[FFmpeg-devel] [PATCH] mpegtsenc: fix free of adts when not using AAC

[Chris Kennedy]

On Wed, Oct 12, 2011 at 10:18:22PM +0000, Carl Eugen Hoyos wrote:
> Chris Kennedy <bitbytebit <at> gmail.com> writes:
> 
> > There is a free for the adts data in writing the trailer onto mpegts
> > files, yet it is only allocated when we are using AAC.  I have seen
> > backtraces that point to this as the issue, although it oddly only
> > segfaults on a very rare occasion.
> 
> Please upload the sample that triggers the segfault for you.

It's actually from a live stream from a clearQAM mpegts broadcast,
so unfortunately has been impossible to get a file that triggers it.
It's rare, once every week, and when it happens backtraces always
point into libavformat somewhere from either the write trailer 
function or read frame function.  Here's the two backtraces I've
gotten, always seems to be when closing an output context and opening
a new one for mpegts.  


SVN-r26400: (code basically same currently where it pointed to)
----
#0  *__GI___libc_free (mem=0x99c3003a6edb869e) at malloc.c:3709
#1  0x000000000040a071 in av_free (ptr=<value optimized out>)
    at libavutil/mem.c:146
#2  av_freep (ptr=<value optimized out>) at libavutil/mem.c:153
#3  0x0000000000453757 in mpegts_write_end (s=0x132d8c0)
    at libavformat/mpegtsenc.c:934
#4  0x000000000048ea32 in av_write_trailer (s=0x132d8c0)
    at libavformat/utils.c:3113
#5  0x0000000000408762 in close_file (SLconfig=0x7fffffffda60, is_video=1)
    at slicer.c:1045
#6  0x0000000000408835 in stop_mux (SLconfig=0x7fffffffda60, is_video=1)
    at slicer.c:1073
#7  0x00000000004076fc in main (argc=4, argv=0x7fffffffe558) at slicer.c:754
----

0.7.4 - slightly different, but same result from same conditions

#0  0x00007ffff682b2d5 in raise () from /lib64/libc.so.6
#1  0x00007ffff682cbeb in abort () from /lib64/libc.so.6
#2  0x00007ffff6866bce in __libc_message () from /lib64/libc.so.6
#3  0x00007ffff686d03a in malloc_printerr () from /lib64/libc.so.6
#4  0x00007ffff78d9eac in av_freep (arg=0x72db38) at libavutil/mem.c:159
#5  0x00007ffff7b56408 in mpegts_close_filter (filter=0x72db20, ts=0x612620) at libavformat/mpegts.c:375
#6  pat_cb (filter=<optimized out>, section=<optimized out>, section_len=<optimized out>)
    at libavformat/mpegts.c:1186
#7  0x00007ffff7b55726 in handle_packet (ts=0x612620, packet=0x7fffffffcc20 "G@") at libavformat/mpegts.c:1332
#8  0x00007ffff7b560ee in handle_packets (nb_packets=0, ts=0x612620) at libavformat/mpegts.c:1418
#9  mpegts_read_packet (s=0x609040, pkt=0x7fffffffcdb0) at libavformat/mpegts.c:1655
#10 0x00007ffff7b95341 in av_read_packet (s=0x609040, pkt=0x7fffffffcdb0) at libavformat/utils.c:807
#11 0x00007ffff7b95ed9 in av_read_frame_internal (s=0x609040, pkt=0x7fffffffdcc0) at libavformat/utils.c:1263
#12 0x00007ffff7b965a1 in av_read_frame (s=0x609040, pkt=0x7fffffffdcc0) at libavformat/utils.c:1370
#13 0x0000000000404dbf in main (argc=<optimized out>, argv=<optimized out>) at slicer.c:503
----


Thanks,
Chris
> 
> Thank you, Carl Eugen
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

-- 
Chris Kennedy
ckennedy at groovy.org