[Ffmpeg-devel] Segfault when seeking in high resolution mpeg2-stream

[Samuli Valo]

Hello!

Ffmpeg seems to segfault sometimes when seeking in high resolution mpeg-2
stream. Error is repeatable, but random in nature. This might happen 
after 5 seeks or
after 1000 seeks, f.e. in last test 5sec loop run for 40min and then 
crashed. Test before
that did not last one minute...

Segfault happens when using mpeg-2 stream with resolution of 1920x500,
encoded with 20Mbps bitrate and only I-frames. Other high resolutions 
are not
tested, but segfault does not seem to happen with same encoder & same
parameters when using sd-resolution (720x576). With dv-stream this does 
not happen.

Does anyone have any ideas about why this could happen? Gdb backtrace is 
below, if
any other info could help finding this bug, I would be more than happy 
to help!

Btw. Is there some other codec, which would work well with high 
resolutions and have
reliable seeking?

Gdb backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1115699552 (LWP 6690)]
0x00002aaaaacf7c22 in ff_mpeg1_find_frame_end (pc=0x6850c0,
    buf=0x1555000 <Address 0x1555000 out of bounds>, buf_size=100214)
    at mpeg12.c:3020
3020                state= (state<<8) | buf[i];
Current language:  auto; currently c
(gdb) backtrace
#0  0x00002aaaaacf7c22 in ff_mpeg1_find_frame_end (pc=0x6850c0,
    buf=0x1555000 <Address 0x1555000 out of bounds>, buf_size=100214)
    at mpeg12.c:3020
#1  0x00002aaaaacf7e4c in mpeg_decode_frame (avctx=0x6cef20, data=0x6d7200,
    data_size=0x42802e34, buf=0x1549410 "", buf_size=100214) at 
mpeg12.c:3059
#2  0x00002aaaaac49ff3 in avcodec_decode_video (avctx=0x6cef20,
    picture=0x6d7200, got_picture_ptr=0x42802e34, buf=0x1549410 "",
    buf_size=100214) at utils.c:621
#3  0x00002aaaabff4d83 in FFMpegSource::decode_frame (this=0x5289f0)
    at ffmpeg_source.cc:514
#4  0x00002aaaabff5221 in FFMpegSource::seek (this=0x5289f0, 
tc=204800000000,
    where=0) at ffmpeg_source.cc:618
#5  0x00002aaaabff4ac8 in FFMpegSource::_handle_eof (this=0x5289f0,
    seek=0x42802f2f) at ffmpeg_source.cc:454
#6  0x00002aaaabff4e8f in FFMpegSource::decode_frame (this=0x5289f0)
    at ffmpeg_source.cc:534
#7  0x00002aaaabff49ef in FFMpegSource::draw (this=0x5289f0, 
_surf_x=0x1530a20)
    at ffmpeg_source.cc:437
#8  0x00002aaaabff567e in FFMpegSource::simpleDraw (this=0x5289f0, 
output_id=0)
    at ffmpeg_source.cc:711
#9  0x00002aaaaaae6756 in Source::threadMain (this=0x5289f0)
    at obj_source.cc:74
#10 0x00002aaaaaafb532 in Thread::_threadMain (this=0x528a40)
---Type <return> to continue, or q <return> to quit---
    at st_thread.cc:71
#11 0x00002aaaaaafb583 in Thread::_threadWrapperMain (x=0x528a40)
    at st_thread.cc:79
#12 0x0000003424455026 in SDL_RunThread () from /usr/lib64/libSDL-1.2.so.0
#13 0x0000003424455419 in SDL_KillThread () from /usr/lib64/libSDL-1.2.so.0
#14 0x000000341d3060aa in start_thread () from /lib64/tls/libpthread.so.0
#15 0x000000341c6c53d3 in clone () from /lib64/tls/libc.so.6
#16 0x0000000000000000 in ?? ()