Crash during playback of real audio over rtsp

[eleventeen]

Configure:
./configure --disable-yasm --enable-debug

How to reproduce:
./ffplay_g rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra

Dump:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffedd6f700 (LWP 17885)]
avio_r8 (s=0x0) at libavformat/aviobuf.c:471
471 if (s->buf_ptr >= s->buf_end)

[Carl Eugen Hoyos]

Does it only crash with ffplay or also with ffmpeg ?

To make this a valid ticket, please provide the crashing command line together with the complete, uncut console output and please add the missing gdb information, see ​http://ffmpeg.org/bugreports.html

[eleventeen]

./ffmpeg_g -v 9 -loglevel 99 -i rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra
ffmpeg version 1.1.git Copyright (c) 2000-2013 the FFmpeg developers

built on May 19 2013 12:16:24 with gcc 4.6 (Ubuntu/Linaro 4.6.3-1ubuntu5)
configuration: --disable-yasm --enable-debug
libavutil 52. 33.100 / 52. 33.100
libavcodec 55. 10.101 / 55. 10.101
libavformat 55. 7.100 / 55. 7.100
libavdevice 55. 0.100 / 55. 0.100
libavfilter 3. 68.101 / 3. 68.101
libswscale 2. 3.100 / 2. 3.100
libswresample 0. 17.102 / 0. 17.102

Splitting the commandline.
Reading option '-v' ... matched as option 'v' (set logging level) with argument '9'.
Reading option '-loglevel' ... matched as option 'loglevel' (set logging level) with argument '99'.
Reading option '-i' ... matched as input file with argument 'rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra'.
Finished splitting the commandline.
Parsing a group of options: global .
Applying option v (set logging level) with argument 9.
Successfully parsed a group of options.
Parsing a group of options: input file rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra.
Successfully parsed a group of options.
Opening an input file: rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra.
[rtsp @ 0x1d12060] SDP:
v=0
o=- 1049958193 1049958193 IN IP4 204.93.222.92
s=A Prairie Home Companion
i=Garrison Keillor & Minnesota Public Radio 1997
c=IN IP4 0.0.0.0
t=0 0
a=SdpplinVersion:1610641560
a=StreamCount:integer;1
a=control:*
a=IsRealDataType:integer;1
a=Title:buffer;"QSBQcmFpcmllIEhvbWUgQ29tcGFuaW9uAA=="
a=Author:buffer;"R2Fycmlzb24gS2VpbGxvciAmIE1pbm5lc290YSBQdWJsaWMgUmFkaW8A"
a=Copyright:buffer;"MTk5NwA="
a=range:npt=0-16.960000
m=audio 0 RTP/AVP 101
b=AS:8
b=RR:299
b=RS:100
a=control:streamid=0
a=range:npt=0-16.960000
a=length:npt=16.960000
a=rtpmap:101 x-pn-realaudio/1000
a=fmtp:101
a=mimetype:string;"audio/x-pn-realaudio"
a=Helix-Adaptation-Support:1
a=MaxBitRate:integer;8000
a=AvgBitRate:integer;8000
a=MaxPacketSize:integer;240
a=AvgPacketSize:integer;240
a=StartTime:integer;0
a=Preroll:integer;5760
a=Predata:integer;5760
a=PreDataAtStart:integer;1
a=PreDataAfterSeek:integer;1
a=EndOneRuleEndAll:integer;1
a=OpaqueData:buffer;"LnJh/QADAF0AAQAAABQAAOpgAABCQBhBIFByYWlyaWUgSG9audio codec set to: (null)
[rtsp @ 0x1d12060] audio samplerate set to: 1000
[rtsp @ 0x1d12060] audio channels set to: 1
Segmentation fault (core dumped)

[Carl Eugen Hoyos]

For future crash reports: Please always provide all the information requested on ​http://ffmpeg.org/bugreports.html

(gdb) r -i rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra
Starting program: ffmpeg_g -i rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
ffmpeg version N-53274-g73b9f31 Copyright (c) 2000-2013 the FFmpeg developers
  built on May 19 2013 19:14:12 with gcc 4.7 (SUSE Linux)
  configuration: --enable-gpl --disable-indev=jack
  libavutil      52. 33.100 / 52. 33.100
  libavcodec     55. 10.101 / 55. 10.101
  libavformat    55.  7.100 / 55.  7.100
  libavdevice    55.  0.100 / 55.  0.100
  libavfilter     3. 68.101 /  3. 68.101
  libswscale      2.  3.100 /  2.  3.100
  libswresample   0. 17.102 /  0. 17.102
  libpostproc    52.  3.100 / 52.  3.100

