[FFmpeg-trac] #3564(avformat:new): random RTMP crash

[FFmpeg]

#3564: random RTMP crash
------------------------------------+--------------------------------------
             Reporter:  kyh96403    |                     Type:  defect
               Status:  new         |                 Priority:  normal
            Component:  avformat    |                  Version:  git-master
             Keywords:  rtmp crash  |               Blocked By:
             Blocking:              |  Reproduced by developer:  0
Analyzed by developer:  0           |
------------------------------------+--------------------------------------
 When internet connection is break or time-out is short...
 Sometime crash is occur.

 Backtrace is follow.

 Program terminated with signal 11, Segmentation fault.
 #0  0x0000003d222728ae in free () from /lib64/libc.so.6
 (gdb) bt
 #0  0x0000003d222728ae in free () from /lib64/libc.so.6
 #1  0x0000000000b9dc1c in av_free (arg=0x2aab3b1be6a8) at
 libavutil/mem.c:232
 #2  av_freep (arg=0x2aab3b1be6a8) at libavutil/mem.c:239
 #3  0x0000000000528fe5 in ff_rtmp_packet_destroy (h=0x1a21c4a0,
 p=0x2aab3b1be690, chunk_size=4096, prev_pkt_ptr=<value optimized out>,
     nb_prev_pkt=<value optimized out>, hdr=100 'd') at
 libavformat/rtmppkt.c:410
 #4  rtmp_packet_read_one_chunk (h=0x1a21c4a0, p=0x2aab3b1be690,
 chunk_size=4096, prev_pkt_ptr=<value optimized out>, nb_prev_pkt=<value
 optimized out>,
     hdr=100 'd') at libavformat/rtmppkt.c:264
 #5  0x000000000052922a in ff_rtmp_packet_read_internal (h=0x1a21c4a0,
 p=0x2aab3b1be690, chunk_size=4096, prev_pkt=0x1a21c050,
 nb_prev_pkt=0x1a21c060)
     at libavformat/rtmppkt.c:289
 #6  ff_rtmp_packet_read (h=0x1a21c4a0, p=0x2aab3b1be690, chunk_size=4096,
 prev_pkt=0x1a21c050, nb_prev_pkt=0x1a21c060) at libavformat/rtmppkt.c:161
 #7  0x00000000004cf309 in get_packet (s=0x1a21bfc0, for_header=<value
 optimized out>) at libavformat/rtmpproto.c:2262
 #8  0x00000000004cf78e in rtmp_read (s=0x2aab7a62a040, buf=0x1a22e7e0
 "\b", size=32768) at libavformat/rtmpproto.c:2628
 #9  0x000000000043d411 in retry_transfer_wrapper (h=0x1a21bfc0,
 buf=0x1a22e7e0 "\b", size=32768) at libavformat/avio.c:303
 #10 ffurl_read (h=0x1a21bfc0, buf=0x1a22e7e0 "\b", size=32768) at
 libavformat/avio.c:334
 #11 0x000000000043dfa3 in fill_buffer (s=0x1a21d220) at
 libavformat/aviobuf.c:449
 #12 0x000000000043e0d5 in avio_r8 (s=0x2aab7a62a040) at
 libavformat/aviobuf.c:495
 #13 0x0000000000452dcc in flv_read_packet (s=0x1a21b9c0,
 pkt=0x2aab3b1be950) at libavformat/flvdec.c:771
 #14 0x0000000000508f0e in ff_read_packet (s=0x1a21b9c0,
 pkt=0x2aab3b1be950) at libavformat/utils.c:767
 #15 0x000000000050b45b in read_frame_internal (s=0x1a21b9c0,
 pkt=0x2aab3b1c9ef0) at libavformat/utils.c:1436
 #16 0x000000000050c29a in av_read_frame (s=0x2aab7a62a040,
 pkt=0x2aab3b1c9ef0) at libavformat/utils.c:1573


 That is can be fix by...
 rtmppkt.c
 {{{
 static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,
                                       int chunk_size, RTMPPacket
 **prev_pkt_ptr,
                                       int *nb_prev_pkt, uint8_t hdr)
 ....
 ....
 ....
     if (size > 0) {
        RTMPPacket *prev = &prev_pkt[channel_id];
        prev->data = p->data;
        prev->read = p->read;
        prev->offset = p->offset;
        // added by K.Y.H for fix crash....
        p->data      = NULL;
        return AVERROR(EAGAIN);
     }

     prev_pkt[channel_id].read = 0; // read complete; reset if needed
     return p->read;
 }
 }}}

--
Ticket URL: <https://trac.ffmpeg.org/ticket/3564>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker