[FFmpeg-trac] #7374(avcodec:new): H.264 decoder is left in broken state after a glitch and switch in input
FFmpeg
trac at avcodec.org
Wed Aug 22 12:05:24 EEST 2018
#7374: H.264 decoder is left in broken state after a glitch and switch in input
---------------------------------+---------------------------------------
Reporter: JEEB | Type: defect
Status: new | Priority: normal
Component: avcodec | Version: unspecified
Keywords: h264 | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
---------------------------------+---------------------------------------
'''Summary of the bug:'''
After what seems to be a glitch/switch in the input stream (trace_headers
notes that there's 12 H.264 packets for which the BSF couldn't be applied
to), the H.264 decoder still keeps decoding, but ultimately is left in a
state where it seems to drop references even though it wouldn't have to.
Additionally, it seems like the stream switches from MBAFF to PAFF after
the glitch, although I'm not 100% sure if I'm parsing things correctly to
note that.
A cut 10MiB sample is available @
https://kuroko.fushizen.eu/samples/2018-08-17-h264_decoder_borks.cut.ts
'''How to reproduce:'''
You can decode or play the sample with pretty much anything lavc-using. It
will be OK at first for a moment, and then have a glitch. Then after that
glitch there's seemingly OK content (if you initialize decoding after the
glitch, the decoding is OK), but the result is borked for the rest of the
clip.
{{{
% ffmpeg -v debug -i 2018-08-17-h264_decoder_borks.cut.ts -map 0:v:0 -f
null -t 10 -
... decodes fine for a while ...
timestamp discontinuity
...
[h264 @ 0x3aacbc0] reference count overflow
[h264 @ 0x3aacbc0] decode_slice_header error
[h264 @ 0x3aacbc0] no frame!
...
[h264 @ 0x3a47080] Reference 2 >= 2
[h264 @ 0x3a47080] error while decoding MB 1 0, bytestream 18674
[h264 @ 0x3bdc740] number of reference frames (0+5) exceeds max (4;
probably corrupt input), discarding one
...
[h264 @ 0x3a218c0] illegal short term buffer state detected
[h264 @ 0x3a218c0] nal_unit_type: 9(AUD), nal_ref_idc: 0
[h264 @ 0x3a218c0] nal_unit_type: 6(SEI), nal_ref_idc: 0
[h264 @ 0x3a218c0] nal_unit_type: 1(Coded slice of a non-IDR picture),
nal_ref_idc: 3
[h264 @ 0x3a218c0] ct_type:0 pic_struct:1
[h264 @ 0x3a218c0] illegal memory management control operation 17
[h264 @ 0x3a218c0] MBAFF frame? aye
[h264 @ 0x3a218c0] Missing reference picture, default is 65975
...
}}}
And then you will get reference picture count/missing related errors for
the rest of the decode.
--
Ticket URL: <https://trac.ffmpeg.org/ticket/7374>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
More information about the FFmpeg-trac
mailing list