Opened 8 years ago
Closed 8 years ago
#5059 closed defect (fixed)
ffserver crash at init_muxer
| Reported by: | tdk | Owned by: | |
|---|---|---|---|
| Priority: | important | Component: | avformat |
| Version: | git-master | Keywords: | crash regression |
| Cc: | Blocked By: | ||
| Blocking: | Reproduced by developer: | no | |
| Analyzed by developer: | no |
Description
Summary of the bug:
freshly compiled ffmpeg from git version git-2015-12-04-5d2cc00 on a 64 bit centos 6.7 crashes at init_muxer.
How to reproduce:
[tdk@webserver ~]$ ffserver -f ffmpeg_sources/ffmpeg/doc/ffserver.conf ffserver version git-2015-12-04-5d2cc00 Copyright (c) 2000-2015 the FFmpeg developers built with gcc 4.4.7 (GCC) 20120313 (Red Hat 4.4.7-16) configuration: --prefix=/home/tdk/ffmpeg_build --extra-cflags=-I/home/tdk/ffmpeg_build/include --extra-ldflags=-L/home/tdk/ffmpeg_build/lib --bindir=/home/tdk/bin --pkg-config-flags=--static --enable-gpl --enable-nonfree --enable-libfdk-aac --enable-libfreetype --enable-libmp3lame --enable-libvorbis --enable-libx264 --disable-optimizations --enable-static --disable-shared --disable-mmx --disable-stripping --enable-debug=3 --extra-cflags='-O0 -fno-inline' libavutil 55. 9.100 / 55. 9.100 libavcodec 57. 16.101 / 57. 16.101 libavformat 57. 19.100 / 57. 19.100 libavdevice 57. 0.100 / 57. 0.100 libavfilter 6. 20.100 / 6. 20.100 libswscale 4. 0.100 / 4. 0.100 libswresample 2. 0.101 / 2. 0.101 libpostproc 54. 0.100 / 54. 0.100 ffmpeg_sources/ffmpeg/doc/ffserver.conf:164: Setting default value for video bit rate tolerance = 21333. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:164: Setting default value for video rate control equation = tex^qComp. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:164: Setting default value for video max rate = 128000. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for audio sample rate = 22050. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for audio channel count = 1. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for video bit rate tolerance = 64000. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for video rate control equation = tex^qComp. Use NoDefaults to disable it. ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for video max rate = 512000. Use NoDefaults to disable it. Fri Dec 4 18:13:56 2015 Deleting feed file '/tmp/feed1.ffm' as it appears to be corrupt Segmentation fault
[tdk@webserver ~]$ gdb ffserver
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/tdk/bin/ffserver...done.
(gdb) r -f ffmpeg_sources/ffmpeg/doc/ffserver.conf
Starting program: /home/tdk/bin/ffserver -f ffmpeg_sources/ffmpeg/doc/ffserver.conf
[Thread debugging using libthread_db enabled]
ffserver version git-2015-12-04-5d2cc00 Copyright (c) 2000-2015 the FFmpeg developers
built with gcc 4.4.7 (GCC) 20120313 (Red Hat 4.4.7-16)
configuration: --prefix=/home/tdk/ffmpeg_build --extra-cflags=-I/home/tdk/ffmpeg_build/include --extra-ldflags=-L/home/tdk/ffmpeg_build/lib --bindir=/home/tdk/bin --pkg-config-flags=--static --enable-gpl --enable-nonfree --enable-libfdk-aac --enable-libfreetype --enable-libmp3lame --enable-libvorbis --enable-libx264 --disable-optimizations --enable-static --disable-shared --disable-mmx --disable-stripping --enable-debug=3 --extra-cflags='-O0 -fno-inline'
libavutil 55. 9.100 / 55. 9.100
libavcodec 57. 16.101 / 57. 16.101
libavformat 57. 19.100 / 57. 19.100
libavdevice 57. 0.100 / 57. 0.100
libavfilter 6. 20.100 / 6. 20.100
libswscale 4. 0.100 / 4. 0.100
libswresample 2. 0.101 / 2. 0.101
libpostproc 54. 0.100 / 54. 0.100
ffmpeg_sources/ffmpeg/doc/ffserver.conf:164: Setting default value for video bit rate tolerance = 21333. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:164: Setting default value for video rate control equation = tex^qComp. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:164: Setting default value for video max rate = 128000. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for audio sample rate = 22050. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for audio channel count = 1. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for video bit rate tolerance = 64000. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for video rate control equation = tex^qComp. Use NoDefaults to disable it.
ffmpeg_sources/ffmpeg/doc/ffserver.conf:219: Setting default value for video max rate = 512000. Use NoDefaults to disable it.
