ASF/WMV partial packet change causes infinite loop

[tracey jaquith]

hi all,

I'm new to posting bugs with FFmpeg, but have been using ffmpeg heavily for years, even customizing and patching it. At some point, I'd like to try to work with folks to see about adding some patches.

OK, back to the "bug" -- granted this is a likely *heavily* poorly (and cutoff) video, but it's representative at times of the random stuff we get in our 500,000+ videos are Internet Archive / archive.org 8-)

The patch here:

​http://git.videolan.org/?p=ffmpeg.git;a=blobdiff;f=libavformat/asfdec.c;h=36876fa1fd053a27a7218908dc2881ebbd298bd6;hp=843b10951127246ddbee59c811ee46311e682f01;hb=bf09a0198121467b5a79ba03363b0d1e4dbc3e58;hpb=d09b5a869fea0de5c2f43c547f8ccba8f4740293

causes ffmpeg to spin and write (seemingly) without end -- I have to kill it.

A one-line "revert" for part of that patch will make it stop spinning and just kind of cut off the audio like it used to,
but it'd be nice if the original diff provider / moderator to the longer change (above) could take a look and see what
they think might be best:

if (ret != asf->packet_frag_size) {

av_log(s, AV_LOG_ERROR, "xxxx scrambled\n"); return ret >= 0 ? AVERROR_EOF : ret;

(that is, inserting that one line "fixes my problem" but likely the greater patch had other intentions to it).

Example: run
ffmpeg -i holymatrimony.wmv -vn audio.wav

[tracey jaquith]

truncated .wmv that gives ffmpeg grief

[Carl Eugen Hoyos]

I get no useful backtrace with -vn

(gdb) r -i holymatrimony.wmv -f null -
Starting program: ffmpeg_g -i holymatrimony.wmv -f null -
ffmpeg version git-N-29734-g38bb5a5, Copyright (c) 2000-2011 the FFmpeg developers
  built on May 10 2011 00:36:05 with gcc 4.5.2
  configuration: --cc='/usr/local/gcc-4.5.2/bin/gcc -m32' --enable-gpl
  libavutil    51.  2. 1 / 51.  2. 1
  libavcodec   53.  5. 0 / 53.  5. 0
  libavformat  53.  0. 3 / 53.  0. 3
  libavdevice  53.  0. 0 / 53.  0. 0
  libavfilter   2.  5. 0 /  2.  5. 0
  libswscale    0. 14. 0 /  0. 14. 0

Seems stream 1 codec frame rate differs from container frame rate: 1000.00 (1000/1) -> 23.00 (23/1)
Input #0, asf, from 'holymatrimony.wmv':
  Metadata:
    title           : Holy Matrimony Billy!
    artist          : Mark Kenneth Woods
    copyright       : Mark Kenneth Woods, 2004.
    comment         :
  Duration: 00:04:25.61, start: 0.000000, bitrate: 40 kb/s
    Stream #0.0: Audio: wmav2, 48000 Hz, 2 channels, s16, 128 kb/s
    Stream #0.1: Video: wmv1, yuv420p, 240x176, 23 tbr, 1k tbn, 1k tbc
[buffer @ 0x8c9b700] w:240 h:176 pixfmt:yuv420p tb:1/1000000 sar:0/1
Output #0, null, to 'pipe:':
  Metadata:
    title           : Holy Matrimony Billy!
    artist          : Mark Kenneth Woods
    copyright       : Mark Kenneth Woods, 2004.
    comment         :
    encoder         : Lavf53.0.3
    Stream #0.0: Video: rawvideo, yuv420p, 240x176, q=2-31, 200 kb/s, 90k tbn, 23 tbc
    Stream #0.1: Audio: pcm_s16le, 48000 Hz, 2 channels, s16, 1536 kb/s
Stream mapping:
  Stream #0.1 -> #0.0
  Stream #0.0 -> #0.1
Press [q] to stop encoding

