[Ffmpeg-devel] SIGSEGV in h264.c, stream is available for debugging

Dario Andrade dario
Tue Sep 6 01:16:15 CEST 2005


I've got a SIGSEGV decoding h264, the stream was generated by x264.


The following stream was recorded live and begins from the middle:




the following command line reproduces the fault (the source code is updated
from cvs as of 09/05/2005 08:13pm GMT-3).


$ ./ffmpeg -i dump.SIGSEGV.h264 -f null dump.SIGSEGV.h264.null

ffmpeg version CVS, build 3211266, Copyright (c) 2000-2004 Fabrice Bellard

  configuration:  --disable-ffserver --disable-ffplay --enable-memalign-hack
--enable-mingw32 --source-path=c:/cygwin/home/dario/ffmpeg

  built on Sep  5 2005 19:18:54, gcc: 3.2.3 (mingw special 20030504-1)

Input #0, h264, from 'dump.SIGSEGV.h264':

  Duration: N/A, bitrate: N/A

  Stream #0.0: Video: h264, yuv420p, 320x240, 10.00 fps

Output #0, null, to 'dump.SIGSEGV.h264.null':

  Stream #0.0: Video: rawvideo, yuv420p, 320x240, 10.00 fps, q=2-31, 200

Stream mapping:

  Stream #0.0 -> #0.0

frame=  104 q=0.0 size=       0kB time=10.4 bitrate=   0.0kbits/s


Here are the requested bug reporting data:


(gdb) r -i dump.SIGSEGV.h264 -f null dump.SIGSEGV.h264.null

Starting program: C:\cygwin\home\dario\ffmpeg/ffmpeg_g.exe -i
dump.SIGSEGV.h264 -f null dump.SIGSEGV.h264.null


Program received signal SIGSEGV, Segmentation fault.

decode_frame (avctx=0x3de270, data=0x22f9d0, data_size=0x22f898,

    buf=0xe66ac8 "", buf_size=895) at h264.c:7553

7553                if(h->delayed_pic[i]->key_frame ||

(gdb) bt

#0  decode_frame (avctx=0x3de270, data=0x22f9d0, data_size=0x22f898,

    buf=0xe66ac8 "", buf_size=895) at h264.c:7553

#1  0x0045d69a in avcodec_decode_video (avctx=0x3de270, picture=0x22f9d0,

    got_picture_ptr=0x22f898, buf=0xe66ac8 "", buf_size=895) at utils.c:625

#2  0x0040cda9 in output_packet (ist=0xd5ced0, ist_index=0,

    ost_table=0xd31d60, nb_ostreams=1, pkt=0x22fb30) at ffmpeg.c:1266

#3  0x00406026 in av_encode (output_files=0x7100f0, nb_output_files=1,

    input_files=0x710000, nb_input_files=1, stream_maps=0x710140,

    nb_stream_maps=0) at ffmpeg.c:2102

#4  0x004048e5 in main (argc=6, argv=0x3d2de0) at ffmpeg.c:4520


(gdb) disass $pc-32 $pc+32

Dump of assembler code from 0x5d53d6 to 0x5d5416:

0x5d53d6 <decode_frame+438>:    out    %al,(%dx)

0x5d53d7 <decode_frame+439>:    add    %eax,(%eax)

0x5d53d9 <decode_frame+441>:    inc    %esi

0x5d53da <decode_frame+442>:    mov    %esi,0xffffffd8(%ebp)

0x5d53dd <decode_frame+445>:    test   %ecx,%ecx

0x5d53df <decode_frame+447>:    jne    0x5d53e8 <decode_frame+456>

0x5d53e1 <decode_frame+449>:    movl   $0x1,0x50(%eax)

