Opened 13 months ago
Closed 13 months ago
#10628 closed defect (invalid)
vulkan decoder crash after seek
| Reported by: | quinkblack | Owned by: | |
|---|---|---|---|
| Priority: | critical | Component: | avcodec |
| Version: | unspecified | Keywords: | |
| Cc: | Blocked By: | ||
| Blocking: | Reproduced by developer: | yes | |
| Analyzed by developer: | no |
Description (last modified by )
With this two patches, I got ffplay work with vulkan decoder and renderer.
https://ffmpeg.org/pipermail/ffmpeg-devel/2023-October/315852.html
https://ffmpeg.org/pipermail/ffmpeg-devel/2023-October/315853.html
Then with this command:
./ffplay -hwaccel vulkan cctv.mp4
The playback is fine. However, with seek there is a heap use after free crash:
Seek to 35% ( 0:10:26) of total duration ( 0:29:59) B f=0/0
=================================================================
==274710==ERROR: AddressSanitizer: heap-use-after-free on address 0x62100058eac8 at pc 0x559f471bf654 bp 0x7f977474c470 sp 0x7f977474c468
READ of size 8 at 0x62100058eac8 thread T36 (av:h264:df15)
#0 0x559f471bf653 in ff_vk_unmap_buffers /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/vulkan.c:1045:13
#1 0x559f49b0207c in ff_vk_unmap_buffer /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/vulkan.h:419:12
#2 0x559f49b01f4e in free_data_buf /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_video.c:206:5
#3 0x559f4adf47c8 in buffer_pool_flush /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/buffer.c:302:9
#4 0x559f4adf4944 in buffer_pool_free /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/buffer.c:313:5
#5 0x559f4adf4e96 in pool_release_buffer /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/buffer.c:350:9
#6 0x559f4adf2fe6 in buffer_replace /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/buffer.c:133:9
#7 0x559f4adf2d88 in av_buffer_unref /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/buffer.c:144:5
#8 0x559f471b5001 in ff_vk_exec_discard_deps /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/vulkan.c:549:9
#9 0x559f471b800c in ff_vk_exec_wait /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/vulkan.c:506:5
#10 0x559f49ad3c86 in ff_vk_decode_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_decode.c:375:9
#11 0x559f49ae32d3 in vk_h264_end_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_h264.c:530:12
#12 0x559f4a26e74c in ff_h264_field_end /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264_picture.c:238:15
#13 0x559f4854d788 in h264_decode_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264dec.c:1066:20
#14 0x559f48e5405c in frame_worker_thread /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/pthread_frame.c:223:21
#15 0x7f97d8094ac2 in start_thread nptl/./nptl/pthread_create.c:442:8
#16 0x7f97d8126a3f misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
0x62100058eac8 is located 456 bytes inside of 4296-byte region [0x62100058e900,0x62100058f9c8)
freed by thread T37 here:
#0 0x559f4647cf12 in __interceptor_free (/home/quink/work/ffmpeg-ci/build/ffmpeg/ffplay+0x8b8f12) (BuildId: 5af246cc4f5d24a4baf349e77196a345b9331952)
#1 0x559f4ae99dc4 in av_free /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/mem.c:241:5
#2 0x559f48f23abe in ff_refstruct_unref /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/refstruct.c:130:9
#3 0x559f48f23d5e in ff_refstruct_replace /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/refstruct.c:163:5
#4 0x559f49ad0117 in ff_vk_update_thread_context /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_decode.c:93:5
#5 0x559f48e4eced in update_context_from_thread /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/pthread_frame.c:379:23
#6 0x559f48e4c39c in submit_packet /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/pthread_frame.c:471:15
#7 0x559f48e4b1e9 in ff_thread_decode_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/pthread_frame.c:522:11
#8 0x559f481d18e6 in decode_simple_internal /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:428:20
#9 0x559f481d0f54 in decode_simple_receive_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:609:15
#10 0x559f481bf11f in decode_receive_frame_internal /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:637:15
#11 0x559f481bebf6 in avcodec_send_packet /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:734:15
#12 0x559f464f945a in decoder_decode_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/fftools/ffplay.c:667:17
#13 0x559f464fa2a2 in get_video_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/fftools/ffplay.c:1776:24
#14 0x559f464f112b in video_thread /home/quink/work/ffmpeg-ci/build/ffmpeg/src/fftools/ffplay.c:2149:15
#15 0x7f97d9afac6d (/lib/x86_64-linux-gnu/libSDL2-2.0.so.0+0x116c6d) (BuildId: 4d5b3c4d6ed820f4264d19e6b9dee40106d05359)
previously allocated by thread T21 (av:h264:df0) here:
#0 0x559f4647dd37 in posix_memalign (/home/quink/work/ffmpeg-ci/build/ffmpeg/ffplay+0x8b9d37) (BuildId: 5af246cc4f5d24a4baf349e77196a345b9331952)
#1 0x559f4ae9998f in av_malloc /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavutil/mem.c:105:9
#2 0x559f48f234c3 in ff_refstruct_alloc_ext_c /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/refstruct.c:105:11
#3 0x559f49ade4d6 in ff_refstruct_alloc_ext /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/refstruct.h:97:12
#4 0x559f49ad738b in vulkan_decode_bootstrap /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_decode.c:629:23
#5 0x559f49ad6c25 in ff_vk_frame_params /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_decode.c:1011:11
#6 0x559f481c4e3e in avcodec_get_hw_frames_parameters /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:1194:11
#7 0x559f481c464b in ff_decode_get_hw_frames_ctx /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:1134:11
#8 0x559f49adbf94 in ff_vk_decode_init /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/vulkan_decode.c:1137:11
#9 0x559f481c6a1a in hwaccel_init /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:1238:15
#10 0x559f481c6345 in ff_get_format /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/decode.c:1376:19
#11 0x559f4a2a9665 in get_pixel_format /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264_slice.c:911:12
#12 0x559f4a2a0e20 in h264_init_ps /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264_slice.c:1144:20
#13 0x559f4a28c77a in h264_field_start /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264_slice.c:1395:11
#14 0x559f4a287af4 in ff_h264_queue_decode_slice /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264_slice.c:2132:15
#15 0x559f485507d7 in decode_nal_units /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264dec.c:651:24
#16 0x559f4854d28c in h264_decode_frame /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/h264dec.c:1047:17
#17 0x559f48e5405c in frame_worker_thread /home/quink/work/ffmpeg-ci/build/ffmpeg/src/libavcodec/pthread_frame.c:223:21
#18 0x7f97d8094ac2 in start_thread nptl/./nptl/pthread_create.c:442:8
Change History (2)
comment:1 by , 13 months ago
| Description: | modified (diff) |
|---|
comment:2 by , 13 months ago
| Resolution: | → invalid |
|---|---|
| Status: | new → closed |
Note:
See TracTickets
for help on using tickets.
