Help - Search - Members - Calendar
Full Version: 3.95 fast preset crashes
Hydrogenaudio Forums > Lossy Audio Compression > MP3 > MP3 - Tech
sony666
Hi smile.gif
it got a little chaotic in the validated news/release thread, please allow me to summarize here:

---

Version from rarewarez (jan 11. 11:11) crashed while encoding a file with --alt-preset fast standard

Unhandled exception at 0x0041e40b in lame.exe: 0xC0000005: Access violation reading location 0x4e525315.

too bad I dont have the debug symbols.. disassembly then

0041E3FC mov edx,dword ptr [esp+10h]
0041E400 mov edi,dword ptr [esp+14h]
0041E404 mov ecx,dword ptr [edx+edi*8+459A2Ch]
--> 0041E40B mov cl,byte ptr [eax+ecx]
0041E40E shl ecx,18h
0041E411 sar ecx,18h
0041E414 add ebp,ecx

WinXP blabla very stable, Celeron 1.7 nothing Overclocked

---

--preset fast medium crashes also, but a few 100 frames later then apfs. both 100% reproduceable here

00430287 fst dword ptr [edx+0Ch]
0043028A mov ecx,dword ptr [edx]
-->0043028C fld qword ptr [ecx*8-57B4B120h]
00430293 faddp st(3),st
00430295 fxch st(2)

in the line where it crashed (arrow), ecx is a value over 1.2 billion, type unsigned long.
multiplied with *8 -> overflow error maybe, I'm not very apt in assembler smile.gif

in the apfs case, it looks very similar. In the fast preset code (vbr-new still?) there might be an opertion with an ulong *8.. but I'm to lazy to check out the code now rolleyes.gif

normal presets (no fast) all work fine

---

Mitiok compile (ICL 4.5) crashes too with my Body Count track and ap fast std, same place.

---

So, now I compiled it myself with MSVC 7.0 (Visual Studio 2002), no NASM
It still crashes in release config on fast preset medium/standard, debug config runs fine.

I was able to get a callstack from the release build eventually:

> lame.exe!_mdct_sub48() + 0x9b6 C
lame.exe!_count_bits() + 0x84 C
lame.exe!_bin_search_StepSize() + 0x4e C
lame.exe!_VBR_noise_shaping() + 0x348 C
lame.exe!_VBR_iteration_loop() + 0x115 C


disassembly for top line (mdct_sub48()):
00421236 fadd qword ptr [ebx*8-57B6E880h]

again a very large number (1.2 billion) multiplied with 8, which might cause an ulong overflow.

thanks for your interest, trying to get some debug symbols to work..
sony666
finally, debug symbols smile.gif

CODE

> lame.exe!quantize_xrpow(const double * xp=0xb5000000, int * pi=0x004febe8, double istep=92681.900023683163, gr_info * const cod_info=0x004fd9e8, calc_noise_data_t * prev_noise=0x00000000)  Line 177 + 0x8a C

 lame.exe!count_bits(lame_internal_flags * const gfc=0x004f5cb0, const double * const xr=0x0011f0d0, gr_info * const gi=0x004fd9e8, calc_noise_data_t * prev_noise=0x00000000)  Line 844 C

 lame.exe!bin_search_StepSize(lame_internal_flags * const gfc=0x00000000, gr_info * const cod_info=0x004fd9e8, int desired_rate=2568, const int ch=0, const double * xrpow=0x0011f0d0)  Line 450 + 0xe C

 lame.exe!VBR_noise_shaping(lame_internal_flags * gfc=0x004f5cb0, double * xr34orig=0x00121a68, int minbits=126, int maxbits=2676, double * l3_xmin=0x00121588, int gr=0, int ch=0)  Line 1261 + 0x18 C

 lame.exe!VBR_iteration_loop(lame_global_struct * gfp=0x004febe8, float [2]* pe=0x667f3bcd, float * ms_ener_ratio=0x40f6a09e, III_psy_ratio [2]* ratio=0x004fd9e8)  Line 1638 + 0x23 C


the problem seems to be takehiro.c, quantize_xrpow(), or it's caller. I'm not sure if that nullpointer (for prev_noise) there is ok...
Gabriel
I can reproduce it:
fadd qword ptr [edx+ecx*8] ->access violation

The crash is in quantize_xrpow, but the problem is not prev_noise.

Unfortunately it does not crash with all tracks.
Gabriel
Crash should be fixed, new test files uploaded
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.