Fri Dec 4 18:18:09 2015 Deleting feed file '/tmp/feed1.ffm' as it appears to be corrupt
Program received signal SIGSEGV, Segmentation fault.
0x00000000004fc66b in init_muxer (s=0x2117d10, options=0x0) at libavformat/mux.c:341
341 st->internal->reorder = 1;
(gdb) bt
#0 0x00000000004fc66b in init_muxer (s=0x2117d10, options=0x0) at libavformat/mux.c:341
#1 0x00000000004fcb96 in avformat_write_header (s=0x2117d10, options=0x0) at libavformat/mux.c:456
#2 0x000000000041a6d1 in build_feed_streams () at ffserver.c:3751
#3 0x000000000041ac43 in main (argc=3, argv=0x7fffffffe718) at ffserver.c:3897
(gdb) disass $pc-32,$pc+32
Dump of assembler code from 0x4fc64b to 0x4fc68b:
0x00000000004fc64b <init_muxer+1264>: cmpq $0x0,-0x20(%rbp)
0x00000000004fc650 <init_muxer+1269>: je 0x4fc671 <init_muxer+1302>
0x00000000004fc652 <init_muxer+1271>: mov -0x20(%rbp),%rax
0x00000000004fc656 <init_muxer+1275>: mov 0x18(%rax),%eax
0x00000000004fc659 <init_muxer+1278>: and $0x8,%eax
0x00000000004fc65c <init_muxer+1281>: test %eax,%eax
0x00000000004fc65e <init_muxer+1283>: je 0x4fc671 <init_muxer+1302>
0x00000000004fc660 <init_muxer+1285>: mov -0x38(%rbp),%rax
0x00000000004fc664 <init_muxer+1289>: mov 0x308(%rax),%rax
=> 0x00000000004fc66b <init_muxer+1296>: movl $0x1,(%rax)
0x00000000004fc671 <init_muxer+1302>: mov -0x28(%rbp),%rax
0x00000000004fc675 <init_muxer+1306>: mov 0x30(%rax),%rax
0x00000000004fc679 <init_muxer+1310>: test %rax,%rax
0x00000000004fc67c <init_muxer+1313>: je 0x4fc7e6 <init_muxer+1675>
0x00000000004fc682 <init_muxer+1319>: mov -0x30(%rbp),%rax
0x00000000004fc686 <init_muxer+1323>: mov 0x3c(%rax),%eax
0x00000000004fc689 <init_muxer+1326>: test %eax,%eax
End of assembler dump.