Program received signal SIGSEGV, Segmentation fault.
avio_r8 (s=0x0) at libavformat/aviobuf.c:471
471         if (s->buf_ptr >= s->buf_end)
(gdb) bt
#0  avio_r8 (s=0x0) at libavformat/aviobuf.c:471
#1  0x000000000057e6d1 in rm_read_metadata (s=0x1680b60, wide=<optimized out>)
    at libavformat/rmdec.c:103
#2  rm_read_audio_stream_info (s=0x1680b60, s@entry=0x16804e0,
    pb=pb@entry=0x7fffffff5420, ast=ast@entry=0x1680b60, read_all=60000,
    read_all@entry=0, st=0x167dca0, st=0x167dca0) at libavformat/rmdec.c:137
#3  0x000000000057ef4e in ff_rm_read_mdpr_codecdata (s=0x16804e0,
    pb=pb@entry=0x7fffffff5420, st=st@entry=0x167dca0, rst=0x1680b60,
    codec_data_size=codec_data_size@entry=102, mime=mime@entry=0x0)
    at libavformat/rmdec.c:316
#4  0x000000000057b41d in rdt_load_mdpr (rule_nr=0, st=0x167dca0, rdt=0x167e480)
    at libavformat/rdt.c:179
#5  rdt_parse_sdp_line (s=0x1679020, st_index=<optimized out>, rdt=0x167e480,
    line=<optimized out>) at libavformat/rdt.c:434
#6  0x0000000000596dec in sdp_parse_line (
    buf=0x7fffffff57b0 "ASMRuleBook:string;\"priority=5,averagebandwidth=8000,PNMKeyFrameRule=T;priority=5,averagebandwidth=0,PNMNonKeyFrameRule=T;\"",
    letter=<optimized out>, s1=0x7fffffff5620, s=0x1679020) at libavformat/rtsp.c:511
#7  ff_sdp_parse (s=s@entry=0x1679020, content=<optimized out>)
    at libavformat/rtsp.c:554
#8  0x000000000059df06 in ff_rtsp_setup_input_streams (s=s@entry=0x1679020,
    reply=reply@entry=0x7fffffffb9c0) at libavformat/rtspdec.c:596
#9  0x000000000059ae5d in ff_rtsp_connect (s=0x1679020) at libavformat/rtsp.c:1675
#10 0x000000000059d4cd in rtsp_read_header (s=0x1679020) at libavformat/rtspdec.c:689
#11 0x00000000005c0b7f in avformat_open_input (ps=ps@entry=0x7fffffffd610,
    filename=filename@entry=0x7fffffffe272 "rtsp://mprrm.publicradio.org/5559/phc/970322/970322_logo.ra", fmt=fmt@entry=0x0, options=0x1671708) at libavformat/utils.c:668
#12 0x0000000000461609 in open_input_file (o=o@entry=0x7fffffffd750,
    filename=<optimized out>) at ffmpeg_opt.c:797
#13 0x000000000045c232 in open_files (inout=<optimized out>,
    inout@entry=0xc5c6bf "input",
    open_file=open_file@entry=0x461390 <open_input_file>, l=<optimized out>,
    l=<optimized out>) at ffmpeg_opt.c:2483
#14 0x0000000000462ac9 in ffmpeg_parse_options (argc=argc@entry=3,
    argv=argv@entry=0x7fffffffdde8) at ffmpeg_opt.c:2520
#15 0x0000000000459d78 in main (argc=3, argv=0x7fffffffdde8) at ffmpeg.c:3351
(gdb) disass $pc,$pc+32
Dump of assembler code from 0x4f8370 to 0x4f8390:
=> 0x00000000004f8370 <avio_r8+0>:      mov    0x18(%rdi),%rdx
   0x00000000004f8374 <avio_r8+4>:      cmp    0x20(%rdi),%rdx
   0x00000000004f8378 <avio_r8+8>:      push   %rbx
   0x00000000004f8379 <avio_r8+9>:      mov    %rdi,%rbx
   0x00000000004f837c <avio_r8+12>:     jae    0x4f8390 <avio_r8+32>
   0x00000000004f837e <avio_r8+14>:     movzbl (%rdx),%eax
   0x00000000004f8381 <avio_r8+17>:     add    $0x1,%rdx
   0x00000000004f8385 <avio_r8+21>:     mov    %rdx,0x18(%rbx)
   0x00000000004f8389 <avio_r8+25>:     pop    %rbx
   0x00000000004f838a <avio_r8+26>:     retq
   0x00000000004f838b <avio_r8+27>:     nopl   0x0(%rax,%rax,1)
End of assembler dump.
(gdb) info register
rax            0x7fffffff4e30   140737488309808
rbx            0x7fffffff5420   140737488311328
rcx            0x66     102
rdx            0x1680978        23595384
rsi            0x0      0
rdi            0x0      0
rbp            0x167dca0        0x167dca0
rsp            0x7fffffff4ce8   0x7fffffff4ce8
r8             0x1680b60        23595872
r9             0x0      0
r10            0x0      0
r11            0x0      0
r12            0x3      3
r13            0xc67700 13006592
r14            0x16804e0        23594208
r15            0x1680b60        23595872
rip            0x4f8370 0x4f8370 <avio_r8>
eflags         0x10206  [ PF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0

[Michael Niedermayer]

Fixed in bf87908cd8da31e8f8fe75c06577170928ea70a8