[Ffmpeg-devel] crash with H.264 MBAFF of height 676 or more

[Loren Merritt]

On Tue, 6 Mar 2007, stream47 wrote:

> I am trying to trancecode from H.264 MBAF (encoded with x.264) to flv.
> It seems that MBAFF H.264 of height 676 or more crashes ffmpeg.
> FFmpeg said "[h264 @ 0x6da784]concealing 860 DC, 860 AC, 860 MV errors" 
> many times and crashed with SIGABRT.
> ffdshow and VLC also crashes.

Diagnosis: Many parts of libavcodec assume that allocated frame height = 
visible frame height rounded up to a multiple of 16. But H.264 MBAFF 
needs to have an allocated height divisible by 32. If the visible 
resolution of your video is not divisble by 32, x264 has to round it up 
and add a cropping rectangle. If the cropping value exceeds 15, libavcodec 
crashes due to the above assumption. (It is possible to use a large crop 
value in progressive videos too, but there's no reason for an encoder to 
choose that except in MBAFF mode.)

But I can't easily fix it. I think any potential fix would have to at 
least modify the get_buffer api, along with some mpeg-common code.
A quick kludge to stop the crash would be to ignore cropping, and just 
display the whole coded frame including the padding region.

> I think this is maybe a libavcodec's bug because I asked CoreAVC users 
> whether it crashed, and they said No.

Of course a crash is a bug. That would be true even if the stream were 
invalid.

--Loren Merritt