[FFmpeg-devel] [PATCH] libavfilter:vf_thumbnail.c: Fix bug in buffer handling for RGB width

[Clément Bœsch]

On Wed, Feb 18, 2015 at 06:20:54PM -0800, Chris Kennedy wrote:
> More details attached, debug level and gdb backtrace.  Hopefully this
> helps, and I will work on getting a file I can share showing the issue.
> 
> Thanks
> 
[...]
> ffmpeg -nostdin -nostats -analyzeduration 774552000 -threads 1 -i input.avi -threads 1 -vsync 0 -q:v 0 -an -vf trim=300:776,fps=fps=29.97,thumbnail=178 video%02d.jpg
> Returned: [Parsed_thumbnail_2 @ 0x2f4cac0] frame id #128 (pts_time=351.785118) selected from a set of 178 images
> WIP, backtrace and full debug ready, I am going to hunt now for the issue and try to fix it:
> Starting program: /opt/ffmpeg/ffmpeg -nostdin -nostats -analyzeduration 774552000 -threads 1 -i input.avi -threads 1 -vsync 0 -q:v 0 -an -vf trim=300:776,fps=fps=29.97,thumbnail=178 -loglevel debug video%02d.jpg
> [Thread debugging using libthread_db enabled]
> ffmpeg version n2.5.1-22-g26e5e17 Copyright (c) 2000-2014 the FFmpeg developers
> built on Feb 17 2015 15:59:56 with gcc 4.4.7 (GCC) 20120313 (Red Hat 4.4.7-11)

> configuration: --prefix=/usr --disable-outdev=sdl --disable-ffplay --disable-ffserver --enable-gpl --enable-nonfree --disable-shared --disable-optimizations --disable-stripping --enable-debug=3 --enable-static --disable-mmx --disable-mmxext --disable-ssse3 --extra-cflags='-O0 -fno-inline'

Weird configuration... You can just use ffmpeg_g. And use runtime
-cpuflags instead of disabling ASM at configure.

> libavutil 54. 15.100 / 54. 15.100
> libavcodec 56. 13.100 / 56. 13.100
> libavformat 56. 15.102 / 56. 15.102
> libavdevice 56. 3.100 / 56. 3.100
> libavfilter 5. 2.103 / 5. 2.103
> libswscale 3. 1.101 / 3. 1.101
> libswresample 1. 1.100 / 1. 1.100
> libpostproc 53. 3.100 / 53. 3.100
> Splitting the commandline.
> Reading option '-nostdin' ... matched as option 'stdin' (enable or disable interaction on standard input) with argument 0.
> Reading option '-nostats' ... matched as option 'stats' (print progress report during encoding) with argument 0.
> Reading option '-analyzeduration' ... matched as AVOption 'analyzeduration' with argument '774552000'.
> Reading option '-threads' ... matched as AVOption 'threads' with argument '1'.
> Reading option '-i' ... matched as input file with argument 'input.avi'.
> Reading option '-threads' ... matched as AVOption 'threads' with argument '1'.
> Reading option '-vsync' ... matched as option 'vsync' (video sync method) with argument '0'.
> Reading option '-q:v' ... matched as option 'q' (use fixed quality scale (VBR)) with argument '0'.
> Reading option '-an' ... matched as option 'an' (disable audio) with argument '1'.
> Reading option '-vf' ... matched as option 'vf' (set video filters) with argument 'trim=300:776,fps=fps=29.97,thumbnail=178'.
> Reading option '-loglevel' ... matched as option 'loglevel' (set logging level) with argument 'debug'.
> Reading option 'video%02d.jpg' ... matched as output file.
> Finished splitting the commandline.
> Parsing a group of options: global .
> Applying option nostdin (enable or disable interaction on standard input) with argument 0.
> Applying option nostats (print progress report during encoding) with argument 0.
> Applying option vsync (video sync method) with argument 0.
> Applying option loglevel (set logging level) with argument debug.
> Successfully parsed a group of options.
> Parsing a group of options: input file input.avi.
> Successfully parsed a group of options.
> Opening an input file: input.avi.
> [avi @ 0x1c8d9b0] Format avi probed with size=2048 and score=100
> [avi @ 0x1c8e330] use odml:1
> [avi @ 0x1c8d9b0] Before avformat_find_stream_info() pos: 9986 bytes read:1906544 seeks:4
> [avi @ 0x1c8d9b0] All info found
> rfps: 29.666667 0.013653
> Last message repeated 1 times
> rfps: 29.750000 0.007182
> Last message repeated 1 times
> rfps: 29.833333 0.002772
> Last message repeated 1 times
> rfps: 29.916667 0.000422
> Last message repeated 1 times
> rfps: 30.000000 0.000133
> Last message repeated 1 times
> rfps: 60.000000 0.000533
> Last message repeated 1 times
> rfps: 120.000000 0.002132
> Last message repeated 1 times
> rfps: 240.000000 0.008528
> Last message repeated 1 times
> rfps: 29.970030 0.000000
> rfps: 59.940060 0.000000
> [avi @ 0x1c8d9b0] After avformat_find_stream_info() pos: 334549 bytes read:2201456 seeks:4 frames:97
> Input #0, avi, from 'input.avi':
> Metadata:
> encoder : Lavf52.62.0
> Duration: 00:25:49.10, start: 0.000000, bitrate: 1644 kb/s
> Stream #0:0, 41, 1001/30000: Video: mpeg4 (Simple Profile) (XVID / 0x44495658), yuv420p(left), 624x480 [SAR 1:1 DAR 13:10], 1/30000, 1439 kb/s, 29.97 fps, 29.97 tbr, 29.97 tbn, 30k tbc
> Stream #0:1, 56, 3/125: Audio: mp3 (U[0][0][0] / 0x0055), 48000 Hz, stereo, s16p, 192 kb/s
> Successfully opened the file.
> Parsing a group of options: output file video%02d.jpg.
> Applying option q:v (use fixed quality scale (VBR)) with argument 0.
> Applying option an (disable audio) with argument 1.
> Applying option vf (set video filters) with argument trim=300:776,fps=fps=29.97,thumbnail=178.
> Successfully parsed a group of options.
> Opening an output file: video%02d.jpg.
> Successfully opened the file.
> [Parsed_trim_0 @ 0x1c95430] Setting 'starti' to value '300'
> [Parsed_trim_0 @ 0x1c95430] Setting 'endi' to value '776'
> [Parsed_fps_1 @ 0x1c85a60] Setting 'fps' to value '29.97'
> [Parsed_fps_1 @ 0x1c85a60] fps=2997/100
> [Parsed_thumbnail_2 @ 0x1c8d810] Setting 'n' to value '178'
> [Parsed_thumbnail_2 @ 0x1c8d810] batch size: 178 frames
> [graph 0 input from stream 0:0 @ 0x1c8d620] Setting 'video_size' to value '624x480'
> [graph 0 input from stream 0:0 @ 0x1c8d620] Setting 'pix_fmt' to value '0'
> [graph 0 input from stream 0:0 @ 0x1c8d620] Setting 'time_base' to value '1001/30000'
> [graph 0 input from stream 0:0 @ 0x1c8d620] Setting 'pixel_aspect' to value '1/1'
> [graph 0 input from stream 0:0 @ 0x1c8d620] Setting 'sws_param' to value 'flags=2'
> [graph 0 input from stream 0:0 @ 0x1c8d620] Setting 'frame_rate' to value '30000/1001'
> [graph 0 input from stream 0:0 @ 0x1c8d620] w:624 h:480 pixfmt:yuv420p tb:1001/30000 fr:30000/1001 sar:1/1 sws_param:flags=2
> [format @ 0x1d15cd0] compat: called with args=[yuvj420p|yuvj422p|yuvj444p]
> [format @ 0x1d15cd0] Setting 'pix_fmts' to value 'yuvj420p|yuvj422p|yuvj444p'
> [auto-inserted scaler 0 @ 0x1d16b30] Setting 'flags' to value '0x4'
> [auto-inserted scaler 0 @ 0x1d16b30] w:iw h:ih flags:'0x4' interl:0
> [Parsed_thumbnail_2 @ 0x1c8d810] auto-inserting filter 'auto-inserted scaler 0' between the filter 'Parsed_fps_1' and the filter 'Parsed_thumbnail_2'
> [auto-inserted scaler 1 @ 0x1d164e0] Setting 'flags' to value '0x4'
> [auto-inserted scaler 1 @ 0x1d164e0] w:iw h:ih flags:'0x4' interl:0
> [format @ 0x1d15cd0] auto-inserting filter 'auto-inserted scaler 1' between the filter 'Parsed_thumbnail_2' and the filter 'format'
> [AVFilterGraph @ 0x1c85cb0] query_formats: 6 queried, 3 merged, 2 already done, 0 delayed
> [auto-inserted scaler 0 @ 0x1d16b30] picking rgb24 out of 2 ref:yuv420p alpha:0
> [auto-inserted scaler 1 @ 0x1d164e0] picking yuvj444p out of 3 ref:rgb24 alpha:0
> [swscaler @ 0x1c85d20] No accelerated colorspace conversion found from yuv420p to rgb24.
> [auto-inserted scaler 0 @ 0x1d16b30] w:624 h:480 fmt:yuv420p sar:1/1 -> w:624 h:480 fmt:rgb24 sar:1/1 flags:0x4
> [swscaler @ 0x1ca8be0] deprecated pixel format used, make sure you did set range correctly
> [auto-inserted scaler 1 @ 0x1d164e0] w:624 h:480 fmt:rgb24 sar:1/1 -> w:624 h:480 fmt:yuvj444p sar:1/1 flags:0x4
> [mjpeg @ 0x1d15660] intra_quant_bias = 96 inter_quant_bias = 0
> Output #0, image2, to 'video%02d.jpg':
> Metadata:
> encoder : Lavf56.15.102
> Stream #0:0, 0, 100/2997: Video: mjpeg, yuvj444p(pc, left), 624x480 [SAR 1:1 DAR 13:10], 100/2997, q=2-31, 200 kb/s, 29.97 fps, 29.97 tbn, 29.97 tbc
> Metadata:
> encoder : Lavc56.13.100 mjpeg
> Stream mapping:
> Stream #0:0 -> #0:0 (mpeg4 (native) -> mjpeg (native))
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #147 (pts_time=304.904905) selected from a set of 178 images
> [AVIOContext @ 0x1f4c140] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #129 (pts_time=310.243577) selected from a set of 178 images
> [AVIOContext @ 0x6ee8cf0] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #43 (pts_time=313.313313) selected from a set of 178 images
> [AVIOContext @ 0x1d39a60] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #88 (pts_time=320.754087) selected from a set of 178 images
> [AVIOContext @ 0x59a9d90] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #131 (pts_time=328.128128) selected from a set of 178 images
> [AVIOContext @ 0x4f20850] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #34 (pts_time=330.830831) selected from a set of 178 images
> [AVIOContext @ 0x1d39a40] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #147 (pts_time=340.540541) selected from a set of 178 images
> [AVIOContext @ 0x6ee3b00] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #138 (pts_time=346.179513) selected from a set of 178 images
> [AVIOContext @ 0x59b4e10] Statistics: 0 seeks, 2 writeouts
> [Parsed_thumbnail_2 @ 0x1c8d810] frame id #128 (pts_time=351.785118) selected from a set of 178 images
> [AVIOContext @ 0x1fecb30] Statistics: 0 seeks, 3 writeouts

