Ticket #1066 (new defect)

Opened 2 years ago

Last modified 2 months ago

VLC crash on h264 stream over RTP with packetloss

Reported by: Nick Assigned to: jpsaman
Priority: normal Milestone: 1.0.0 bugs
Component: Decoders Version: master
Severity: major Keywords: AVC, RTP, HD
Cc: jb Platform(s): all
Difficulty: unknown Work status: Not started

Description

Hello vlc-devs,

for a demo we stream an avc encoded video sequence over rtp and in the network we introduce packetloss. This packetloss ranges from 0.1% to 1%.

When certain packets get lost vlc crashes. After reviewing the crash dump I noticed, that the error occurs inside libffmpeg.dll. I noticed that in january a bug was fixed in the h264 decoder of ffmpeg to enable decoding of corrupted avc streams. Maybe this could solve the problem?

Some further info:

DrMingw? produces following backtrace:

vlc.exe caused an Access Violation at location 005f0c27 in module vlc.exe Reading from location 1711d134.

Registers: eax=0000001f ebx=167656e0 ecx=00000016 edx=00000000 esi=1091f2c4 edi=040a7010 eip=005f0c27 esp=0fe8f998 ebp=040a9108 iopl=0 nv up ei pl nz ac pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200212

Call stack: 005F0C27 vlc.exe:005F0C27 Send switcher.c:475 static int Send(

sout_stream_t * p_stream = &{

int i_object_id = , int i_object_type = , const char * psz_object_type = , char * psz_object_name = , char * psz_header = , int i_flags = , vlc_bool_t b_thread = , vlc_thread_t thread_id = , vlc_mutex_t object_lock = {

HANDLE mutex = , CRITICAL_SECTION csection = {

PCRITICAL_SECTION_DEBUG DebugInfo? = , LONG LockCount? = , LONG RecursionCount? = , HANDLE OwningThread? = , HANDLE LockSemaphore? = , DWORD SpinCount? =

}, vlc_object_t * p_this =

}, vlc_cond_t object_wait = {

int i_waiting_threads = , HANDLE event = , SIGNALOBJECTANDWAIT SignalObjectAndWait? = , HANDLE semaphore = , CRITICAL_SECTION csection = {

PCRITICAL_SECTION_DEBUG DebugInfo? = , LONG LockCount? = , LONG RecursionCount? = , HANDLE OwningThread? = , HANDLE LockSemaphore? = , DWORD SpinCount? =

}, int i_win9x_cv = , vlc_object_t * p_this =

}, vlc_bool_t b_error = , vlc_bool_t b_die = , vlc_bool_t b_dead = , vlc_bool_t b_attached = , vlc_bool_t b_force = , vlc_mutex_t var_lock = {

HANDLE mutex = , CRITICAL_SECTION csection = {

PCRITICAL_SECTION_DEBUG DebugInfo? = , LONG LockCount? = , LONG RecursionCount? = , HANDLE OwningThread? = , HANDLE LockSemaphore? = , DWORD SpinCount? =

}, vlc_object_t * p_this =

}, int i_vars = , variable_t * p_vars = , libvlc_t * p_libvlc = , vlc_t * p_vlc = , int i_refcount = , vlc_object_t * p_parent = , vlc_object_t * * pp_children = , int i_children = , void * p_private = , int be_sure_to_add_VLC_COMMON_MEMBERS_to_struct = , module_t * p_module = , sout_instance_t * p_sout = , char * psz_name = , sout_cfg_t * p_cfg = , char * psz_next = , spu_t * p_spu = , sout_stream_id_t * ()(void) * pf_add = , int ()(void) * pf_del = , int ()(void) * pf_send = , sout_stream_sys_t * p_sys =

}, sout_stream_id_t * id = &(indirect), block_t * p_buffer = &{

block_t * p_next = , block_t * p_prev = , uint32_t i_flags = , mtime_t i_pts = , mtime_t i_dts = , mtime_t i_length = , int i_samples = , int i_rate = , int i_buffer = , uint8_t * p_buffer = , void ()(void) * pf_release = , vlc_object_t * p_manager = , block_sys_t * p_sys =

}

)

...

{

block_Release( p_buffer );

return VLC_EGENERIC;

}

...

10924043 A6A00F00

Change History

05/03/07 12:24:21 changed by Nick

Compiled vlc 0.8.6-bugfix with the latest ffmpeg (05/03/2007) then i got following stacktrace

vlc.exe caused an Access Violation at location 7c910f2b in module ntdll.dll Reading from location b28391c2.

Registers: eax=066e3f70 ebx=003e0000 ecx=066e3f70 edx=b28391be esi=066e3f68 edi=066e0f28 eip=7c910f2b esp=04a9fbd8 ebp=04a9fbe4 iopl=0 nv up ei ng nz na po cy cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000287

Call stack: 7C910F2B ntdll.dll:7C910F2B wcsncpy 7C910D5C ntdll.dll:7C910D5C wcsncpy 77C2C2DE msvcrt.dll:77C2C2DE free 671C14E7 libtrivial_mixer_plugin.dll:671C14E7 DoWork? trivial.c:112 static void DoWork?(

aout_instance_t * p_aout = &(indirect), aout_buffer_t * p_buffer = &(indirect)

)

...

p_old_buffer = aout_FifoPop( p_aout, &p_input->fifo ); aout_BufferFree( p_old_buffer );

if ( p_input->fifo.p_first == NULL )

{

msg_Err( p_aout, "internal amix error" );

...