0x5d53e8 <decode_frame+456>:    mov    0x1ee18(%ebx),%eax

0x5d53ee <decode_frame+462>:    xor    %ecx,%ecx

0x5d53f0 <decode_frame+464>:    test   %eax,%eax

0x5d53f2 <decode_frame+466>:    je     0x5d541a <decode_frame+506>

0x5d53f4 <decode_frame+468>:    mov    %eax,%esi

0x5d53f6 <decode_frame+470>:    mov    0x30(%esi),%edx

0x5d53f9 <decode_frame+473>:    test   %edx,%edx

0x5d53fb <decode_frame+475>:    jne    0x5d5407 <decode_frame+487>

0x5d53fd <decode_frame+477>:    mov    0xe4(%esi),%edi

0x5d5403 <decode_frame+483>:    test   %edi,%edi

0x5d5405 <decode_frame+485>:    jne    0x5d540e <decode_frame+494>

0x5d5407 <decode_frame+487>:    movl   $0x1,0xffffffd4(%ebp)

0x5d540e <decode_frame+494>:    inc    %ecx

0x5d540f <decode_frame+495>:    mov    0x1ee18(%ebx,%ecx,4),%esi

End of assembler dump.


(gdb) info all-registers

eax            0xda51b0 14307760

ecx            0x11     17

edx            0x0      0

ebx            0xd84fc0 14176192

esp            0x22f7a0 0x22f7a0

ebp            0x22f7d8 0x22f7d8

esi            0x1      1

edi            0x32     50

eip            0x5d53f6 0x5d53f6

eflags         0x10202  66050

cs             0x1b     27

ss             0x23     35

ds             0x23     35

es             0x23     35

fs             0x3b     59

gs             0x0      0

st0            -nan(0x6e6e6e6e6e6e6e6e) (raw 0xffff6e6e6e6e6e6e6e6e)

st1            -nan(0x6e6e6e6e6e6e6e6e) (raw 0xffff6e6e6e6e6e6e6e6e)

st2            -nan(0x6e68566b686b6c72) (raw 0xffff6e68566b686b6c72)

st3            -nan(0x6e00680056006b)   (raw 0xffff006e00680056006b)

st4            0        (raw 0xffff0000000000000000)

st5            0        (raw 0xffff0000000000000000)

st6            0        (raw 0xffff0000000000000000)

st7            0        (raw 0xffff0000000000000000)

fctrl          0xffff037f       -64641

fstat          0xffff0020       -65504

ftag           0xffffffff       -1

fiseg          0x1b     27

fioff          0x4065e9 4220393

foseg          0xffff0023       -65501

fooff          0xd5cf08 14012168

fop            0x1ca    458


(gdb) l h264.c:7550

7545            }


7547            while(h->delayed_pic[pics]) pics++;

7548            h->delayed_pic[pics++] = cur;

7549            if(cur->reference == 0)

7550                cur->reference = 1;


7552            for(i=0; h->delayed_pic[i]; i++)

7553                if(h->delayed_pic[i]->key_frame ||
h->delayed_pic[i]->poc==0)             <---------- ERROR in here!!

7554                    cross_idr = 1;


7556            out = h->delayed_pic[0];

7557            for(i=1; h->delayed_pic[i] && !h->delayed_pic[i]->key_frame;

7558                if(h->delayed_pic[i]->poc < out->poc){

7559                    out = h->delayed_pic[i];

7560                    out_idx = i;

7561                }


7563            out_of_order = !cross_idr && prev && out->poc < prev->poc;

7564            if(prev && pics <= s->avctx->has_b_frames)


(gdb) info locals

out = (Picture *) 0xffffffff

cur = (Picture *) 0xda61a0

prev = (Picture *) 0xda6338

out_idx = 0

pics = 16

cross_idr = 0

dropped_frame = 0

s = (MpegEncContext *) 0xd84fc0

buf_index = 895

buf_index = 895


(gdb) out h

(H264Context *) 0xda51b0


(gdb) out h->delayed_pic

{0xbaadf00d <repeats 16 times>}



I really hope someone could try to figure out what's going on. That bug is
fatally crashing the whole app.


Thanks a lot,

Dario Andrade



More information about the ffmpeg-devel mailing list