[FFmpeg-trac] #7374(avcodec:new): H.264 decoder is left in broken state after a glitch and switch in input

[FFmpeg]

#7374: H.264 decoder is left in broken state after a glitch and switch in input
---------------------------------+---------------------------------------
             Reporter:  JEEB     |                     Type:  defect
               Status:  new      |                 Priority:  normal
            Component:  avcodec  |                  Version:  unspecified
             Keywords:  h264     |               Blocked By:
             Blocking:           |  Reproduced by developer:  0
Analyzed by developer:  0        |
---------------------------------+---------------------------------------
 '''Summary of the bug:'''
 After what seems to be a glitch/switch in the input stream (trace_headers
 notes that there's 12 H.264 packets for which the BSF couldn't be applied
 to), the H.264 decoder still keeps decoding, but ultimately is left in a
 state where it seems to drop references even though it wouldn't have to.
 Additionally, it seems like the stream switches from MBAFF to PAFF after
 the glitch, although I'm not 100% sure if I'm parsing things correctly to
 note that.

 A cut 10MiB sample is available @
 https://kuroko.fushizen.eu/samples/2018-08-17-h264_decoder_borks.cut.ts

 '''How to reproduce:'''
 You can decode or play the sample with pretty much anything lavc-using. It
 will be OK at first for a moment, and then have a glitch. Then after that
 glitch there's seemingly OK content (if you initialize decoding after the
 glitch, the decoding is OK), but the result is borked for the rest of the
 clip.

 {{{
 % ffmpeg -v debug -i 2018-08-17-h264_decoder_borks.cut.ts -map 0:v:0 -f
 null -t 10 -
 ... decodes fine for a while ...
 timestamp discontinuity
 ...
 [h264 @ 0x3aacbc0] reference count overflow
 [h264 @ 0x3aacbc0] decode_slice_header error
 [h264 @ 0x3aacbc0] no frame!
 ...
 [h264 @ 0x3a47080] Reference 2 >= 2
 [h264 @ 0x3a47080] error while decoding MB 1 0, bytestream 18674
 [h264 @ 0x3bdc740] number of reference frames (0+5) exceeds max (4;
 probably corrupt input), discarding one
 ...
 [h264 @ 0x3a218c0] illegal short term buffer state detected
 [h264 @ 0x3a218c0] nal_unit_type: 9(AUD), nal_ref_idc: 0
 [h264 @ 0x3a218c0] nal_unit_type: 6(SEI), nal_ref_idc: 0
 [h264 @ 0x3a218c0] nal_unit_type: 1(Coded slice of a non-IDR picture),
 nal_ref_idc: 3
 [h264 @ 0x3a218c0] ct_type:0 pic_struct:1
 [h264 @ 0x3a218c0] illegal memory management control operation 17
 [h264 @ 0x3a218c0] MBAFF frame? aye
 [h264 @ 0x3a218c0] Missing reference picture, default is 65975
 ...
 }}}
 And then you will get reference picture count/missing related errors for
 the rest of the decode.

--
Ticket URL: <https://trac.ffmpeg.org/ticket/7374>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker