#7976 closed defect (fixed)

ffplay mpd file segfaults in refresh_manifest()

Reported by: clem Owned by:
Priority: important Component: avformat
Version: git-master Keywords: dash crash SIGSEGV
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

ffplay http://.../test.mpd plays for a while (>30s) and then segfaults with a null pointer deref in refresh_manifest() libavformat/dashdec.c:1437

ffmpeg 4154f89678

ffplay version n4.1.3 Copyright (c) 2003-2019 the FFmpeg developers
  built with gcc 9 (GCC)
  configuration: --enable-libxml2
  libavutil      56. 22.100 / 56. 22.100
  libavcodec     58. 35.100 / 58. 35.100
  libavformat    58. 20.100 / 58. 20.100
  libavdevice    58.  5.100 / 58.  5.100
  libavfilter     7. 40.101 /  7. 40.101
  libswscale      5.  3.100 /  5.  3.100
  libswresample   3.  3.100 /  3.  3.100
0x00000000006378b0 in refresh_manifest (s=0x0) at libavformat/dashdec.c:1437
1437	    DASHContext *c = s->priv_data;
(gdb) where
#0  0x00000000006378b0 in refresh_manifest (s=0x0) at libavformat/dashdec.c:1437
#1  0x0000000000638203 in get_current_fragment (pls=pls@entry=0x7fffd0005cc0)
    at libavformat/dashdec.c:1542
#2  0x0000000000638669 in read_data (opaque=0x7fffd0005cc0, buf=0x7fffd0896bc0 "", buf_size=32768)
    at libavformat/dashdec.c:1709
#3  0x0000000000626b01 in read_packet_wrapper (size=32768, buf=<optimized out>, s=0x7fffd0005cc8)
    at libavformat/aviobuf.c:535
#4  fill_buffer (s=0x7fffd0005cc8) at libavformat/aviobuf.c:585
#5  avio_read (s=s@entry=0x7fffd0005cc8, buf=<optimized out>, size=size@entry=2048)
    at libavformat/aviobuf.c:678
#6  0x0000000000650a04 in av_probe_input_buffer2 (pb=pb@entry=0x7fffd0005cc8, 
    fmt=fmt@entry=0x7fffdcc9dad0, filename=filename@entry=0x117939c "", logctx=logctx@entry=0x0, 
    offset=offset@entry=0, max_probe_size=1048576, max_probe_size@entry=0) at libavformat/format.c:262
#7  0x0000000000650bf9 in av_probe_input_buffer (pb=pb@entry=0x7fffdNcat: 0005cc8, 
    fmt=fmt@entry=0x7fffdcc9dad0, filename=filename@entry=0x117939c "", logctx=logctx@entry=0x0, 
    offset=offset@entry=0,Broken pipe.
 max_probe_size=max_probe_size@entry=0) at libavformat/format.c:316
#8  0x0000000000633ec4 in reopen_demux_for_component (s=s@entry=0x7fffd0000b80, 
    pls=pls@entry=0x7fffd0005cc0) at libavformat/dashdec.c:1850
#9  0x00000000006355cc in dash_read_packet (s=0x7fffd0000b80, pkt=0x7fffdcc9dc60)
    at libavformat/dashdec.c:2115
#10 0x0000000000732733 in ff_read_packet (s=s@entry=0x7fffd0000b80, pkt=pkt@entry=0x7fffdcc9dc60)
    at libavformat/utils.c:856
#11 0x00000000007337e9 in read_frame_internal (s=0x7fffd0000b80, pkt=0x7fffdcc9ddc0)
    at libavformat/utils.c:1582
#12 0x000000000073477d in av_read_frame (s=0x7fffd0000b80, pkt=pkt@entry=0x7fffdcc9ddc0)
    at libavformat/utils.c:472
#13 0x000000000048c2b8 in read_thread (arg=0x45869c0) at fftools/ffplay.c:3014
#14 0x00007ffff7c126e0 in ?? () from /lib64/libSDL2-2.0.so.0
#15 0x00007ffff7c8a2ad in ?? () from /lib64/libSDL2-2.0.so.0
#16 0x00007ffff786c5a2 in start_thread () from /lib64/libpthread.so.0
#17 0x00007ffff7799163 in clone () from /lib64/libc.so.6

Attachments (1)

master.mpd (31.7 KB) - added by npryan 11 months ago.
Example mpd causing segfault with startNumber parser for segmentlist

Download all attachments as: .zip

Change History (13)

comment:1 Changed 14 months ago by cehoyos

  • Component changed from ffplay to avformat
  • Keywords dash crash SIGSEGV added; segfault removed

Please test current FFmpeg git head and provide all missing information as explained on http://ffmpeg.org/bugreports.html

comment:2 follow-ups: Changed 13 months ago by stevenliu

Hi can you leave the mpd link here, let me test it.

comment:3 in reply to: ↑ 2 Changed 13 months ago by clem

Replying to stevenliu:

Hi can you leave the mpd link here, let me test it.

