{"action":"created","issue":{"url":"https://api.github.com/repos/appunite/AndroidFFmpeg/issues/36","labels_url":"https://api.github.com/repos/appunite/AndroidFFmpeg/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/appunite/AndroidFFmpeg/issues/36/comments","events_url":"https://api.github.com/repos/appunite/AndroidFFmpeg/issues/36/events","html_url":"https://github.com/appunite/AndroidFFmpeg/issues/36","id":13452900,"number":36,"title":"Crash when player->caputre_streams_no has negative value","user":{"login":"myrmidon-media","id":2820532,"avatar_url":"https://avatars.githubusercontent.com/u/2820532?v=3","gravatar_id":"","url":"https://api.github.com/users/myrmidon-media","html_url":"https://github.com/myrmidon-media","followers_url":"https://api.github.com/users/myrmidon-media/followers","following_url":"https://api.github.com/users/myrmidon-media/following{/other_user}","gists_url":"https://api.github.com/users/myrmidon-media/gists{/gist_id}","starred_url":"https://api.github.com/users/myrmidon-media/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myrmidon-media/subscriptions","organizations_url":"https://api.github.com/users/myrmidon-media/orgs","repos_url":"https://api.github.com/users/myrmidon-media/repos","events_url":"https://api.github.com/users/myrmidon-media/events{/privacy}","received_events_url":"https://api.github.com/users/myrmidon-media/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2013-04-21T17:19:57Z","updated_at":"2015-06-17T10:15:09Z","closed_at":"2015-06-17T10:15:09Z","body":"Sometimes a negative  value of player->caputre_streams_no is passed to player_find_stream() when playing certain streams. Thus a crash happens in:\r\n\r\n```c\r\nplayer->input_streams[streams_no] = stream;\r\n```\r\n\r\nTo avoid this we can check before reaching that point.\r\n\r\n```c\r\nif(streams_no < 0){\r\n\t\t LOGI(3, \"streams_no %d\", streams_no);\r\n\t\t return -1;\r\n}\r\n```\r\n\r\nDoing that we'll reach goto error in:\r\n\r\n```c\r\nif ((player->video_stream_no = player_find_stream(player,\r\n\t\tAVMEDIA_TYPE_VIDEO, video_stream_no)) < 0) {\r\n\t\terr = player->video_stream_no;\r\n\t\tgoto error;\r\n}\r\n\r\n```\r\n\r\nBut another crash will happen in player_alloc_video_frames_free() due to uninitialized pointers in any of the \"free\" procedures, for example:\r\n\r\n```c\r\n//player->tmp_frame2 pointer is not NULL but it's unintialized\r\nif (player->tmp_frame2 != NULL) {\r\n               //CRASH\r\n\t\tavcodec_free_frame(&player->tmp_frame2);\r\n\t\tplayer->tmp_frame2 = NULL;\r\n\t}\r\n```\r\n\r\nOne possible solution it's to initialize pointers to NULL:\r\n\r\n```c\r\n\r\nint jni_player_init(JNIEnv *env, jobject thiz) {\r\n\r\n.....\r\n\t\r\n\t//Initialize pointers for sanity reasons\r\n\t\r\n+\tplayer->rgb_frame = NULL;\r\n+\tplayer->rgb_frame = NULL;\r\n+\tplayer->tmp_frame2 = NULL;\r\n+\tplayer->tmp_buffer = NULL;\r\n+\tplayer->tmp_buffer2 = NULL;\r\n\r\n\r\n...\r\n}\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/appunite/AndroidFFmpeg/issues/comments/112745652","html_url":"https://github.com/appunite/AndroidFFmpeg/issues/36#issuecomment-112745652","issue_url":"https://api.github.com/repos/appunite/AndroidFFmpeg/issues/36","id":112745652,"user":{"login":"jacek-marchwicki","id":689211,"avatar_url":"https://avatars.githubusercontent.com/u/689211?v=3","gravatar_id":"","url":"https://api.github.com/users/jacek-marchwicki","html_url":"https://github.com/jacek-marchwicki","followers_url":"https://api.github.com/users/jacek-marchwicki/followers","following_url":"https://api.github.com/users/jacek-marchwicki/following{/other_user}","gists_url":"https://api.github.com/users/jacek-marchwicki/gists{/gist_id}","starred_url":"https://api.github.com/users/jacek-marchwicki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jacek-marchwicki/subscriptions","organizations_url":"https://api.github.com/users/jacek-marchwicki/orgs","repos_url":"https://api.github.com/users/jacek-marchwicki/repos","events_url":"https://api.github.com/users/jacek-marchwicki/events{/privacy}","received_events_url":"https://api.github.com/users/jacek-marchwicki/received_events","type":"User","site_admin":false},"created_at":"2015-06-17T10:15:09Z","updated_at":"2015-06-17T10:15:09Z","body":"Fixed by: https://github.com/appunite/AndroidFFmpeg/commit/242c8870e2d34dccf70246ea31fc2e976ea79a53 My issue"}}