Opened 6 years ago

Closed 6 years ago

Last modified 6 years ago

#1740 closed defect (fixed)

avformat's av_write_trailer have bug.

Reported by: kyh96403 Owned by:
Priority: important Component: avformat
Version: git-master Keywords:
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
Lastest git version..
avformat/utils.c -> av_write_trailer have bug.
s->pb can be NULL.

    if (!(s->oformat->flags & AVFMT_NOFILE))
        avio_flush(s->pb);

So needed check s->pb is NULL or not.

    if (!(s->oformat->flags & AVFMT_NOFILE) && s->pb)
        avio_flush(s->pb);

Or need check in avio_flush function.

void avio_flush(AVIOContext *s)
{
    if (!s)
        return 0;

    flush_buffer(s);
    s->must_flush = 0;
}

Change History (3)

comment:1 Changed 6 years ago by cehoyos

  • Keywords av_write_trailer error removed

If you are observing a crash with FFmpeg, please provide at least command line, complete, uncut console output and a sample.

If you want to provide a patch for FFmpeg, either attach it here, or send it to ffmpeg-devel (patches get much more attention on ffmpeg-devel, so this is preferred).

comment:2 Changed 6 years ago by reimar

  • Resolution set to fixed
  • Status changed from new to closed

I mentioned this issue on -cvslog already yesterday. However I don't know how to trigger it, so could you describe how to reproduce it?
Either way it should be fixed now, commit 07d2d063954251bdefe34d7d1f8de751eec606be

comment:3 Changed 6 years ago by kyh96403

Crash when using ffserver's RTSP UDP connection.
When close RTSP UDP connection, each RTP also close.
That code is below..

    for(i=0;i<nb_streams;i++) {
        ctx = c->rtp_ctx[i];
        if (ctx) {
            av_write_trailer(ctx);
            av_dict_free(&ctx->metadata);
            av_free(ctx->streams[0]);
            av_free(ctx);
        }
        h = c->rtp_handles[i];
        if (h)
            ffurl_close(h);
    }

You know, c->rtp_ctx[i]->pb using dyn_buf.
dyn_buf's pb is not safe when after using avio_close_dyn_buf.
So it is need set pb to NULL or avio_open_dyn_buf before call av_write_trailer.
Old version don't have problem.
Because av_write_trailer don't using ctx->pb.
Today that problem is fixed...
Thanks

Note: See TracTickets for help on using tickets.