Sorry, I don't have a public source, I was just re-muxing a rtsp stream generated with ffmpeg.

The crash is related to the window expiration. With the rtsp source using 90 frame gops, the segfault happened after ~48s, which is the window size (3*16=48). Reducing the gop size to 60 frames, it would crash after 30s.

Here is the ffmpeg command to generate the mpd:

ffmpeg \
        -nostats -hide_banner \
        -buffer_size 1572864 \
        -i rtsp://192.168.100.100/video1 \
        -probesize 32 \
        -c:v copy \
        -an \
        -copyts \
        -fflags nobuffer \
        -flags +global_header+low_delay \
        -seg_duration 0.5 \
        -window_size 16 \
        -extra_window_size 2 \
        -use_template 0 \
        -use_timeline 0 \
        -init_seg_name 'live-init-stream$RepresentationID$.m4s' \
        -media_seg_name 'live-$RepresentationID$-$Number%06d$-$Time%09d$.m4s' \
        -hls_playlist 1 \
        -streaming 1 \
        -dash_segment_type mp4 \
        -f dash test.mpd

comment:4 in reply to: ↑ 2 Changed 13 months ago by clem

Replying to stevenliu:

Hi can you leave the mpd link here, let me test it.

Sorry, I don't have a public source, I was just re-muxing a rtsp stream generated with ffmpeg.

The crash is related to the window expiration. With the rtsp source using 90 frame gops, the segfault happened after ~48s, which is the window size (3*16=48). Reducing the gop size to 60 frames, it would crash after 30s.

Here is the ffmpeg command to generate the mpd:

ffmpeg \
        -nostats -hide_banner \
        -buffer_size 1572864 \
        -i rtsp://192.168.100.100/video1 \
        -probesize 32 \
        -c:v copy \
        -an \
        -copyts \
        -fflags nobuffer \
        -flags +global_header+low_delay \
        -seg_duration 0.5 \
        -window_size 16 \
        -extra_window_size 2 \
        -use_template 0 \
        -use_timeline 0 \
        -init_seg_name 'live-init-stream$RepresentationID$.m4s' \
        -media_seg_name 'live-$RepresentationID$-$Number%06d$-$Time%09d$.m4s' \
        -hls_playlist 1 \
        -streaming 1 \
        -dash_segment_type mp4 \
        -f dash test.mpd
Version 0, edited 13 months ago by clem (next)

comment:5 follow-up: Changed 13 months ago by cehoyos

Can't you upload what you produced?

comment:6 in reply to: ↑ 5 Changed 13 months ago by clem

Replying to cehoyos:

Can't you upload what you produced?

It is a live stream, the .mpd file is constantly (every 5s) changing and the problem seems to occur when the all the segments that where present initially have fallen out of the sliding window.

Just reading the initial .mpd file is fine, the problem doesn't occur until the 16 or 17th time it reads the .mpd file.

comment:7 Changed 13 months ago by stevenliu

OK

I have reproduced it, let me think how to fix it.

comment:8 Changed 11 months ago by stevenliu

Changed 11 months ago by npryan

Example mpd causing segfault with startNumber parser for segmentlist

comment:9 Changed 11 months ago by npryan

I have attached an example mpd file which produces a segfault in ffprobe with the patch https://patchwork.ffmpeg.org/patch/14996/ applied.

I am about to submit a patch which should rectify this.

comment:10 Changed 11 months ago by npryan

comment:11 Changed 11 months ago by cehoyos

The attached sample (and patch) look unrelated to the provided bug report.

comment:12 Changed 11 months ago by cehoyos

  • Priority changed from normal to important
  • Resolution set to fixed
  • Status changed from new to closed

Maybe fixed by Steven Liu in e55018ee110bf42e32739b1725411dde44e70291

Note: See TracTickets for help on using tickets.