FFmpeg crashing with Yadif and ac3

[ramitb]

Summary of the bug: This is a regression bug, with the git head it crashes, with an older build it doesn't. Happens with some videos only with ac3 and yadif are used. The crash happens right at the end of this video.
This happens irrespective of the video codec (tried x264 and mpeg2video).
The video sample is uploaded here (it's 100MB and whole file is required because the crash happens at the end)

​http://files.mcebuddy2x.com/UPLOAD/Broken.ts

How to reproduce:
Crashing

ffmpegNew.exe -i Broken.ts -vcodec mpeg2video -acodec ac3 -ab 384K -vf yadif=0:-1:1 test1.ts
ffmpeg version N-72144-gca688de Copyright (c) 2000-2015 the FFmpeg developers
  built with gcc 4.9.2 (GCC)
  configuration: --arch=x86 --target-os=mingw32 --cross-prefix=/home/mcebuddy/Software/sandbox/mingw-w64-i686/bin/i686-w
64-mingw32- --pkg-config=pkg-config --enable-gpl --enable-libsoxr --enable-fontconfig --enable-libass --enable-libutvide
o --enable-libbluray --enable-iconv --enable-libtwolame --extra-cflags=-DLIBTWOLAME_STATIC --enable-libzvbi --enable-lib
caca --enable-libmodplug --extra-libs=-lstdc++ --extra-libs=-lpng --enable-libvidstab --enable-libx265 --enable-decklink
 --extra-libs=-loleaut32 --enable-libx264 --enable-libxvid --enable-libmp3lame --enable-version3 --enable-zlib --enable-
librtmp --enable-libvorbis --enable-libtheora --enable-libspeex --enable-libopenjpeg --enable-gnutls --enable-libgsm --e
nable-libfreetype --enable-libopus --disable-w32threads --enable-frei0r --enable-filter=frei0r --enable-libvo-aacenc --e
nable-bzlib --enable-libxavs --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libvo-amrwbenc --enable-libs
chroedinger --enable-libvpx --enable-libilbc --enable-libwavpack --enable-libwebp --enable-libgme --enable-dxva2 --enabl
e-libdcadec --enable-avisynth --enable-libmfx --enable-static --disable-shared --extra-cflags= --prefix=/home/mcebuddy/S
oftware/sandbox/mingw-w64-i686/i686-w64-mingw32 --extra-libs=-lpsapi --enable-nonfree --enable-libfdk-aac --enable-libfa
ac --disable-decoder=aac --enable-nvenc --enable-runtime-cpudetect
  libavutil      54. 23.101 / 54. 23.101
  libavcodec     56. 39.100 / 56. 39.100
  libavformat    56. 33.101 / 56. 33.101
  libavdevice    56.  4.100 / 56.  4.100
  libavfilter     5. 16.101 /  5. 16.101
  libswscale      3.  1.101 /  3.  1.101
  libswresample   1.  1.100 /  1.  1.100
  libpostproc    53.  3.100 / 53.  3.100
Input #0, mpegts, from 'Broken.ts':
  Duration: 00:00:52.00, start: 1.417333, bitrate: 15476 kb/s
  Program 1
    Metadata:
      service_name    : KXASDT (KXAS-DT)
      service_provider: KXASDT
    Stream #0:0[0x100](eng): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, 5.1(side), fltp, 384 kb/s
    Stream #0:1[0x101](spa): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, stereo, fltp, 192 kb/s
    Stream #0:2[0x102]: Video: mpeg2video (Main) ([2][0][0][0] / 0x0002), yuv420p(tv), 1920x1080 [SAR 1:1 DAR 16:9], max
. 24000 kb/s, 29.97 fps, 29.97 tbr, 90k tbn, 59.94 tbc
Output #0, mpegts, to 'test1.ts':
  Metadata:
    encoder         : Lavf56.33.101
    Stream #0:0: Video: mpeg2video, yuv420p, 1920x1080 [SAR 1:1 DAR 16:9], q=2-31, 200 kb/s, 29.97 fps, 90k tbn, 29.97 t
bc
    Metadata:
      encoder         : Lavc56.39.100 mpeg2video
    Stream #0:1(eng): Audio: ac3, 48000 Hz, 5.1(side), fltp, 384 kb/s
    Metadata:
      encoder         : Lavc56.39.100 ac3
Stream mapping:
  Stream #0:2 -> #0:0 (mpeg2video (native) -> mpeg2video (native))
  Stream #0:0 -> #0:1 (ac3 (native) -> ac3 (native))
Press [q] to stop, [?] for help
[mpeg2video @ 056d20a0] ac-tex damaged at 73 26=00:00:51.03 bitrate=2796.4kbits/s dup=24 drop=0
[mpeg2video @ 056d20a0] Warning MVs not available
[mpeg2video @ 056d20a0] concealing 5040 DC, 5040 AC, 5040 MV errors in B frame
[mpeg2video @ 03b1c4e0] AVFrame.format is not set
[mpeg2video @ 03b1c4e0] AVFrame.width or height is not set

