Context Navigation

#371 closed defect (fixed)

Segmentation fault or get core dump when trying to use transpose/hflip/vflip on some inputs

Reported by:	x2305andy2305x	Owned by:
Priority:	important	Component:	avfilter
Version:	git-master	Keywords:	transpose, hflip, vflip
Cc:	danwax	Blocked By:
Blocking:		Reproduced by developer:	yes
Analyzed by developer:	no

Description

I am trying to transcode from quicktime to mjpeg, or from 3gp to mjpeg, but inputs are filmed with various devices and are rotated. Using transpose, hflip and vflip to correct them, along with padding, but for some 3gp sample i get Segmentation fault (core dumped) message (but file is almost entirely transcoded to mjpeg, frames missing), while for a .mov sample i get the following:

(gdb) r -y -i /downloads/RAMExports/19838260/Export_at_Fri_Jul_29_07_28_54_EDT_2011/downloads/tmpFile1311938940984Tzc6a.mov -r 25 -vcodec mjpeg -s 1280x720 -vf pad=1280:720:0:0,transpose,hflip -qscale 1 /www/movieexporter/exportMJPEG/720p/userclips/content_item_16409042_19837921.mjpeg
Starting program: /downloads/ffmpeg/ffmpeg_g -y -i /downloads/RAMExports/19838260/Export_at_Fri_Jul_29_07_28_54_EDT_2011/downloads/tmpFile1311938940984Tzc6a.mov -r 25 -vcodec mjpeg -s 1280x720 -vf pad=1280:720:0:0,transpose,hflip -qscale 1 /www/movieexporter/exportMJPEG/720p/userclips/content_item_16409042_19837921.mjpeg
[Thread debugging using libthread_db enabled]
ffmpeg version N-31684-g2dd2abe, Copyright (c) 2000-2011 the FFmpeg developers

built on Jul 29 2011 07:13:05 with gcc 4.4.5 20110214 (Red Hat 4.4.5-6)
configuration: --enable-shared --disable-static --disable-doc --disable-ffplay --disable-ffserver --enable-avfilter --enable-postproc --enable-swscale --enable-gpl --enable-nonfree --enable-runtime-cpudetect --enable-pthreads --enable-bzlib --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libfaac --enable-libgsm --enable-libmp3lame --enable-libspeex --enable-libtheora --enable-libvorbis --enable-libx264 --enable-zlib --enable-version3 --enable-libopenjpeg
libavutil 51. 11. 1 / 51. 11. 1
libavcodec 53. 9. 0 / 53. 9. 0
libavformat 53. 6. 0 / 53. 6. 0
libavdevice 53. 2. 0 / 53. 2. 0
libavfilter 2. 27. 3 / 2. 27. 3
libswscale 2. 0. 0 / 2. 0. 0
libpostproc 51. 2. 0 / 51. 2. 0

Seems stream 0 codec frame rate differs from container frame rate: 1200.00 (1200/1) -> 29.97 (30000/1001)
Input #0, mov,mp4,m4a,3gp,3g2,mj2, from '/downloads/RAMExports/19838260/Export_at_Fri_Jul_29_07_28_54_EDT_2011/downloads/tmpFile1311938940984Tzc6a.mov':

Metadata:

major_brand : qt
minor_version : 0
compatible_brands: qt
creation_time : 2011-07-11 15:38:08
encoder : 4.3.3
encoder-nob : 4.3.3
date : 2011-07-11T17:38:08+0200
date-nob : 2011-07-11T17:38:08+0200

Duration: 00:00:01.09, start: 0.000000, bitrate: 11369 kb/s

Stream #0.0(und): Video: h264 (Baseline), yuv420p, 1280x720, 11514 kb/s, 29.95 fps, 29.97 tbr, 600 tbn, 1200 tbc
Metadata:

creation_time : 2011-07-11 15:38:08

Stream #0.1(und): Audio: aac, 44100 Hz, mono, s16, 62 kb/s
Metadata:

