mmsh seeking crashes ffmpeg

[Carl Eugen Hoyos]

Ticket #358 - seeking mmsh does not work - is reproducible again since 7b0b10c (with ffmpeg), currently crashes:

$ (gdb) r -ss 20 -i "mmsh://straumod.nrk.no/disk11/Supermorgen/2011-03-11/MSUS54000411AA-1Mbit.wmv?UseSilverlight=1" -qscale 2 out.avi
Starting program: ffmpeg_g -ss 20 -i "mmsh://straumod.nrk.no/disk11/Supermorgen/2011-03-11/MSUS54000411AA-1Mbit.wmv?UseSilverlight=1" -qscale 2 out.avi
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
ffmpeg version N-53170-g17989dc Copyright (c) 2000-2013 the FFmpeg developers
  built on May 17 2013 09:58:53 with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl --disable-indev=jack
  libavutil      52. 32.100 / 52. 32.100
  libavcodec     55.  9.100 / 55.  9.100
  libavformat    55.  7.100 / 55.  7.100
  libavdevice    55.  0.100 / 55.  0.100
  libavfilter     3. 68.101 /  3. 68.101
  libswscale      2.  3.100 /  2.  3.100
  libswresample   0. 17.102 /  0. 17.102
  libpostproc    52.  3.100 / 52.  3.100
Read data packet header failed!
Get http header data failed!
mmsh://straumod.nrk.no/disk11/Supermorgen/2011-03-11/MSUS54000411AA-1Mbit.wmv?UseSilverlight=1: could not seek to position 20.000
Guessed Channel Layout for  Input Stream #0.1 : stereo
Input #0, asf, from 'mmsh://straumod.nrk.no/disk11/Supermorgen/2011-03-11/MSUS54000411AA-1Mbit.wmv?UseSilverlight=1':
  Metadata:
    artist          : NRK
    copyright       : NRK
    WMFSDKNeeded    : 0.0.0.0000
    DeviceConformanceTemplate: L1
    WM/WMADRCPeakReference: 12325
    WM/WMADRCAverageReference: 3248
    WMFSDKVersion   : 10.00.00.4007
    IsVBR           : 0
  Duration: 00:02:37.80, start: 0.000000, bitrate: N/A
    Stream #0:0(nor): Video: wmv3 (Main) (WMV3 / 0x33564D57), yuv420p, 768x432, 896 kb/s, 25 tbr, 1k tbn, 1k tbc
    Stream #0:1(nor): Audio: wmav2 (a[1][0][0] / 0x0161), 44100 Hz, stereo, fltp, 128 kb/s
Please use -q:a or -q:v, -qscale is ambiguous
[New Thread 0x7ffff5d35700 (LWP 23405)]
[New Thread 0x7ffff5534700 (LWP 23406)]
[New Thread 0x7ffff4d33700 (LWP 23407)]
[New Thread 0x7ffff4532700 (LWP 23408)]
[New Thread 0x7ffff3d31700 (LWP 23409)]
[New Thread 0x7ffff3530700 (LWP 23410)]
[New Thread 0x7ffff2d2f700 (LWP 23411)]
[New Thread 0x7ffff252e700 (LWP 23412)]
[New Thread 0x7ffff1d2d700 (LWP 23413)]
Output #0, avi, to 'out.avi':
  Metadata:
    IART            : NRK
    ICOP            : NRK
    WMFSDKNeeded    : 0.0.0.0000
    DeviceConformanceTemplate: L1
    WM/WMADRCPeakReference: 12325
    WM/WMADRCAverageReference: 3248
    WMFSDKVersion   : 10.00.00.4007
    IsVBR           : 0
    ISFT            : Lavf55.7.100
    Stream #0:0(nor): Video: mpeg4 (FMP4 / 0x34504D46), yuv420p, 768x432, q=2-31, 200 kb/s, 25 tbn, 25 tbc
    Stream #0:1(nor): Audio: ac3 ([0] [0][0] / 0x2000), 44100 Hz, stereo, fltp, 192 kb/s
Stream mapping:
  Stream #0:0 -> #0:0 (wmv3 -> mpeg4)
  Stream #0:1 -> #0:1 (wmav2 -> ac3)
Press [q] to stop, [?] for help
[wmv3 @ 0x1693cc0] warning: first frame is no keyframe
Read data packet header failed!
Recv other type packet -5
Read data packet header failed!
Recv other type packet -5
Read data packet header failed!
Recv other type packet -5
Read data packet header failed!
Recv other type packet -5
frame=    0 fps=0.0 q=0.0 Lsize=      10kB time=00:00:00.00 bitrate=N/A dup=0 drop=2
video:0kB audio:0kB subtitle:0 global headers:0kB muxing overhead inf%
Output file is empty, nothing was encoded (check -ss / -t / -frames parameters if used)
[Thread 0x7ffff1d2d700 (LWP 23413) exited]
[Thread 0x7ffff4532700 (LWP 23408) exited]
[Thread 0x7ffff5d35700 (LWP 23405) exited]
[Thread 0x7ffff252e700 (LWP 23412) exited]
[Thread 0x7ffff3530700 (LWP 23410) exited]
[Thread 0x7ffff2d2f700 (LWP 23411) exited]
[Thread 0x7ffff3d31700 (LWP 23409) exited]
[Thread 0x7ffff5534700 (LWP 23406) exited]
[Thread 0x7ffff4d33700 (LWP 23407) exited]

