DynamoRIO / DynamoRIO/drmemory

Possible false positives in ffmpeg asm routines from vector and string instructions

Open
#747 0 comments 0 reactions 0 assignees View on GitHub
Bug-FalsePositive Component-FullMode Migrated Priority-Medium
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on January 12, 2012 14:11:32_

Example reports on full bot: http://build.chromium.org/p/chromium.fyi/builders/Windows%20Tests%20%28DrMemory%20full%29/builds/333/steps/memory%20test%3A%20media/logs/stdio UNINITIALIZED READ: reading 0x0637fbb0-0x0637fbb4 4 byte(s) within 0x0637fbac-0x0637fbb4
#0 avcodec-53.dll!ff_pred4x4_vertical_vp8_mmxext+0x18 (0x6e6e99a8 )
#1 avcodec-53.dll!ff_thread_finish_setup +0x186 (0x6e6965a7 )
#2 avcodec-53.dll!ptw32_threadStart +0x148 (0x6e70f5e1 )
#3 msvcrt.dll!itow_s +0x4b (0x76311287 )
#4 msvcrt.dll!endthreadex +0x6b (0x76311328 )
#5 KERNEL32.dll!BaseThreadInitThunk +0x11 (0x7606339a )
Note: @0:07:03.712 in thread 2380
Note: instruction: punpckldq (%ecx) %mm0 -> %mm0

UNINITIALIZED READ: reading 0x0648fdb0-0x0648fdb4 4 byte(s) within 0x0648fdac-0x0648fdb4
#0 avcodec-53.dll!ff_pred4x4_vertical_vp8_mmxext+0x18 (0x6e6e99a8 )
#1 ntdll.dll!RtlFreeHeap +0x7d (0x77c4e003 )
#2 avcodec-53.dll!ff_thread_finish_setup +0x186 (0x6e6965a7 )
#3 avcodec-53.dll!ptw32_threadStart +0x148 (0x6e70f5e1 )
#4 msvcrt.dll!itow_s +0x4b (0x76311287 )
#5 msvcrt.dll!endthreadex +0x6b (0x76311328 )
#6 KERNEL32.dll!BaseThreadInitThunk +0x11 (0x7606339a )
Note: @0:07:08.913 in thread 3840
Note: instruction: punpckldq (%ecx) %mm0 -> %mm0

UNINITIALIZED READ: reading register ecx
#0 avcodec-53.dll!ff_vorbis_floor1_render_list +0x1d65 (0x6e69f3d5 )
#1 avcodec-53.dll!avcodec_decode_audio3 +0x60 (0x6e69bcf1 )
#2 media::FFmpegAudioDecoder::DoDecodeBuffer [media\filters\ffmpeg_audio_decoder.cc:197]
#3 base::internal::RunnableAdapter const &)>::Run [base\bind_internal.h:188]
Note: @0:08:51.147 in thread 776
Note: instruction: movsx 0x02(%ecx) -> %ebp

UNINITIALIZED READ: reading 0x0577b5d5-0x0577b5d8 3 byte(s) within 0x0577b5c8-0x0577b5d8
#0 avcodec-53.dll!ff_put_vp8_epel8_h6_ssse3+0x49 (0x6e6fe699 )
#1 avcodec-53.dll!ff_vp3_idct_dc_add_mmx2 +0x1d6e (0x6e6fdd8f )
#2 avcodec-53.dll!ff_vp3_h_loop_filter_c +0x47ce (0x6e6ab75f )
#3 avcodec-53.dll!ff_thread_finish_setup +0x186 (0x6e6965a7 )
#4 avcodec-53.dll!ptw32_threadStart +0x148 (0x6e70f5e1 )
#5 msvcrt.dll!itow_s +0x4b (0x76311287 )
#6 msvcrt.dll!endthreadex +0x6b (0x76311328 )
#7 KERNEL32.dll!BaseThreadInitThunk +0x11 (0x7606339a )
Note: @0:10:10.308 in thread 3776
Note: instruction: movdqu 0xfffffffe(%edx) -> %xmm0

It is possible that these are real uninitialized memory accesses, but it seems more likely to me that the ffmpeg code is reading off the end of an aligned buffer and it will eventually mask out the uninitialized data. If so, we can dup this on issue #471 , but it requires investigation first.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=747_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.