(gdb) info all-registers
rax 0x0 0
rbx 0x1 1
rcx 0x0 0
rdx 0x0 0
rsi 0x100000000 4294967296
rdi 0x1 1
rbp 0x7fffffffe470 0x7fffffffe470
rsp 0x7fffffffe3b0 0x7fffffffe3b0
r8 0x2105610 34625040
r9 0x445e1e 4480542
r10 0x0 0
r11 0x7ffff7009e39 140737337400889
r12 0x404c00 4213760
r13 0x7fffffffe710 140737488348944
r14 0x0 0
r15 0x0 0
rip 0x4fc66b 0x4fc66b <init_muxer+1296>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
st0 -nan(0x000000010) (raw 0xffff0000000000000010)
st1 -nan(0x000000030) (raw 0xffff0000000000000030)
st2 -nan(0x1e000000000000) (raw 0xffff001e000000000000)
st3 -nan(0x00000001e) (raw 0xffff000000000000001e)
st4 0 (raw 0x00000000000000000000)
st5 0 (raw 0x00000000000000000000)
st6 0 (raw 0x00000000000000000000)
st7 -inf (raw 0xffff0000000000000000)
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
xmm0 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0 <repeats 16 times>}, v8_int16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0}, v4_int32 = {0x0, 0x0, 0x0, 0x0}, v2_int64 = {0x0, 0x0}, uint128 = 0x00000000000000000000000000000000}
xmm1 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1,
0x0, 0x0}, v8_int16 = {0x0, 0x0, 0x101, 0x101, 0x101, 0x101, 0x101, 0x0}, v4_int32 = {0x0, 0x1010101, 0x1010101, 0x101}, v2_int64 = {0x101010100000000,
0x10101010101}, uint128 = 0x00000101010101010101010100000000}
xmm2 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x8000000000000000, 0x0}, v16_int8 = {0x2f, 0x74, 0x6d, 0x70, 0x2f, 0x66, 0x65, 0x65, 0x64,
0x31, 0x2e, 0x66, 0x66, 0x6d, 0x0, 0x0}, v8_int16 = {0x742f, 0x706d, 0x662f, 0x6565, 0x3164, 0x662e, 0x6d66, 0x0}, v4_int32 = {0x706d742f, 0x6565662f,
0x662e3164, 0x6d66}, v2_int64 = {0x6565662f706d742f, 0x6d66662e3164}, uint128 = 0x00006d66662e31646565662f706d742f}
xmm3 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x8000000000000000, 0x0}, v16_int8 = {0x0, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff, 0xff, 0x0, 0x0,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int16 = {0x0, 0x0, 0xffff, 0xffff, 0x0, 0x0, 0x0, 0x0}, v4_int32 = {0x0, 0xffffffff, 0x0, 0x0}, v2_int64 = {
0xffffffff00000000, 0x0}, uint128 = 0x0000000000000000ffffffff00000000}
xmm4 {v4_float = {0x3, 0x3, 0x3, 0x3}, v2_double = {0x20, 0x20}, v16_int8 = {0x40 <repeats 16 times>}, v8_int16 = {0x4040, 0x4040, 0x4040,
0x4040, 0x4040, 0x4040, 0x4040, 0x4040}, v4_int32 = {0x40404040, 0x40404040, 0x40404040, 0x40404040}, v2_int64 = {0x4040404040404040,
0x4040404040404040}, uint128 = 0x40404040404040404040404040404040}
xmm5 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x8000000000000000, 0x8000000000000000}, v16_int8 = {0x5b <repeats 16 times>}, v8_int16 = {
0x5b5b, 0x5b5b, 0x5b5b, 0x5b5b, 0x5b5b, 0x5b5b, 0x5b5b, 0x5b5b}, v4_int32 = {0x5b5b5b5b, 0x5b5b5b5b, 0x5b5b5b5b, 0x5b5b5b5b}, v2_int64 = {
0x5b5b5b5b5b5b5b5b, 0x5b5b5b5b5b5b5b5b}, uint128 = 0x5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b}
xmm6 {v4_float = {0x0, 0x0, 0x0, 0x0}, v2_double = {0x0, 0x0}, v16_int8 = {0x20 <repeats 16 times>}, v8_int16 = {0x2020, 0x2020, 0x2020, 0x2020,
0x2020, 0x2020, 0x2020, 0x2020}, v4_int32 = {0x20202020, 0x20202020, 0x20202020, 0x20202020}, v2_int64 = {0x2020202020202020, 0x2020202020202020},
---Type <return> to continue, or q <return> to quit---
Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker.
Change History (4)
comment:1 by , 8 years ago
comment:2 by , 8 years ago
| Keywords: | crash regression added |
|---|---|
| Priority: | normal → important |
comment:3 by , 8 years ago
Thanks for reporting. We are aware of this regression and
are already working on fixing it.
comment:4 by , 8 years ago
| Resolution: | → fixed |
|---|---|
| Status: | new → closed |
This bug should had been fixed by:
ffserver: allocate AVStream's internal too
Avoids segfault at init_muxer() (mux.c) due to a
null pointer dereference on the recently
introduced AVStream->internal
Signed-off-by: Reynaldo H. Verdejo Pinochet <reynaldo@osg.samsung.com>
Note:
See TracTickets
for help on using tickets.
just confirmed the same building with 2.8.3 tarball works, that means, no crash ;)