Program received signal SIGSEGV, Segmentation fault.
0x0000000000bef51b in av_opt_free (obj=0x8000) at libavutil/opt.c:1195
1195    {
(gdb) bt
#0  0x0000000000bef51b in av_opt_free (obj=0x8000) at libavutil/opt.c:1195
#1  0x00000000004f4d31 in ffurl_closep (hh=0x7fffffffd998) at libavformat/avio.c:352
#2  ffurl_close (h=0x8000) at libavformat/avio.c:361
#3  0x00000000005328d2 in mmsh_close (h=<optimized out>) at libavformat/mmsh.c:69
#4  0x00000000004f4d5d in ffurl_closep (hh=0x7fffffffd9d8) at libavformat/avio.c:345
#5  ffurl_close (h=0x167bdc0) at libavformat/avio.c:361
#6  0x00000000004f980a in avio_close (s=s@entry=0x169a900) at libavformat/aviobuf.c:836
#7  0x00000000005be3fd in avformat_close_input (ps=0x1691400) at libavformat/utils.c:3360
#8  0x000000000046522b in exit_program () at ffmpeg.c:483
#9  0x00007ffff679f8b1 in __run_exit_handlers () from /lib64/libc.so.6
#10 0x00007ffff679f935 in exit () from /lib64/libc.so.6
#11 0x0000000000459dbb in main (argc=<optimized out>, argv=<optimized out>) at ffmpeg.c:3384
(gdb) disass $pc-11,$pc+32
Dump of assembler code from 0xbef510 to 0xbef53b:
   0x0000000000bef510 <av_opt_free+0>:  push   %rbp
   0x0000000000bef511 <av_opt_free+1>:  mov    %rdi,%rbp
   0x0000000000bef514 <av_opt_free+4>:  push   %rbx
   0x0000000000bef515 <av_opt_free+5>:  xor    %ebx,%ebx
   0x0000000000bef517 <av_opt_free+7>:  sub    $0x8,%rsp
=> 0x0000000000bef51b <av_opt_free+11>: mov    (%rdi),%rdx
   0x0000000000bef51e <av_opt_free+14>: xchg   %ax,%ax
   0x0000000000bef520 <av_opt_free+16>: test   %rbx,%rbx
   0x0000000000bef523 <av_opt_free+19>: je     0xbef550 <av_opt_free+64>
   0x0000000000bef525 <av_opt_free+21>: cmpq   $0x0,0x40(%rbx)
   0x0000000000bef52a <av_opt_free+26>: je     0xbef560 <av_opt_free+80>
   0x0000000000bef52c <av_opt_free+28>: add    $0x40,%rbx
   0x0000000000bef530 <av_opt_free+32>: mov    0x14(%rbx),%eax
   0x0000000000bef533 <av_opt_free+35>: and    $0xfffffffd,%eax
   0x0000000000bef536 <av_opt_free+38>: cmp    $0x5,%eax
   0x0000000000bef539 <av_opt_free+41>: jne    0xbef520 <av_opt_free+16>
End of assembler dump.
(gdb) info register
rax            0x5328c0 5449920
rbx            0x0      0
rcx            0x7fffffffd908   140737488345352
rdx            0x16933f0        23671792
rsi            0x1      1
rdi            0x8000   32768
rbp            0x8000   0x8000
rsp            0x7fffffffd970   0x7fffffffd970
r8             0xc1     193
r9             0x0      0
r10            0x0      0
r11            0x246    582
r12            0x169a900        23701760
r13            0x1691400        23663616
r14            0x167bd50        23575888
r15            0x0      0
rip            0xbef51b 0xbef51b <av_opt_free+11>
eflags         0x10202  [ IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0

[Michael Niedermayer]

Fixed in b4579a29c75e2968ede2ad002dd4a495dbfc883d