creation_time : 2011-07-11 15:38:08

Incompatible pixel format 'yuv420p' for codec 'mjpeg', auto-selecting format 'yuvj420p'
[buffer @ 0x623a60] w:1280 h:720 pixfmt:yuv420p tb:1/1000000 sar:0/1 sws_param:
[hflip @ 0x61b780] auto-inserting filter 'auto-inserted scaler 0' between the filter 'Parsed filter 1 transpose' and the filter 'Parsed filter 2 hflip'
[pad @ 0x6281a0] w:1280 h:720 -> w:1280 h:720 x:0 y:0 color:0x108080FF[yuva]
[transpose @ 0x61b3a0] w:1280 h:720 dir:0 -> w:720 h:1280 rotation:counterclockwise vflip:1
[scale @ 0x6205c0] w:720 h:1280 fmt:yuv420p -> w:720 h:1280 fmt:yuvj420p flags:0x4
Output #0, mjpeg, to '/www/movieexporter/exportMJPEG/720p/userclips/content_item_16409042_19837921.mjpeg':

Metadata:

major_brand : qt
minor_version : 0
compatible_brands: qt
creation_time : 2011-07-11 15:38:08
date-nob : 2011-07-11T17:38:08+0200
encoder-nob : 4.3.3
date : 2011-07-11T17:38:08+0200
encoder : Lavf53.6.0
Stream #0.0(und): Video: mjpeg, yuvj420p, 720x1280, q=2-31, 200 kb/s, 90k tbn, 25 tbc
Metadata:

creation_time : 2011-07-11 15:38:08

Stream mapping:

Stream #0.0 -> #0.0

Attachments (2)

bug_vfilter_rotate_to_mjpeg.mov (1.5 MB ) - added by x2305andy2305x 13 years ago.

bug_vfilter_rotate_to_mjpeg.3gp (1.9 MB ) - added by x2305andy2305x 13 years ago.

Oldest first Newest first

Show comments Show property changes

Change History (9)

by x2305andy2305x, 13 years ago

Attachment: bug_vfilter_rotate_to_mjpeg.mov added

by x2305andy2305x, 13 years ago

Attachment: bug_vfilter_rotate_to_mjpeg.3gp added

comment:1 by x2305andy2305x, 13 years ago

Status: new → open

I'm using latest trunk version of ffmpeg.
For the segmentation fault error code, the command is this:
ffmpeg -y -i input.3gp -r 25 -vcodec mjpeg -s 720x480 -vf pad=720:480:0:0,transpose=3,hflip -qscale 1 output.mjpeg

