I420, sar 1:1, msk r0x0 g0x0 b0x0
[00007fffdc0025a8] core spu text debug: removing module "freetype"
[00007fffdc0025a8] core spu text debug: looking for text renderer module matching "any": 3 candidates
[00007fffdc0025a8] freetype spu text debug: Building font databases.
[00007fffdc0025a8] freetype spu text debug: Took 0 microseconds
[00007fffdc0025a8] freetype spu text debug: Using Serif Bold as font from file /usr/share/fonts/TTF/DejaVuSans.ttf
[00007fffdc0025a8] freetype spu text debug: Using Monospace as mono-font from file /usr/share/fonts/TTF/DejaVuSansMono.ttf
[00007fffdc0025a8] freetype spu text debug: using fontsize: 2
[00007fffdc0025a8] core spu text debug: using text renderer module "freetype"
[00007fffd8c1e078] avcodec decoder debug: plane 1: pitch not aligned (1680%32)
[00007fffd8c1e078] avcodec decoder warning: disabling direct rendering
[00007fffb8001268] xcb vout display debug: display is visible
[00007fffb8001268] xcb vout display debug: display is visible
[00007fffb8001268] core vout display debug: VoutDisplayEvent 'resize' 1600x843 window
[00007fffd8c1e078] core decoder debug: End of video preroll
[00007fffd8c1e078] core decoder debug: Received first picture
[00007fffa3df2688] core blend debug: looking for video blending module matching "any": 1 candidates
[00007fffa3df2688] core blend debug: using video blending module "blend"
[Switching to Thread 0x7fffec752700 (LWP 28563)]
Breakpoint 1, plane_CopyPixels (p_dst=0x7fffb801ee98, p_src=0x7fffb801ead8) at misc/picture.c:334
334 p_in += p_src->i_pitch;
(gdb) c
Continuing.
[00007fffb8001eb8] xcb_window window debug: key: 0x00000000 (X11: 0xffe9)
Breakpoint 1, plane_CopyPixels (p_dst=0x7fffb801eeb8, p_src=0x7fffb801eaf8) at misc/picture.c:334
334 p_in += p_src->i_pitch;
(gdb) c
Continuing.
Breakpoint 1, plane_CopyPixels (p_dst=0x7fffb801eed8, p_src=0x7fffb801eb18) at misc/picture.c:334
334 p_in += p_src->i_pitch;
(gdb) l
329 assert( p_out );
330
331 for( i_line = i_height; i_line--; )
332 {
333 memcpy( p_out, p_in, i_width );
334 p_in += p_src->i_pitch;
335 p_out += p_dst->i_pitch;
336 }
337 }
338 }
(gdb) info locals
p_in = 0x7fffb88ee980 '{' <repeats 16 times>, "|{{|", '{' <repeats 38 times>, 'z' <repeats 14 times>, '{' <repeats 84 times>, "||||", '{' <repeats 12 times>, 'z' <repeats 16 times>, "{{zzzzzzzzzz"...
p_out = <optimized out>
i_line = 1049
i_width = 1680
i_height = 1050
(gdb) p *p_dst
$1 = {p_pixels = 0x7fffbcd29000 '{' <repeats 16 times>, "|{{|", '{' <repeats 38 times>, 'z' <repeats 14 times>, '{' <repeats 84 times>, "||||", '{' <repeats 12 times>, 'z' <repeats 16 times>, "{{zzzzzzzzzz"...,
i_lines = 1024, i_pitch = 1024, i_pixel_pitch = 1, i_visible_lines = 1050, i_visible_pitch = 1680}
(gdb) p *p_src
$2 = {p_pixels = 0x7fffb88ee980 '{' <repeats 16 times>, "|{{|", '{' <repeats 38 times>, 'z' <repeats 14 times>, '{' <repeats 84 times>, "||||", '{' <repeats 12 times>, 'z' <repeats 16 times>, "{{zzzzzzzzzz"...,
i_lines = 1074, i_pitch = 1680, i_pixel_pitch = 1, i_visible_lines = 1050, i_visible_pitch = 1680}
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7485ea5 in __memcpy_sse2_unaligned () from /usr/lib/libc.so.6
(gdb) bt
[#0](https://code.videolan.org/videolan/vlc/-/issues/0) 0x00007ffff7485ea5 in __memcpy_sse2_unaligned () from /usr/lib/libc.so.6
[#1](https://code.videolan.org/videolan/vlc/-/issues/1) 0x00007ffff717ce7c in memcpy (__len=1680, __src=<optimized out>, __dest=<optimized out>) at /usr/include/bits/string3.h:53
[#2](https://code.videolan.org/videolan/vlc/-/issues/2) plane_CopyPixels (p_dst=0x7fffb801eed8, p_src=0x7fffb801eb18) at misc/picture.c:333
[#3](https://code.videolan.org/videolan/vlc/-/issues/3) 0x00007ffff717cf96 in picture_CopyPixels (p_dst=<optimized out>, p_src=0x7fffb801ea70) at misc/picture.c:355
[#4](https://code.videolan.org/videolan/vlc/-/issues/4) 0x00007fffbfa283da in Filter (p_filter=0x7fffb8013298, p_pic=0x7fffb801ea70) at video_chroma/swscale.c:667
[#5](https://code.videolan.org/videolan/vlc/-/issues/5) 0x00007ffff7197d9c in FilterChainVideoFilter (p_pic=0x7fffb801ea70, f=0x7fffb8013298) at misc/filter_chain.c:230
[#6](https://code.videolan.org/videolan/vlc/-/issues/6) filter_chain_VideoFilter (p_chain=0x7fffb8012ed0, p_pic=p_pic@entry=0x7fffb801ea70) at misc/filter_chain.c:248
[#7](https://code.videolan.org/videolan/vlc/-/issues/7) 0x00007ffff7158b45 in vout_FilterDisplay (vd=vd@entry=0x7fffb8001268, picture=picture@entry=0x7fffb801ea70) at video_output/display.c:1160
[#8](https://code.videolan.org/videolan/vlc/-/issues/8) 0x00007ffff715ce6b in ThreadDisplayRenderPicture (is_forced=true, vout=0x7fffdcc0fd58) at video_output/video_output.c:1038
[#9](https://code.videolan.org/videolan/vlc/-/issues/9) ThreadDisplayPicture (vout=vout@entry=0x7fffdcc0fd58, deadline=deadline@entry=0x7fffec751d48) at video_output/video_output.c:1149
[#10](https://code.videolan.org/videolan/vlc/-/issues/10) 0x00007ffff715dbcb in Thread (object=0x7fffdcc0fd58) at video_output/video_output.c:1595
[#11](https://code.videolan.org/videolan/vlc/-/issues/11) 0x00007ffff79a44a4 in start_thread () from /usr/lib/libpthread.so.0
[#12](https://code.videolan.org/videolan/vlc/-/issues/12) 0x00007ffff74de13d in clone () from /usr/lib/libc.so.6