Re: [FFmpeg-devel] [FFmpeg-cvslog] avformat/mpegts: add option max_packet_size

[Michael Niedermayer <michael@niedermayer.cc>]

[-- Attachment #1.1: Type: text/plain, Size: 9789 bytes --]

On Sun, Jan 16, 2022 at 05:19:15AM +0000, Gyan Doshi wrote:
> ffmpeg | branch: master | Gyan Doshi <ffmpeg@gyani.pro> | Wed Jan 12 20:57:59 2022 +0530| [bca30570d28bbaa07badadabf55ec3589201a82f] | committer: Gyan Doshi
> 
> avformat/mpegts: add option max_packet_size
> 
> Makes maximum size of emitted packet user-tunable.
> 
> Default is existing 204800 bytes.
> 
> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bca30570d28bbaa07badadabf55ec3589201a82f
> ---
> 
>  doc/demuxers.texi    |  4 ++++
>  libavformat/mpegts.c | 11 ++++++-----
>  2 files changed, 10 insertions(+), 5 deletions(-)

Since this commit there is occasional memory corruption occuring

  libavutil      57. 18.100 / 57. 18.100
  libavcodec     59. 20.100 / 59. 20.100
  libavformat    59. 17.101 / 59. 17.101
  libavdevice    59.  5.100 / 59.  5.100
  libavfilter     8. 25.100 /  8. 25.100
  libswscale      6.  5.100 /  6.  5.100
  libswresample   4.  4.100 /  4.  4.100
  libpostproc    56.  4.100 / 56.  4.100
invalid fastbin entry (free)
doom/rtp-video: line 14: 15621 Aborted                 (core dumped) ./ffmpeg_g -bitexact -protocol_whitelist http,tcp,rtp,udp -i http://127.0.0.1:8080/test.sdp -bitexact -acodec mp2 -ab 64k -y -t 1 -threads 1 $TMP/out.avi
Command exited with non-zero status 134

this was tricky to reproduce under a memory debugger as it dependat on timing
but heres a run that crashed under valgrind

the input was generated with this: (and some tuned delays)
./ffmpeg -bitexact  -i ~/videos/mm-short.mpg -y -s 320x240 -bitexact -t 10 -threads 1 $TMP/in.mpg
cvlc --play-and-exit -vvv $TMP/in.mpg --sout '#rtp{dst=127.0.0.1,port=5104,mux=ts,sdp=http://127.0.0.1:8076/test.sdp}'



==17945== Invalid write of size 2
==17945==    at 0x4C38753: memmove (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17945==    by 0x6A6650: mpegts_push_data (mpegts.c:1397)
==17945==    by 0x6AB60E: handle_packet (mpegts.c:2879)
==17945==    by 0x6AD048: avpriv_mpegts_parse_packet (mpegts.c:3407)
==17945==    by 0x7AFA06: mpegts_handle_packet (rtpdec_mpegts.c:77)
==17945==    by 0x7A7BFA: rtp_parse_packet_internal (rtpdec.c:762)
==17945==    by 0x7A8211: rtp_parse_one_packet (rtpdec.c:900)
==17945==    by 0x7A83A7: ff_rtp_parse_packet (rtpdec.c:945)
==17945==    by 0x71D4B5: ff_rtsp_fetch_packet (rtsp.c:2273)
==17945==    by 0x5DB6E8: ff_read_packet (demux.c:557)
==17945==    by 0x5DE6D8: read_frame_internal (demux.c:1231)
==17945==    by 0x5E3CB4: avformat_find_stream_info (demux.c:2584)
==17945==  Address 0x16a730c0 is 0 bytes after a block of size 64 alloc'd
==17945==    at 0x4C33E76: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17945==    by 0x4C33F91: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17945==    by 0x129949B: av_malloc (mem.c:104)
==17945==    by 0x127F3AE: av_buffer_alloc (buffer.c:82)
==17945==    by 0x127FDF6: pool_alloc_buffer (buffer.c:365)
==17945==    by 0x127FF77: av_buffer_pool_get (buffer.c:404)
==17945==    by 0x6A5955: buffer_pool_get (mpegts.c:1130)
==17945==    by 0x6A65F5: mpegts_push_data (mpegts.c:1392)
==17945==    by 0x6AB60E: handle_packet (mpegts.c:2879)
==17945==    by 0x6AD048: avpriv_mpegts_parse_packet (mpegts.c:3407)
==17945==    by 0x7AFA06: mpegts_handle_packet (rtpdec_mpegts.c:77)
==17945==    by 0x7A7BFA: rtp_parse_packet_internal (rtpdec.c:762)
==17945== 
--17945-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--17945-- si_code=128;  Faulting address: 0x0;  sp: 0x10032c1e20

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==17945==    at 0x58051665: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==17945==    by 0x58053E58: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==17945==    by 0x5800BA44: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==17945==    by 0x5800BD64: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==17945==    by 0x5809F55C: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==17945==    by 0x580AECD0: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 17945)
==17945==    at 0x4C33E76: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17945==    by 0x4C33F91: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17945==    by 0x129949B: av_malloc (mem.c:104)
==17945==    by 0x12998EE: av_mallocz (mem.c:265)
==17945==    by 0x6A671C: add_pes_stream (mpegts.c:1428)
==17945==    by 0x6AB01D: handle_packet (mpegts.c:2761)
==17945==    by 0x6AD048: avpriv_mpegts_parse_packet (mpegts.c:3407)
==17945==    by 0x7AFA06: mpegts_handle_packet (rtpdec_mpegts.c:77)
==17945==    by 0x7A7BFA: rtp_parse_packet_internal (rtpdec.c:762)
==17945==    by 0x7A8292: rtp_parse_one_packet (rtpdec.c:911)
==17945==    by 0x7A83A7: ff_rtp_parse_packet (rtpdec.c:945)
==17945==    by 0x71D4B5: ff_rtsp_fetch_packet (rtsp.c:2273)
==17945==    by 0x5DB6E8: ff_read_packet (demux.c:557)
==17945==    by 0x5DE6D8: read_frame_internal (demux.c:1231)
==17945==    by 0x5E3CB4: avformat_find_stream_info (demux.c:2584)
==17945==    by 0x232DB0: open_input_file (ffmpeg_opt.c:1200)
==17945==    by 0x241D56: open_files (ffmpeg_opt.c:3423)
==17945==    by 0x241F0A: ffmpeg_parse_options (ffmpeg_opt.c:3463)
==17945==    by 0x261331: main (ffmpeg.c:4870)

heres the same with origin/master
 libavutil      57. 19.100 / 57. 19.100
  libavcodec     59. 20.100 / 59. 20.100
  libavformat    59. 17.101 / 59. 17.101
  libavdevice    59.  5.100 / 59.  5.100
  libavfilter     8. 26.101 /  8. 26.101
  libswscale      6.  5.100 /  6.  5.100
  libswresample   4.  4.100 /  4.  4.100
  libpostproc    56.  4.100 / 56.  4.100
==11758== Invalid write of size 2
==11758==    at 0x4C38753: memmove (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11758==    by 0x6AB497: mpegts_push_data (mpegts.c:1397)
==11758==    by 0x6B0455: handle_packet (mpegts.c:2879)
==11758==    by 0x6B1E8F: avpriv_mpegts_parse_packet (mpegts.c:3407)
==11758==    by 0x7B4BE8: mpegts_handle_packet (rtpdec_mpegts.c:77)
==11758==    by 0x7ACD85: rtp_parse_packet_internal (rtpdec.c:762)
==11758==    by 0x7AD3AF: rtp_parse_one_packet (rtpdec.c:905)
==11758==    by 0x7AD545: ff_rtp_parse_packet (rtpdec.c:950)
==11758==    by 0x722419: ff_rtsp_fetch_packet (rtsp.c:2273)
==11758==    by 0x5DF675: ff_read_packet (demux.c:557)
==11758==    by 0x5E2665: read_frame_internal (demux.c:1231)
==11758==    by 0x5E7C41: avformat_find_stream_info (demux.c:2584)
==11758==  Address 0x16a72fc0 is 0 bytes after a block of size 64 alloc'd
==11758==    at 0x4C33E76: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11758==    by 0x4C33F91: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11758==    by 0x128E3AB: av_malloc (mem.c:104)
==11758==    by 0x12742BE: av_buffer_alloc (buffer.c:82)
==11758==    by 0x1274D06: pool_alloc_buffer (buffer.c:365)
==11758==    by 0x1274E87: av_buffer_pool_get (buffer.c:404)
==11758==    by 0x6AA79C: buffer_pool_get (mpegts.c:1130)
==11758==    by 0x6AB43C: mpegts_push_data (mpegts.c:1392)
==11758==    by 0x6B0455: handle_packet (mpegts.c:2879)
==11758==    by 0x6B1E8F: avpriv_mpegts_parse_packet (mpegts.c:3407)
==11758==    by 0x7B4BE8: mpegts_handle_packet (rtpdec_mpegts.c:77)
==11758==    by 0x7ACD85: rtp_parse_packet_internal (rtpdec.c:762)
==11758== 
--11758-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--11758-- si_code=128;  Faulting address: 0x0;  sp: 0x10032c6e20

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==11758==    at 0x58051665: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==11758==    by 0x58053E58: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==11758==    by 0x5800BA44: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==11758==    by 0x5800BD64: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==11758==    by 0x5809F55C: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==11758==    by 0x580AECD0: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 11758)
==11758==    at 0x4C33E76: memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11758==    by 0x4C33F91: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11758==    by 0x128E3AB: av_malloc (mem.c:104)
==11758==    by 0x128E7FE: av_mallocz (mem.c:265)
==11758==    by 0x6AB563: add_pes_stream (mpegts.c:1428)
==11758==    by 0x6AFE64: handle_packet (mpegts.c:2761)
==11758==    by 0x6B1E8F: avpriv_mpegts_parse_packet (mpegts.c:3407)
==11758==    by 0x7B4BE8: mpegts_handle_packet (rtpdec_mpegts.c:77)
==11758==    by 0x7ACD85: rtp_parse_packet_internal (rtpdec.c:762)
==11758==    by 0x7AD430: rtp_parse_one_packet (rtpdec.c:916)
==11758==    by 0x7AD545: ff_rtp_parse_packet (rtpdec.c:950)
==11758==    by 0x722419: ff_rtsp_fetch_packet (rtsp.c:2273)
==11758==    by 0x5DF675: ff_read_packet (demux.c:557)
==11758==    by 0x5E2665: read_frame_internal (demux.c:1231)
==11758==    by 0x5E7C41: avformat_find_stream_info (demux.c:2584)
==11758==    by 0x235E10: open_input_file (ffmpeg_opt.c:1200)
==11758==    by 0x244DB6: open_files (ffmpeg_opt.c:3423)
==11758==    by 0x244F6A: ffmpeg_parse_options (ffmpeg_opt.c:3463)
==11758==    by 0x264391: main (ffmpeg.c:4870)




[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".