> Program received signal SIGSEGV, Segmentation fault.
> _int_malloc (av=0x7ffff7124e80, bytes=<value optimized out>) at malloc.c:4515
> 4515 fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
> (gdb) backtrace
> #0 _int_malloc (av=0x7ffff7124e80, bytes=<value optimized out>) at malloc.c:4515
> #1 0x00007ffff6e0f6b1 in __libc_malloc (bytes=683) at malloc.c:3664
> #2 0x0000000001035633 in av_realloc (ptr=0x0, size=683) at libavutil/mem.c:166
> #3 0x0000000001026c72 in av_buffer_realloc (pbuf=0x7fffffffd160, size=683) at libavutil/buffer.c:165
> #4 0x00000000006fb572 in packet_alloc (buf=0x7fffffffd160, size=651) at libavcodec/avpacket.c:74
> #5 0x00000000006fb5d5 in av_new_packet (pkt=0x7fffffffd400, size=651) at libavcodec/avpacket.c:86
> #6 0x00000000006fb6dd in av_grow_packet (pkt=0x7fffffffd400, grow_by=651) at libavcodec/avpacket.c:116
> #7 0x00000000006a4b31 in append_packet_chunked (s=0x1c964b0, pkt=0x7fffffffd400, size=651) at libavformat/utils.c:217
> #8 0x00000000006a4c6b in av_get_packet (s=0x1c964b0, pkt=0x7fffffffd400, size=651) at libavformat/utils.c:245
> #9 0x0000000000576fb1 in avi_read_packet (s=0x1c8d9b0, pkt=0x7fffffffd400) at libavformat/avidec.c:1363
> #10 0x00000000006a6162 in ff_read_packet (s=0x1c8d9b0, pkt=0x7fffffffd400) at libavformat/utils.c:662
> #11 0x00000000006a8900 in read_frame_internal (s=0x1c8d9b0, pkt=0x7fffffffd700) at libavformat/utils.c:1312
> #12 0x00000000006a9528 in av_read_frame (s=0x1c8d9b0, pkt=0x7fffffffd700) at libavformat/utils.c:1471
> #13 0x00000000004277e5 in get_input_packet (f=0x1c8e7b0, pkt=0x7fffffffd700) at ffmpeg.c:3381
> #14 0x000000000042790c in process_input (file_index=0) at ffmpeg.c:3418
> #15 0x0000000000429397 in transcode_step () at ffmpeg.c:3719
> #16 0x00000000004294a5 in transcode () at ffmpeg.c:3771
> #17 0x00000000004299b3 in main (argc=21, argv=0x7fffffffdcf8) at ffmpeg.c:3951

This doesn't really look like an overread, more like you hit a memory
limit and your malloc implementation doesn't like it, or something along
these lines (178 frames is a lot). Keep in mind that thumbnail might not
be the best solution to getting thumb. Using scene detection in select
filter and pick the Nth scene change might pick a better one, with less
memory usage.

You might want to try valgrind to make sure it's not an overread/write.

-- 
Clément B.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150222/217eafc7/attachment.asc>