0043D42E vlc.exe:0043D42E MixBuffer? vlc_threads_funcs.h:158 static int MixBuffer?(

aout_instance_t * p_aout = &(indirect)

)

...

#elif defined( WIN32 )

if( p_mutex->mutex )

{

ReleaseMutex?( p_mutex->mutex );

...

0043DDB7 vlc.exe:0043DDB7 aout_MixerRun mixer.c:348 void aout_MixerRun(

aout_instance_t * p_aout = &(indirect)

)

... void aout_MixerRun( aout_instance_t * p_aout ) {

while( MixBuffer?( p_aout ) != -1 );

}

...

00486DCB vlc.exe:00486DCB aout_DecPlay dec.c:368 int aout_DecPlay(

aout_instance_t * p_aout = &(indirect), aout_input_t * p_input = &(indirect), aout_buffer_t * p_buffer = &(indirect)

)

...

vlc_mutex_lock( &p_aout->mixer_lock ); aout_MixerRun( p_aout );

if( p_input->p_input_thread )

{

stats_UpdateInteger( p_input->p_input_thread,

...

0047CAE4 vlc.exe:0047CAE4 DecoderDecode? decoder.c:643 static int DecoderDecode?(

decoder_t * p_dec = &(indirect), block_t * p_block = &(indirect)

)

...

{

p_dec->p_owner->i_preroll_end = -1;

aout_DecPlay( p_dec->p_owner->p_aout,

p_dec->p_owner->p_aout_input, p_aout_buf );

...

0047D2E9 vlc.exe:0047D2E9 DecoderThread? decoder.c:494 static int DecoderThread?(

decoder_t * p_dec = &(indirect)

)

...

break;

}

if( DecoderDecode?( p_dec, p_block ) != VLC_SUCCESS )

{

break;

...

77C3A3B0 msvcrt.dll:77C3A3B0 _endthreadex 7C80B683 kernel32.dll:7C80B683 GetModuleFileNameA

09/03/07 20:14:01 changed by hartman

File is not actually a .mov , but a .ts

Seems to crash in:

#0  0x004ad2b4 in sad16_mmx2 (v=0x520, blk2=0x10 <Address 0x10 out of bounds>, blk1=0x35e <Address 0x35e out of bounds>, stride=0, h=83027041) at i386/motion_est_mmx.c:74
#1  0x0041793b in ff_er_frame_end (s=Cannot access memory at address 0x155
) at error_resilience.c:587

09/03/07 21:46:54 changed by hartman

  • status changed from new to assigned.
  • owner set to hartman.

Bugreport file on ffmpeg-devel

01/05/07 12:53:34 changed by jb

  • status changed from assigned to new.
  • owner changed from hartman to jpsaman.

01/05/07 13:00:57 changed by jb

  • cc set to jb.

Does it also happen in TRUNK and nightly builds ?

01/05/07 13:48:33 changed by jpsaman

Problem still exists in vlc trunk revision [19989] and ffmpeg version of 30 april 2007. The crash happens in ffmpeg library itself.

The crash report: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1302340720 (LWP 22662)] 0x01a52774 in sad16_mmx2 (v=0x0, blk2=0x240 <Address 0x240 out of bounds>,

blk1=0xaf06e470 "####\"\"\"\"", '#' <repeats 20 times>, " !!!! !!\"#####\"\"! !!\037\037\037 !####! !\"\"\"\"########\"\"! !\"####\"\"\"\"", '#' <repeats 16 times>, "\"\"\"\"\"\"\"\"#!!#!!!!\"\"\"\"\"\"\"\"\"\"! \"#\"! \"\"\"\"####\"\"\"\"\"\"! ", '#' <repeats 20 times>..., stride=1312, h=16) at i386/motion_est_mmx.c:74

74 asm volatile(#1 0x019c5de5 in ff_er_frame_end (s=0xb118e020) at error_resilience.c:587 #2 0x01ae0d3f in decode_frame (avctx=dwarf2_read_address: Corrupted DWARF expression. ) at h264.c:8388 #3 0x0189bf92 in avcodec_decode_video (avctx=0x985b950, picture=0x9869330,

got_picture_ptr=0xb25fd234, buf=0xaef8f008 "", buf_size=58703) at utils.c:902

#4 0x018387c2 in DecodeVideo?0_9_0b (p_dec=0x987e100, pp_block=0xb25fd384)

at video.c:490

#5 0x080dff19 in DecoderDecode? (p_dec=0x987e100, p_block=0x98fe9e8)

at input/decoder.c:631

#6 0x080e06bf in DecoderThread? (p_dec=0x987e100) at input/decoder.c:423 #7 0x00c433db in start_thread () from /lib/libpthread.so.0 #8 0x00b9d26e in clone () from /lib/libc.so.6

16/09/07 20:36:26 changed by courmisch

  • version changed from 0.8.6a to HEAD.
  • milestone changed from 0.8.6-b to 0.9.0 bugs.

12/08/08 13:24:15 changed by hartman

Crash still exists with the latest avcodec versions.

14/08/08 07:30:52 changed by jpsaman

Could you be more specific about with which ffmpeg version? And provide a backtrace please. Anyway it is a resilience problem inside ffmpeg decoder nothing that vlc team can do about it.

I am using ffmpeg version 1480