Working:

ffmpeg.exe -i Broken.ts -vcodec mpeg2video -acodec ac3 -ab 384K -vf yadif=0:-1:1 test1.ts
ffmpeg version N-70269-gaa7a2fa Copyright (c) 2000-2015 the FFmpeg developers
  built with gcc 4.9.2 (GCC)
  configuration: --arch=x86 --target-os=mingw32 --cross-prefix=/home/mcebuddy/Software/sandbox/mingw-w64-i686/bin/i686-w
64-mingw32- --pkg-config=pkg-config --enable-hwaccels --enable-dxva2 --enable-gpl --enable-libx264 --enable-avisynth --e
nable-libxvid --enable-libmp3lame --enable-version3 --enable-zlib --enable-librtmp --enable-libvorbis --enable-libtheora
 --enable-libspeex --enable-libopenjpeg --enable-gnutls --enable-libgsm --enable-libfreetype --enable-libopus --disable-
w32threads --enable-frei0r --enable-filter=frei0r --enable-libvo-aacenc --enable-bzlib --enable-libxavs --extra-cflags=-
DPTW32_STATIC_LIB --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libvo-amrwbenc --enable-libschroedinger
 --enable-libvpx --enable-libilbc --prefix=/home/mcebuddy/Software/sandbox/mingw-w64-i686/i686-w64-mingw32 --enable-stat
ic --disable-shared --enable-libsoxr --enable-fontconfig --enable-libass --enable-libutvideo --enable-libbluray --enable
-iconv --enable-libtwolame --extra-cflags=-DLIBTWOLAME_STATIC --enable-libzvbi --enable-libcaca --enable-libmodplug --ex
tra-libs=-lstdc++ --extra-libs=-lpng --enable-libvidstab --enable-libx265 --enable-decklink --extra-libs=-loleaut32 --ex
tra-cflags= --extra-cflags= --enable-nonfree --enable-libfdk-aac --enable-libfaac --enable-runtime-cpudetect
  libavutil      54. 19.100 / 54. 19.100
  libavcodec     56. 26.100 / 56. 26.100
  libavformat    56. 23.105 / 56. 23.105
  libavdevice    56.  4.100 / 56.  4.100
  libavfilter     5. 11.102 /  5. 11.102
  libswscale      3.  1.101 /  3.  1.101
  libswresample   1.  1.100 /  1.  1.100
  libpostproc    53.  3.100 / 53.  3.100
Input #0, mpegts, from 'Broken.ts':
  Duration: 00:00:52.00, start: 1.417333, bitrate: 15476 kb/s
  Program 1
    Metadata:
      service_name    : KXASDT (KXAS-DT)
      service_provider: KXASDT
    Stream #0:0[0x100](eng): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, 5.1(side), fltp, 384 kb/s
    Stream #0:1[0x101](spa): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, stereo, fltp, 192 kb/s
    Stream #0:2[0x102]: Video: mpeg2video (Main) ([2][0][0][0] / 0x0002), yuv420p(tv), 1920x1080 [SAR 1:1 DAR 16:9], max
. 24000 kb/s, 29.97 fps, 29.97 tbr, 90k tbn, 59.94 tbc
Output #0, mpegts, to 'test1.ts':
  Metadata:
    encoder         : Lavf56.23.105
    Stream #0:0: Video: mpeg2video, yuv420p, 1920x1080 [SAR 1:1 DAR 16:9], q=2-31, 200 kb/s, 29.97 fps, 90k tbn, 29.97 t
bc
    Metadata:
      encoder         : Lavc56.26.100 mpeg2video
    Stream #0:1(eng): Audio: ac3, 48000 Hz, 5.1(side), fltp, 384 kb/s
    Metadata:
      encoder         : Lavc56.26.100 ac3
Stream mapping:
  Stream #0:2 -> #0:0 (mpeg2video (native) -> mpeg2video (native))
  Stream #0:0 -> #0:1 (ac3 (native) -> ac3 (native))
Press [q] to stop, [?] for help
[mpeg2video @ 050dc5a0] ac-tex damaged at 73 26=00:00:50.61 bitrate=2792.3kbits/s dup=24 drop=0
[mpeg2video @ 050dc5a0] Warning MVs not available
[mpeg2video @ 050dc5a0] concealing 5040 DC, 5040 AC, 5040 MV errors in B frame
frame= 1558 fps= 94 q=31.0 Lsize=   17755kB time=00:00:51.95 bitrate=2799.7kbits/s dup=25 drop=0
video:13664kB audio:2420kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: 10.388759%

[Carl Eugen Hoyos]

Please remember not to use --enable-nonfree when building FFmpeg: You are not allowed to distribute the resulting binaries!

