Opened 7 years ago
Closed 6 years ago
#6658 closed defect (fixed)
Dash demuxer segfault
Reported by: | Detergent | Owned by: | |
---|---|---|---|
Priority: | important | Component: | avformat |
Version: | git-master | Keywords: | dash crash SIGSEGV |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description
Summary of the bug:
How to reproduce:
% ffmpeg -i http://download.tsi.telecom-paristech.fr/gpac/dataset/dash/uhd/dashevc-main-6s/dashevc-main-6s.mpd ffmpeg version N-87286-g6ce4a635ed Copyright (c) 2000-2017 the FFmpeg developers built with gcc 5.4.0 (Ubuntu 5.4.0-6ubuntu1~16.04.4) 20160609 configuration: --enable-gpl --enable-nonfree --enable-libx264 --enable-libopus --enable-shared --enable-libcaca --enable-openssl --enable-libxml2 libavutil 55. 74.100 / 55. 74.100 libavcodec 57.105.100 / 57.105.100 libavformat 57. 82.100 / 57. 82.100 libavdevice 57. 8.100 / 57. 8.100 libavfilter 6.105.100 / 6.105.100 libswscale 4. 7.103 / 4. 7.103 libswresample 2. 8.100 / 2. 8.100 libpostproc 54. 6.100 / 54. 6.100 [2] 26794 segmentation fault (core dumped) ffmpeg -i
Backtrace:
Program received signal SIGSEGV, Segmentation fault. 0x00007fbf08d83ce3 in ff_dash_fill_tmpl_params (dst=dst@entry=0x7fffffffb7b0 " ", buffer_size=buffer_size@entry=4096, template=0x0, rep_id=rep_id@entry=0, number=0, bit_rate=bit_rate@entry=0, time=0) at libavformat/dash.c:102 102 while (dst_pos < buffer_size - 1 && *t_cur) { (gdb) bt #0 0x00007fbf08d83ce3 in ff_dash_fill_tmpl_params (dst=dst@entry=0x7fffffffb7b0 " ", buffer_size=buffer_size@entry=4096, template=0x0, rep_id=rep_id@entry=0, number=0, bit_rate=bit_rate@entry=0, time=0) at libavformat/dash.c:102 #1 0x00007fbf08d87c5d in get_current_fragment (pls=pls@entry=0x66e6e0) at libavformat/dashdec.c:1253 #2 0x00007fbf08d87f24 in read_data (opaque=0x66e6e0, buf=0x67e060 "Ȓ\030\006\277\177", buf_size=32768) at libavformat/dashdec.c:1406 #3 0x00007fbf08d78157 in fill_buffer (s=0x66e6e8) at libavformat/aviobuf.c:573 #4 avio_read (s=s@entry=0x66e6e8, buf=0x66ef00 "\270\222\030\006\277\177", size=size@entry=2048) at libavformat/aviobuf.c:667 #5 0x00007fbf08da1ed3 in av_probe_input_buffer2 (pb=pb@entry=0x66e6e8, fmt=fmt@entry=0x7fffffffc968, filename=filename@entry=0x7fbf08ee021c "", logctx=logctx@entry=0x0, offset=offset@entry=0, max_probe_size=1048576, max_probe_size@entry=0) at libavformat/format.c:314 #6 0x00007fbf08da20e9 in av_probe_input_buffer (pb=pb@entry=0x66e6e8, fmt=fmt@entry=0x7fffffffc968, filename=filename@entry=0x7fbf08ee021c "", logctx=logctx@entry=0x0, offset=offset@entry=0, max_probe_size=max_probe_size@entry=0) at libavformat/format.c:368 #7 0x00007fbf08d84536 in reopen_demux_for_component (s=s@entry=0x669e20, pls=pls@entry=0x66e6e0) at libavformat/dashdec.c:1530 #8 0x00007fbf08d84dd5 in open_demux_for_component (s=s@entry=0x669e20, pls=0x66e6e0) at libavformat/dashdec.c:1565 #9 0x00007fbf08d8841d in dash_read_header (s=0x669e20) at libavformat/dashdec.c:1615 #10 0x00007fbf08eaf0ee in avformat_open_input (ps=ps@entry=0x7fffffffcb88, filename=filename@entry=0x7fffffffde40 "http://download.tsi.telecom-paristech.fr/gpac/dataset/dash/uhd/dashevc-main-6s/dashevc-main-6s.mpd", fmt=fmt@entry=0x0, options=0x669c28) at libavformat/utils.c:595 #11 0x0000000000417b55 in open_input_file (o=o@entry=0x7fffffffcd40, filename=<optimized out>) at ffmpeg_opt.c:1060 #12 0x0000000000419a23 in open_files (l=0x669bd8, l=0x669bd8, open_file=0x4160d0 <open_input_file>, inout=0x43299f "input") at ffmpeg_opt.c:3278 #13 ffmpeg_parse_options (argc=argc@entry=3, argv=argv@entry=0x7fffffffda98) at ffmpeg_opt.c:3318 #14 0x0000000000408542 in main (argc=3, argv=0x7fffffffda98) at ffmpeg.c:4786
Attachments (1)
Change History (5)
comment:1 by , 7 years ago
Keywords: | crash SIGSEGV added; demux removed |
---|---|
Priority: | normal → important |
Reproduced by developer: | set |
Status: | new → open |
by , 7 years ago
Attachment: | dashevc-main-6s.mpd added |
---|
comment:2 by , 6 years ago
comment:4 by , 6 years ago
Resolution: | → fixed |
---|---|
Status: | open → closed |
fix by commit: 7a63da891023767824af75ff1c9fe681c156ac19
Note:
See TracTickets
for help on using tickets.
The crash is caused by failing to handle the relative URL in the representation baseURL value.