Program received signal SIGSEGV, Segmentation fault.
0x081553ac in ff_interleave_add_packet (pkt=0xffffbefc, s=0x8c9a420, compare=<value optimized out>) at libavformat/utils.c:3016
3016        this_pktl->pkt= *pkt;
(gdb) bt
#0  0x081553ac in ff_interleave_add_packet (pkt=0xffffbefc, s=0x8c9a420, compare=<value optimized out>) at libavformat/utils.c:3016
#1  av_interleave_packet_per_dts (pkt=0xffffbefc, s=0x8c9a420, compare=<value optimized out>) at libavformat/utils.c:3064
#2  0x08155623 in av_interleave_packet (flush=0, in=0xffffbefc, out=0xffffba9c, s=<value optimized out>) at libavformat/utils.c:3101
#3  av_interleaved_write_frame (flush=0, in=0xffffbefc, out=0xffffba9c, s=<value optimized out>) at libavformat/utils.c:3122
#4  0x0804cb58 in write_frame (s=0x8c9a420, pkt=0xffffbefc, avctx=0x8c9b020, bsfc=0x0) at ffmpeg.c:782
#5  0x0804f71c in do_audio_out (size=192000,
    buf=0xf7c99020 "\230\353\230\353\332\351\332\351=\351=\351\067\351\067\351|\351|\351\320\351\320\351\273\351\273\351]\353]\353\354\355\354\355\317\357\317\357;\362;\362\315\363\315\363\255\363\255\363\001\364\001\364\323\364\323\364\r\367\r\367\236\371\236\371U\373U\373\225\376\225\376\031\002\031\002\371\004\371\004\230\006\230\006N\tN\t\255\f\255\f\213\016\213\016", ist=0x8c9b600, ost=0x8c9b440, s=0x8c9a420) at ffmpeg.c:1031
#6  output_packet (size=192000,
    buf=0xf7c99020 "\230\353\230\353\332\351\332\351=\351=\351\067\351\067\351|\351|\351\320\351\320\351\273\351\273\351]\353]\353\354\355\354\355\317\357\317\357;\362;\362\315\363\315\363\255\363\255\363\001\364\001\364\323\364\323\364\r\367\r\367\236\371\236\371U\373U\373\225\376\225\376\031\002\031\002\371\004\371\004\230\006\230\006N\tN\t\255\f\255\f\213\016\213\016", ist=0x8c9b600, ost=0x8c9b440, s=0x8c9a420) at ffmpeg.c:1707
#7  0x08052878 in transcode (nb_output_files=1, nb_input_files=1, stream_maps=0x0, nb_stream_maps=0, input_files=0x872a600, output_files=0x872a460) at ffmpeg.c:2706
#8  0x080586f3 in main (argc=<value optimized out>, argv=<value optimized out>) at ffmpeg.c:4506
(gdb) disass $pc-21 $pc+32
Dump of assembler code from 0x8155397 to 0x81553cc:
0x08155397 <ff_interleave_add_packet+0>:        movl   $0x48,(%esp)
0x0815539e <ff_interleave_add_packet+7>:        mov    %ebx,%esi
0x081553a0 <ff_interleave_add_packet+9>:        call   0x85d57c0 <av_mallocz>
0x081553a5 <ff_interleave_add_packet+14>:       mov    $0x11,%ecx
0x081553aa <ff_interleave_add_packet+19>:       mov    %eax,%edi
0x081553ac <ff_interleave_add_packet+21>:       rep movsl %ds:(%esi),%es:(%edi)
0x081553ae <ff_interleave_add_packet+23>:       movl   $0x0,0x2c(%ebx)
0x081553b5 <ff_interleave_add_packet+30>:       mov    %eax,0x18(%esp)
0x081553b9 <ff_interleave_add_packet+34>:       mov    %eax,(%esp)
0x081553bc <ff_interleave_add_packet+37>:       call   0x817e8c0 <av_dup_packet>
0x081553c1 <ff_interleave_add_packet+42>:       mov    0x18(%ebx),%edx
0x081553c4 <ff_interleave_add_packet+45>:       mov    0x18(%ebp),%eax
0x081553c7 <ff_interleave_add_packet+48>:       mov    (%eax,%edx,4),%eax
0x081553ca <ff_interleave_add_packet+51>:       mov    %eax,0x1c(%esp)
End of assembler dump.
(gdb) info registers
eax            0x0      0
ecx            0x11     17
edx            0x0      0
ebx            0xffffbefc       -16644
esp            0xffffba30       0xffffba30
ebp            0x8c9a420        0x8c9a420
esi            0xffffbefc       -16644
edi            0x0      0
eip            0x81553ac        0x81553ac <ff_interleave_add_packet+21>
eflags         0x210282 [ SF IF RF ID ]
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x0      0
gs             0x63     99

[Michael Niedermayer]

Fixed in git-N-30122-geb97d4d