Regression since 98c7729c

$ valgrind ffmpeg_g -i Broken.ts -acodec ac3 -ab 384K -vf yadif=0:-1:1 out.ts
==10703== Memcheck, a memory error detector
==10703== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==10703== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==10703== Command: ffmpeg_g -i Broken.ts -acodec ac3 -ab 384K -vf yadif=0:-1:1 out.ts
==10703==
ffmpeg version N-72164-g3a91a07 Copyright (c) 2000-2015 the FFmpeg developers
  built with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl
  libavutil      54. 23.101 / 54. 23.101
  libavcodec     56. 39.100 / 56. 39.100
  libavformat    56. 33.101 / 56. 33.101
  libavdevice    56.  4.100 / 56.  4.100
  libavfilter     5. 16.101 /  5. 16.101
  libswscale      3.  1.101 /  3.  1.101
  libswresample   1.  1.100 /  1.  1.100
  libpostproc    53.  3.100 / 53.  3.100
Input #0, mpegts, from 'Broken.ts':
  Duration: 00:00:52.00, start: 1.417333, bitrate: 15476 kb/s
  Program 1
    Metadata:
      service_name    : KXASDT (KXAS-DT)
      service_provider: KXASDT
    Stream #0:0[0x100](eng): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, 5.1(side), fltp, 384 kb/s
    Stream #0:1[0x101](spa): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, stereo, fltp, 192 kb/s
    Stream #0:2[0x102]: Video: mpeg2video (Main) ([2][0][0][0] / 0x0002), yuv420p(tv), 1920x1080 [SAR 1:1 DAR 16:9], max. 24000 kb/s, 29.97 fps, 29.97 tbr, 90k tbn, 59.94 tbc
Output #0, mpegts, to 'out.ts':
  Metadata:
    encoder         : Lavf56.33.101
    Stream #0:0: Video: mpeg2video, yuv420p, 1920x1080 [SAR 1:1 DAR 16:9], q=2-31, 200 kb/s, 29.97 fps, 90k tbn, 29.97 tbc
    Metadata:
      encoder         : Lavc56.39.100 mpeg2video
    Stream #0:1(eng): Audio: ac3, 48000 Hz, 5.1(side), fltp, 384 kb/s
    Metadata:
      encoder         : Lavc56.39.100 ac3
Stream mapping:
  Stream #0:2 -> #0:0 (mpeg2video (native) -> mpeg2video (native))
  Stream #0:0 -> #0:1 (ac3 (native) -> ac3 (native))
Press [q] to stop, [?] for help
[mpeg2video @ 0xbb0f820] ac-tex damaged at 73 2600:00:51.75 bitrate=2801.2kbits/s dup=24 drop=0
[mpeg2video @ 0xbb0f820] Warning MVs not available
[mpeg2video @ 0xbb0f820] concealing 5040 DC, 5040 AC, 5040 MV errors in B frame
[mpeg2video @ 0xbf0f180] AVFrame.format is not set:00:51.85 bitrate=2795.8kbits/s dup=24 drop=0
[mpeg2video @ 0xbf0f180] AVFrame.width or height is not set
==10703== Invalid read of size 8
==10703==    at 0x4C2C558: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==10703==    by 0x9CE753: ff_mpv_encode_picture (mpegvideo_enc.c:1187)
==10703==    by 0xAF78C6: avcodec_encode_video2 (utils.c:2131)
==10703==    by 0x488378: do_video_out (ffmpeg.c:1124)
==10703==    by 0x489E1A: reap_filters (ffmpeg.c:1311)
==10703==    by 0x48EF0C: transcode (ffmpeg.c:3772)
==10703==    by 0x47277A: main (ffmpeg.c:4070)
==10703==  Address 0x778 is not stack'd, malloc'd or (recently) free'd
==10703==
==10703==
==10703== Process terminating with default action of signal 11 (SIGSEGV)
==10703==  Access not within mapped region at address 0x778
==10703==    at 0x4C2C558: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==10703==    by 0x9CE753: ff_mpv_encode_picture (mpegvideo_enc.c:1187)
==10703==    by 0xAF78C6: avcodec_encode_video2 (utils.c:2131)
==10703==    by 0x488378: do_video_out (ffmpeg.c:1124)
==10703==    by 0x489E1A: reap_filters (ffmpeg.c:1311)
==10703==    by 0x48EF0C: transcode (ffmpeg.c:3772)
==10703==    by 0x47277A: main (ffmpeg.c:4070)
==10703==  If you believe this happened as a result of a stack
==10703==  overflow in your program's main thread (unlikely but
==10703==  possible), you can try to increase the size of the
==10703==  main thread stack using the --main-stacksize= flag.
==10703==  The main thread stack size used in this run was 8388608.
==10703==
==10703== HEAP SUMMARY:
==10703==     in use at exit: 77,103,462 bytes in 1,124 blocks
==10703==   total heap usage: 438,452 allocs, 437,328 frees, 5,401,659,862 bytes allocated
==10703==
==10703== LEAK SUMMARY:
==10703==    definitely lost: 0 bytes in 0 blocks
==10703==    indirectly lost: 0 bytes in 0 blocks
==10703==      possibly lost: 10,944 bytes in 36 blocks
==10703==    still reachable: 77,092,518 bytes in 1,088 blocks
==10703==         suppressed: 0 bytes in 0 blocks
==10703== Rerun with --leak-check=full to see details of leaked memory
==10703==
==10703== For counts of detected and suppressed errors, rerun with: -v
==10703== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 2 from 2)
Killed

[Michael Niedermayer]

Fixed in b87dd7f82d4df6c6207cab8e40e28e5b3fe81d0f and the previous commit