Opened 2 years ago

Closed 19 months ago

#6658 closed defect (fixed)

Dash demuxer segfault

Reported by: Detergent Owned by:
Priority: important Component: avformat
Version: git-master Keywords: dash crash SIGSEGV
Cc: Blocked By:
Blocking: Reproduced by developer: yes
Analyzed by developer: no

Description

Summary of the bug:
How to reproduce:

% ffmpeg -i http://download.tsi.telecom-paristech.fr/gpac/dataset/dash/uhd/dashevc-main-6s/dashevc-main-6s.mpd
ffmpeg version N-87286-g6ce4a635ed Copyright (c) 2000-2017 the FFmpeg developers
  built with gcc 5.4.0 (Ubuntu 5.4.0-6ubuntu1~16.04.4) 20160609
  configuration: --enable-gpl --enable-nonfree --enable-libx264 --enable-libopus --enable-shared --enable-libcaca --enable-openssl --enable-libxml2
  libavutil      55. 74.100 / 55. 74.100
  libavcodec     57.105.100 / 57.105.100
  libavformat    57. 82.100 / 57. 82.100
  libavdevice    57.  8.100 / 57.  8.100
  libavfilter     6.105.100 /  6.105.100
  libswscale      4.  7.103 /  4.  7.103
  libswresample   2.  8.100 /  2.  8.100
  libpostproc    54.  6.100 / 54.  6.100
[2]    26794 segmentation fault (core dumped)  ffmpeg -i 

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007fbf08d83ce3 in ff_dash_fill_tmpl_params (dst=dst@entry=0x7fffffffb7b0 " ", 
    buffer_size=buffer_size@entry=4096, template=0x0, rep_id=rep_id@entry=0, number=0, 
    bit_rate=bit_rate@entry=0, time=0) at libavformat/dash.c:102
102	    while (dst_pos < buffer_size - 1 && *t_cur) {
(gdb) bt
#0  0x00007fbf08d83ce3 in ff_dash_fill_tmpl_params (dst=dst@entry=0x7fffffffb7b0 " ", 
    buffer_size=buffer_size@entry=4096, template=0x0, rep_id=rep_id@entry=0, number=0, 
    bit_rate=bit_rate@entry=0, time=0) at libavformat/dash.c:102
#1  0x00007fbf08d87c5d in get_current_fragment (pls=pls@entry=0x66e6e0)
    at libavformat/dashdec.c:1253
#2  0x00007fbf08d87f24 in read_data (opaque=0x66e6e0, buf=0x67e060 "Ȓ\030\006\277\177", 
    buf_size=32768) at libavformat/dashdec.c:1406
#3  0x00007fbf08d78157 in fill_buffer (s=0x66e6e8) at libavformat/aviobuf.c:573
#4  avio_read (s=s@entry=0x66e6e8, buf=0x66ef00 "\270\222\030\006\277\177", 
    size=size@entry=2048) at libavformat/aviobuf.c:667
#5  0x00007fbf08da1ed3 in av_probe_input_buffer2 (pb=pb@entry=0x66e6e8, 
    fmt=fmt@entry=0x7fffffffc968, filename=filename@entry=0x7fbf08ee021c "", 
    logctx=logctx@entry=0x0, offset=offset@entry=0, max_probe_size=1048576, 
    max_probe_size@entry=0) at libavformat/format.c:314
#6  0x00007fbf08da20e9 in av_probe_input_buffer (pb=pb@entry=0x66e6e8, 
    fmt=fmt@entry=0x7fffffffc968, filename=filename@entry=0x7fbf08ee021c "", 
    logctx=logctx@entry=0x0, offset=offset@entry=0, max_probe_size=max_probe_size@entry=0)
    at libavformat/format.c:368
#7  0x00007fbf08d84536 in reopen_demux_for_component (s=s@entry=0x669e20, 
    pls=pls@entry=0x66e6e0) at libavformat/dashdec.c:1530
#8  0x00007fbf08d84dd5 in open_demux_for_component (s=s@entry=0x669e20, pls=0x66e6e0)
    at libavformat/dashdec.c:1565
#9  0x00007fbf08d8841d in dash_read_header (s=0x669e20) at libavformat/dashdec.c:1615
#10 0x00007fbf08eaf0ee in avformat_open_input (ps=ps@entry=0x7fffffffcb88, 
    filename=filename@entry=0x7fffffffde40 "http://download.tsi.telecom-paristech.fr/gpac/dataset/dash/uhd/dashevc-main-6s/dashevc-main-6s.mpd", fmt=fmt@entry=0x0, options=0x669c28)
    at libavformat/utils.c:595
#11 0x0000000000417b55 in open_input_file (o=o@entry=0x7fffffffcd40, 
    filename=<optimized out>) at ffmpeg_opt.c:1060
#12 0x0000000000419a23 in open_files (l=0x669bd8, l=0x669bd8, 
    open_file=0x4160d0 <open_input_file>, inout=0x43299f "input") at ffmpeg_opt.c:3278
#13 ffmpeg_parse_options (argc=argc@entry=3, argv=argv@entry=0x7fffffffda98)
    at ffmpeg_opt.c:3318
#14 0x0000000000408542 in main (argc=3, argv=0x7fffffffda98) at ffmpeg.c:4786

Attachments (1)

dashevc-main-6s.mpd (32.9 KB) - added by cehoyos 2 years ago.

Download all attachments as: .zip

Change History (5)

comment:1 Changed 2 years ago by cehoyos

  • Keywords crash SIGSEGV added; demux removed
  • Priority changed from normal to important
  • Reproduced by developer set
  • Status changed from new to open

Changed 2 years ago by cehoyos

comment:2 Changed 22 months ago by kccpac

The crash is caused by failing to handle the relative URL in the representation baseURL value.

comment:3 Changed 22 months ago by kccpac

The crash is caused by failing to handle the relative URL in the representation baseURL value.

Version 0, edited 22 months ago by kccpac (next)

comment:4 Changed 19 months ago by stevenliu

  • Resolution set to fixed
  • Status changed from open to closed
Note: See TracTickets for help on using tickets.