comment:2 by Carl Eugen Hoyos, 13 years ago

Component: undetermined → avfilter

Reproduced by developer: set

Version: unspecified → git-master

(gdb) r -i tests/lena.pnm -vf transpose=3,hflip out.jpg Starting program: ffmpeg_g -i tests/lena.pnm -vf transpose=3,hflip out.jpg [Thread debugging using libthread_db enabled] [New Thread 0xb7b326c0 (LWP 23528)] ffmpeg version n0.8-749-g2dd2abe, Copyright (c) 2000-2011 the FFmpeg developers built on Jul 29 2011 15:09:21 with gcc 4.2.1 (SUSE Linux) configuration: libavutil 51. 11. 1 / 51. 11. 1 libavcodec 53. 9. 0 / 53. 9. 0 libavformat 53. 6. 0 / 53. 6. 0 libavdevice 53. 2. 0 / 53. 2. 0 libavfilter 2. 27. 3 / 2. 27. 3 libswscale 2. 0. 0 / 2. 0. 0 Input #0, image2, from 'tests/lena.pnm': Duration: 00:00:00.04, start: 0.000000, bitrate: N/A Stream #0.0: Video: ppm, rgb24, 256x256, 25 tbr, 25 tbn, 25 tbc Incompatible pixel format 'rgb24' for codec 'mjpeg', auto-selecting format 'yuvj420p' [buffer @ 0x8c99420] w:256 h:256 pixfmt:rgb24 tb:1/1000000 sar:0/1 sws_param: [hflip @ 0x8ca0cc0] auto-inserting filter 'auto-inserted scaler 0' between the filter 'Parsed filter 0 transpose' and the filter 'Parsed filter 1 hflip' [transpose @ 0x8ca08a0] w:256 h:256 dir:3 -> w:256 h:256 rotation:clockwise vflip:1 [scale @ 0x8ca67a0] w:256 h:256 fmt:rgb24 -> w:256 h:256 fmt:yuvj420p flags:0x4 Output #0, image2, to 'out.jpg': Metadata: encoder : Lavf53.6.0 Stream #0.0: Video: mjpeg, yuvj420p, 256x256, q=2-31, 200 kb/s, 90k tbn, 25 tbc Stream mapping: Stream #0.0 -> #0.0 Press [q] to stop, [?] for help Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7b326c0 (LWP 23528)] 0x0806644a in draw_slice (inlink=0x8ca6820, y=256, h=256, slice_dir=1) at libavfilter/vf_hflip.c:101 101 outrow[j] = inrow[-j]; (gdb) bt #0 0x0806644a in draw_slice (inlink=0x8ca6820, y=256, h=256, slice_dir=1) at libavfilter/vf_hflip.c:101 #1 0x08060198 in avfilter_draw_slice (link=0x8ca6820, y=256, h=256, slice_dir=1) at libavfilter/avfilter.c:589 #2 0x0806a831 in draw_slice (link=0x8ca0f40, y=0, h=256, slice_dir=1) at libavfilter/vf_scale.c:317 #3 0x08060198 in avfilter_draw_slice (link=0x8ca0f40, y=0, h=256, slice_dir=1) at libavfilter/avfilter.c:589 #4 0x0806c38b in end_frame (inlink=0x8ca0b60) at libavfilter/vf_transpose.c:193 #5 0x0805fbe7 in avfilter_end_frame (link=0x8ca0b60) at libavfilter/avfilter.c:541 #6 0x0806d227 in request_frame (link=0x8ca0b60) at libavfilter/vsrc_buffer.c:197 #7 0x08060834 in avfilter_request_frame (link=0x8ca10a0) at libavfilter/avfilter.c:478 #8 0x0806d13c in av_vsink_buffer_get_video_buffer_ref (ctx=0x8c9f2a0, picref=0x8c9a3cc, flags=0) at libavfilter/vsink_buffer.c:83 #9 0x0804e4e2 in output_packet (ist=0x8ca1ab0, ist_index=0, ost_table=0x8ca1a20, nb_ostreams=1, pkt=0xbfa9acb4) at ffmpeg.c:1733 #10 0x08056262 in transcode (output_files=0x8740100, nb_output_files=1, input_files=0x8c9f358, nb_input_files=1, stream_maps=0x0, nb_stream_maps=0) at ffmpeg.c:2819 #11 0x080573d5 in main (argc=Cannot access memory at address 0x0 ) at ffmpeg.c:4575 (gdb) disass $pc-32 $pc+32 Dump of assembler code from 0x806642a to 0x806646a: 0x0806642a <draw_slice+762>: and $0x44,%al 0x0806642c <draw_slice+764>: sar %cl,%eax 0x0806642e <draw_slice+766>: test %eax,%eax 0x08066430 <draw_slice+768>: mov %esi,0x18(%esp) 0x08066434 <draw_slice+772>: jle 0x80662b8 <draw_slice+392> 0x0806643a <draw_slice+778>: lea 0x0(%esi),%esi 0x08066440 <draw_slice+784>: movzbl (%esi),%eax 0x08066443 <draw_slice+787>: sub $0x1,%esi 0x08066446 <draw_slice+790>: mov 0x48(%esp),%edx 0x0806644a <draw_slice+794>: mov %al,-0x1(%ebx,%edx,1) 0x0806644e <draw_slice+798>: mov 0x2c(%esp),%ecx 0x08066452 <draw_slice+802>: mov %ebx,%edx 0x08066454 <draw_slice+804>: add $0x1,%ebx 0x08066457 <draw_slice+807>: mov %esi,0x18(%esp) 0x0806645b <draw_slice+811>: mov 0x18(%ecx),%edi 0x0806645e <draw_slice+814>: movzbl 0x54(%esp),%ecx 0x08066463 <draw_slice+819>: mov %edi,%eax 0x08066465 <draw_slice+821>: sar %cl,%eax 0x08066467 <draw_slice+823>: cmp %edx,%eax 0x08066469 <draw_slice+825>: jg 0x8066440 <draw_slice+784> End of assembler dump. (gdb) info registers eax 0x0 0 ecx 0x0 0 edx 0x30db4e60 819678816 ebx 0x1 1 esp 0xbfa990d0 0xbfa990d0 ebp 0x28000000 0x28000000 esi 0x8d9ccde 148491486 edi 0x100 256 eip 0x806644a 0x806644a <draw_slice+794> eflags 0x10206 [ PF IF RF ] cs 0x73 115 ss 0x7b 123 ds 0x7b 123 es 0x7b 123 fs 0x0 0 gs 0x33 51

