[FFmpeg-trac] #1022(avformat:open): "Glibc detected corrupted double-linked list" when copying rtsp stream.

FFmpeg trac at avcodec.org
Sat Mar 24 10:11:58 CET 2012


#1022: "Glibc detected corrupted double-linked list" when copying rtsp stream.
------------------------------------+------------------------------------
             Reporter:  vk5ztv      |                    Owner:  michael
                 Type:  defect      |                   Status:  open
             Priority:  important   |                Component:  avformat
              Version:  git-master  |               Resolution:
             Keywords:  rm          |               Blocked By:
             Blocking:              |  Reproduced by developer:  1
Analyzed by developer:  0           |
------------------------------------+------------------------------------
Changes (by cehoyos):

 * keywords:   => rm
 * status:  new => open
 * component:  undetermined => avformat
 * reproduced:  0 => 1


Comment:

 samples.mplayerhq.hu/real/real-bug/no_play/spear.rm

 Crashes badly without valgrind.
 {{{
 $ valgrind ./ffmpeg_g -i spear.rm -acodec copy -vcodec copy -map 0:3 -map
 0:4 -map 0:5 out.rm
 ==16544== Memcheck, a memory error detector.
 ==16544== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
 ==16544== Using LibVEX rev 1732, a library for dynamic binary translation.
 ==16544== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
 ==16544== Using valgrind-3.2.3, a dynamic binary instrumentation
 framework.
 ==16544== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
 ==16544== For more details, rerun with: -v
 ==16544==
 ffmpeg version N-39200-gb222c28 Copyright (c) 2000-2012 the FFmpeg
 developers
   built on Mar 24 2012 08:09:50 with gcc 4.3.2
   configuration: --cc=/usr/local/gcc-4.3.2/bin/gcc --enable-gpl
   libavutil      51. 44.100 / 51. 44.100
   libavcodec     54. 12.100 / 54. 12.100
   libavformat    54.  2.100 / 54.  2.100
   libavdevice    53.  4.100 / 53.  4.100
   libavfilter     2. 65.102 /  2. 65.102
   libswscale      2.  1.100 /  2.  1.100
   libswresample   0.  7.100 /  0.  7.100
   libpostproc    52.  0.100 / 52.  0.100
 [rm @ 0x440ab40] Unsupported stream type 000001a3
 [rm @ 0x440ab40] Unsupported stream type 00000431
 [rm @ 0x440ab40] Unsupported stream type 00000362
 [rm @ 0x440ab40] max_analyze_duration 5000000 reached at 5000000
 Input #0, rm, from 'spear.rm':
   Metadata:
     title           : Spear
     author          :
     copyright       : 2512000
     comment         :
   Duration: 00:00:11.14, start: 0.000000, bitrate: 916 kb/s
     Stream #0:0: Data: none
     Stream #0:1: Data: none
     Stream #0:2: Data: none
     Stream #0:3: Audio: cook (cook / 0x6B6F6F63), 22050 Hz, mono, flt, 32
 kb/s
     Stream #0:4: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 317
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
     Stream #0:5: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 230
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
     Stream #0:6: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 68
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
     Stream #0:7: Audio: cook (cook / 0x6B6F6F63), 22050 Hz, mono, flt, 32
 kb/s
     Stream #0:8: Audio: cook (cook / 0x6B6F6F63), 22050 Hz, mono, flt, 32
 kb/s
     Stream #0:9: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 317
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
     Stream #0:10: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 317
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
     Stream #0:11: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 317
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
     Stream #0:12: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240, 68
 kb/s, 30 fps, 30 tbr, 1k tbn, 1k tbc
 ==16544== Invalid write of size 4
 ==16544==    at 0x815A08A: rm_write_header (rmenc.c:316)
 ==16544==  Address 0x47C0074 is 0 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid write of size 4
 ==16544==    at 0x815A094: rm_write_header (rmenc.c:317)
 ==16544==  Address 0x47C0084 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid write of size 4
 ==16544==    at 0x815A09A: rm_write_header (rmenc.c:319)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid write of size 4
 ==16544==    at 0x815A09D: rm_write_header (rmenc.c:318)
