[Ffmpeg-devel] segfault in ff_mpeg1_find_frame_end()

[Måns Rullgård]

Stefan Lucke <stefan at lucke.in-berlin.de> writes:

> On Sonntag, 10. April 2005 20:37, M?ns Rullg?rd wrote:
>> Stefan Lucke <stefan at lucke.in-berlin.de> writes:
>> 
>> > Hi,
>> >
>> > We are developing a plugin for vdr named softdevice. Plugins homepage
>> > is at http://softdevice.berlios.de .
>> >
>> > I get a segfault in function mentioned in subject. The segfault happens
>> > when there is a transition in aspect ratio from 16:9 to 4:3. It happens not
>> > when the stream is played the first time but when its played the 3rd time.
>> > But this may vary (segfault may happen at the first time too).
>> 
>> That makes me suspect a problem in your code.  Could you be
>> accidentally using a freed buffer?  Maybe a race between threads.
>
> That was one of my initial thoughts too. But I think it is related
> to the thread: "bug in aspect ratio change detection" from
> 2005-04-02.  For a test, I backed out Ivan Kalvachev's change
> (mpeg12.c from rev 1.227 to 1.228). So I got no segfaults any more,
> but aspect ratio change is not detected correct. Then I used my
> rejected patch and so I've no segfaults and aspect ratio is detected
> correct ;-) .

That change causes some buffers to be reallocated.  My guess is that
something is still holding pointers to the old buffers.  Perhaps
someone more familiar with the code could make a better guess.

>> > To ensure that it has nothing to with PADDING bytes I added extra
>> > code that mallocs and copies data before decoding and zeros
>> > from "data+size" FF_INPUT_BUFFER_PADDING_SIZE bytes.
>> >
>> > I'm using ffmpeg cvs version from today.
>> >
>> > What could be done to track down the cause of segfault?
>> 
>> Can the crash be reproduced using the "ffmpeg" command?
>
> No, at least not with ffmep -i in_file_name xx.m2v. Are there other
> usfull parameters ?

Not really.  Could you put a sample somewhere?

>> This looks like an unrelated crash.
>
> But it happens at the same place when aspect ratio changes from 16:9
> to 4:3.

All signs are pointing at some buffer misuse.  Could you try running
it under valgrind?

-- 
M?ns Rullg?rd
mru at inprovide.com