[Ffmpeg-devel] DVR-MS bug (MP2 decoding)

[Steve Lhomme]

Hi,

A user sent us a DVR-MS file (ASF with MPEG-2 and MP2) that doesn't 
decode correctly in FFMPEG.

The issue in DrFFMPEG (with some fixes in ASF submited on this list) is 
that the audio is not decoded at all. The video is decoded fine. In 
FFMPEG the files crashes very fast but not at the same place with the 
following gdb log:

(gdb) run -i c:\test\divx\today.dvr-ms -vn test.wav
Starting program: c:\Perso\Programmes\ffmpeg.cvs/ffmpeg_g.exe -i 
c:\test\divx\today.dvr-ms -vn test.wav
gdb: do_initial_child_stuff: process 1336
gdb: kernel event for pid=1336 tid=1300 code=CREATE_PROCESS_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=EXCEPTION_DEBUG_EVENT)
gdb: Target exception EXCEPTION_BREAKPOINT at 0x7c901230
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=UNLOAD_DLL_DEBUG_EVENT)
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=LOAD_DLL_DEBUG_EVENT)
gdb: child_resume.SetThreadContext: thread 1336.0x514
ContinueDebugEvent (cpid=1336, ctid=1300, DBG_CONTINUE);
gdb: kernel event for pid=1336 tid=1300 code=EXCEPTION_DEBUG_EVENT)
gdb: Target exception EXCEPTION_ACCESS_VIOLATION at 0x00524801

Program received signal SIGSEGV, Segmentation fault.
mpeg_decode_mb (s=0x3d950, block=0x2) at mpeg12.c:1894
1894        block[0] = dc << (3 - s->intra_dc_precision);
(gdb) bt
#0  mpeg_decode_mb (s=0x3d950, block=0x2) at mpeg12.c:1894
#1  0x00525230 in mpeg_decode_slice (s1=0x3d950, mb_y=0, buf=0x23efe4,
     buf_size=101196) at mpeg12.c:2567
#2  0x00527942 in mpeg_decode_frame (avctx=0x3bf90, data=0x23f4d0,
     data_size=0x23f47c, buf=0x1500030 "", buf_size=101380) at mpeg12.c:3157
#3  0x00458612 in avcodec_decode_video (avctx=0x3bf90, picture=0x23f4d0,
     got_picture_ptr=0x23f47c, buf=0x1500030 "", buf_size=101380) at 
utils.c:946
#4  0x0040f44c in av_find_stream_info (ic=0x36790) at utils.c:1826
#5  0x00405c87 in opt_input_file (filename=0x0) at ffmpeg.c:2834
#6  0x00032422 in ?? ()
#7  0x00000000 in ?? () from
#8  0x00000000 in ?? () from
#9  0x0023f900 in ?? ()
#10 0x0023f8e4 in ?? ()
#11 0x7c90ee18 in strchr () from ntdll.dll
#12 0x7c9106f0 in ntdll!RtlAppendStringToString () from ntdll.dll
#13 0xffffffff in ?? ()
#14 0x7c9106eb in ntdll!RtlAppendStringToString () from ntdll.dll
#15 0x77c2c3c9 in msvcrt!free () from C:\WINDOWS\system32\msvcrt.dll
#16 0x00030000 in ?? ()
#17 0x40000060 in ?? ()
#18 0x77c2c3ce in msvcrt!free () from C:\WINDOWS\system32\msvcrt.dll
#19 0x0000003c in ?? ()
#20 0x77c5fcc0 in msvcrt!_iob ()
#21 0x00000002 in ?? ()
#22 0x0023f6cc in ?? ()
#23 0x00000000 in ?? () from
#24 0x00000000 in ?? () from
#25 0x7c90ee18 in strchr () from ntdll.dll
#26 0x0023f988 in ?? ()
#27 0x77c35c94 in msvcrt!_except_handler2 ()
    from C:\WINDOWS\system32\msvcrt.dll

(gdb) disass $pc-32 $pc+32
Dump of assembler code from 0x5247e1 to 0x524821:
0x005247e1 <mpeg_decode_mb+6625>:       pusha
0x005247e2 <mpeg_decode_mb+6626>:       pop    %es
0x005247e3 <mpeg_decode_mb+6627>:       add    %al,(%eax)
0x005247e5 <mpeg_decode_mb+6629>:       mov    0x1c74(%esi),%edx
0x005247eb <mpeg_decode_mb+6635>:       add    %edi,%eax
0x005247ed <mpeg_decode_mb+6637>:       mov    %eax,0x760(%esi,%ebx,4)
0x005247f4 <mpeg_decode_mb+6644>:       sub    %edx,%ecx
0x005247f6 <mpeg_decode_mb+6646>:       mov    0xffffffcc(%ebp),%edi
0x005247f9 <mpeg_decode_mb+6649>:       shl    %cl,%eax
0x005247fb <mpeg_decode_mb+6651>:       mov    0x1c88(%esi),%ecx
0x00524801 <mpeg_decode_mb+6657>:       mov    %ax,(%edi)
0x00524804 <mpeg_decode_mb+6660>:       xor    $0x1,%eax
0x00524807 <mpeg_decode_mb+6663>:       cwtl
0x00524808 <mpeg_decode_mb+6664>:       mov    %eax,0xffffffbc(%ebp)
0x0052480b <mpeg_decode_mb+6667>:       test   %ecx,%ecx
0x0052480d <mpeg_decode_mb+6669>:       mov    $0x681780,%eax
0x00524812 <mpeg_decode_mb+6674>:       jne    0x524819 
<mpeg_decode_mb+6681>
0x00524814 <mpeg_decode_mb+6676>:       mov    $0x6816c0,%eax
0x00524819 <mpeg_decode_mb+6681>:       mov    0xfffffff0(%ebp),%esi
0x0052481c <mpeg_decode_mb+6684>:       mov    0x3c(%eax),%eax
0x0052481f <mpeg_decode_mb+6687>:       mov    0x1c3c(%esi),%ebx


When loaded in GraphEdit this file needs 2 filters named "Decrypt/Tag". 
And it doesn't decode when ffdshow is used (either with libmad or 
mp3lib). But it does decode when using DScaler5. Dunno what library they 
use, apparently libmad:
http://cvs.sourceforge.net/viewcvs.py/deinterlace/DScaler5/Filters/Decoders/MpegAudio/

For those interrested in finding out what's wrong, here is the sample URL:
ftp://uleguadv:refulavi at ftp.divxnetworks.com/today.dvr-ms

Steve