 ==16544==  Address 0x47C0074 is 0 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid write of size 4
 ==16544==    at 0x815A0BD: rm_write_header (rmenc.c:336)
 ==16544==  Address 0x47C0080 is 12 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid write of size 4
 ==16544==    at 0x815A0CC: rm_write_header (rmenc.c:332)
 ==16544==  Address 0x47C0078 is 4 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159445: rv10_write_header (rmenc.c:95)
 ==16544==  Address 0x47C0074 is 0 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159466: rv10_write_header (rmenc.c:99)
 ==16544==  Address 0x47C0080 is 12 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159472: rv10_write_header (rmenc.c:99)
 ==16544==  Address 0x47C0078 is 4 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x815975B: rv10_write_header (rmenc.c:146)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x81597F1: rv10_write_header (rmenc.c:162)
 ==16544==  Address 0x47C0074 is 0 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159808: rv10_write_header (rmenc.c:163)
 ==16544==  Address 0x47C0074 is 0 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159888: rv10_write_header (rmenc.c:174)
 ==16544==  Address 0x47C0080 is 12 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x815990F: rv10_write_header (rmenc.c:182)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159963: rv10_write_header (rmenc.c:245)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x81599B5: rv10_write_header (rmenc.c:249)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x81599C7: rv10_write_header (rmenc.c:250)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x81599DC: rv10_write_header (rmenc.c:251)
 ==16544==  Address 0x47C0078 is 4 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159A13: rv10_write_header (rmenc.c:253)
 ==16544==  Address 0x47C0078 is 4 bytes after a block of size 84 alloc'd
 ==16544==    at 0x4021A50: memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x4021AAA: posix_memalign (in
 /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
 ==16544==    by 0x87C1E4F: av_mallocz (mem.c:94)
 ==16544==    by 0x63: ???
 ==16544==
 ==16544== Invalid read of size 4
 ==16544==    at 0x8159A5A: rv10_write_header (rmenc.c:259)
 ==16544==  Address 0x47C0088 is not stack'd, malloc'd or (recently) free'd
 Output #0, rm, to 'out.rm':
   Metadata:
     title           : Spear
     author          :
     copyright       : 2512000
     comment         :
     encoder         : Lavf54.2.100
     Stream #0:0: Audio: cook (cook / 0x6B6F6F63), 22050 Hz, mono, 32 kb/s
     Stream #0:1: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240,
 q=2-31, 317 kb/s, 30 fps, 90k tbn, 1k tbc
     Stream #0:2: Video: rv30 (RV30 / 0x30335652), yuv420p, 320x240,
 q=2-31, 230 kb/s, 30 fps, 90k tbn, 1k tbc
 Stream mapping:
   Stream #0:3 -> #0:0 (copy)
   Stream #0:4 -> #0:1 (copy)
   Stream #0:5 -> #0:2 (copy)
 Press [q] to stop, [?] for help
 [rm @ 0x440ab40] DATA tag in middle of chunk, file may be broken.
 ==16544== Warning: set address range perms: large range 177522203
 (undefined)
 ==16544== Warning: set address range perms: large range 177522235
 (noaccess)
 ==16544== Warning: set address range perms: large range 242554107
 (undefined)
 ==16544== Warning: set address range perms: large range 242554139
 (noaccess)
 [rm @ 0x47bfae0] pts < dts in stream 1
 av_interleaved_write_frame(): Invalid argument
 ==16544==
 ==16544== ERROR SUMMARY: 25 errors from 20 contexts (suppressed: 3 from 1)
 ==16544== malloc/free: in use at exit: 12,867 bytes in 8 blocks.
 ==16544== malloc/free: 2,271 allocs, 2,263 frees, 424,122,066 bytes
 allocated.
 ==16544== For counts of detected errors, rerun with: -v
 ==16544== searching for pointers to 8 not-freed blocks.
 ==16544== checked 6,285,892 bytes.
 ==16544==
 ==16544== LEAK SUMMARY:
 ==16544==    definitely lost: 1,746 bytes in 6 blocks.
 ==16544==      possibly lost: 0 bytes in 0 blocks.
 ==16544==    still reachable: 11,121 bytes in 2 blocks.
 ==16544==         suppressed: 0 bytes in 0 blocks.
 ==16544== Rerun with --leak-check=full to see details of leaked memory.
 }}}

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/1022#comment:10>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker


More information about the FFmpeg-trac mailing list