ao=null never receives EOF with ao-null-untimed

mpv Information

mpv v0.38.0-590-gd36f72eb63-dirty Copyright © 2000-2024 mpv/MPlayer/mplayer2 projects
 built on Jun 23 2024 20:55:13
libplacebo version: v7.349.0 (v7.349.0-rc1-20-gea3d0673-dirty)
FFmpeg version: N-115634-g6a05128a13
FFmpeg library versions:
   libavcodec      61.7.100
   libavdevice     61.2.100
   libavfilter     10.2.102
   libavformat     61.3.104
   libavutil       59.21.100
   libswresample   5.2.100
   libswscale      8.2.100

Other Information

• Linux version: Ubuntu 16.04
• Kernel Version: 4.4
• GPU Model: NVIDIA GeForce 256
• Mesa/GPU Driver Version: 71.86.13
• Window Manager and Version: NO
• Source mpv: https://github.com/mpv-player/mpv
• Introduced in version: I don't know

Reproduction Steps

1. Extract provided sample file
2. mpv --no-config --ao=null --untimed --ao-null-untimed ./clusterfuzz-testcase-minimized-fuzzer_loadfile-4665657266864128

Expected Behavior

mpv exits after playing the file

Actual Behavior

mpv hangs and never reports EOF

Log File

We get one frame of data, eat it, and than loop without any data.

[ao/null] starting AO
[ao/null] in=7168 space=8704(8704) pl=1, eof=0
[ao/null] in=0 space=8704(8704) pl=1, eof=0
[ao/null] in=0 space=8704(8704) pl=1, eof=0
[ao/null] in=0 space=8704(8704) pl=1, eof=0
[ao/null] in=0 space=8704(8704) pl=1, eof=0
<repeated inf times>

Sample Files

clusterfuzz-testcase-minimized-fuzzer_loadfile-4665657266864128.zip

I carefully read all instruction and confirm that I did the following:

• I tested with the latest mpv version to validate that the issue is not already fixed.
• I provided all required information including system and mpv version.
• I produced the log file with the exact same set of files, parameters, and conditions used in "Reproduction Steps", with the addition of --log-file=output.txt.
• I produced the log file while the behaviors described in "Actual Behavior" were actively observed.
• I attached the full, untruncated log file.
• I attached the backtrace in the case of a crash.

Start by running the reported mpv command with the attached sample and inspect the null audio output path involved in --ao-null-untimed. Done means the sample is consumed and mpv exits instead of looping after the audio buffer is empty.