comment:3 by Stefano Sabatini, 13 years ago

Resolution: → fixed

Status: open → closed

Fixed in commit:

commit d9c23a0d5a56488b146eef17a19a9b47643be333 Author: Stefano Sabatini <stefano.sabatini-lala@poste.it> Date: Fri Jul 29 20:19:04 2011 +0200 vf_transpose: avoid multiple calls to avfilter_draw_slice() avfilter_draw_slice() is already called in the end_frame() callback, this avoids multiple calls. This is done by adding a null draw_slice() callback. In particular fix crash occurring with -vf transpose=3,hflip, fix trac issue #371.

comment:4 by danwax, 13 years ago

Resolution: fixed

Status: closed → reopened

I'm seeing this very same issue. Only though, when I am getting a still frame. It seems also affected by -vframes (if this flag is in front of -vf, it errors everytime). It appears if you take transpose out, it's fine. I've tried putting -vf filters in [in] [out] as well.

Command is:-

ffmpeg -i /var/input/video.wmv -ss 20 -s 480x272 -vf "transpose=1,pad=854:480:291:0" -vframes 1 /var/output/still.jpg < /dev/null 2>&1
Error Report

*** glibc detected *** /usr/local/bin/ffmpeg: double free or corruption (out): 0x00007ff5d4a7b040 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x75146)[0x7ff5d4db0146] /usr/local/bin/ffmpeg[0xa48c9c] /usr/local/bin/ffmpeg[0x441241] /usr/local/bin/ffmpeg[0x443073] /lib64/libc.so.6(__libc_start_main+0xfd)[0x7ff5d4d59cdd] /usr/local/bin/ffmpeg[0x439db9] ======= Memory map: ======== 00400000-00c92000 r-xp 00000000 ca:01 26865 /usr/local/bin/ffmpeg 00e91000-00ec2000 rw-p 00891000 ca:01 26865 /usr/local/bin/ffmpeg 00ec2000-0148c000 rw-p 00000000 00:00 0 015d5000-01750000 rw-p 00000000 00:00 0 [heap] 7ff5d485c000-7ff5d4872000 r-xp 00000000 ca:01 15 /lib64/libgcc_s-4.4.5-20110214.so.1 7ff5d4872000-7ff5d4a71000 ---p 00016000 ca:01 15 /lib64/libgcc_s-4.4.5-20110214.so.1 7ff5d4a71000-7ff5d4a72000 rw-p 00015000 ca:01 15 /lib64/libgcc_s-4.4.5-20110214.so.1 7ff5d4a7a000-7ff5d4d3b000 rw-p 00000000 00:00 0 7ff5d4d3b000-7ff5d4ec1000 r-xp 00000000 ca:01 7609 /lib64/libc-2.12.so 7ff5d4ec1000-7ff5d50c0000 ---p 00186000 ca:01 7609 /lib64/libc-2.12.so 7ff5d50c0000-7ff5d50c4000 r--p 00185000 ca:01 7609 /lib64/libc-2.12.so 7ff5d50c4000-7ff5d50c5000 rw-p 00189000 ca:01 7609 /lib64/libc-2.12.so 7ff5d50c5000-7ff5d50ca000 rw-p 00000000 00:00 0 7ff5d50ca000-7ff5d50e1000 r-xp 00000000 ca:01 7633 /lib64/libpthread-2.12.so 7ff5d50e1000-7ff5d52e0000 ---p 00017000 ca:01 7633 /lib64/libpthread-2.12.so 7ff5d52e0000-7ff5d52e1000 r--p 00016000 ca:01 7633 /lib64/libpthread-2.12.so 7ff5d52e1000-7ff5d52e2000 rw-p 00017000 ca:01 7633 /lib64/libpthread-2.12.so 7ff5d52e2000-7ff5d52e6000 rw-p 00000000 00:00 0 7ff5d52e6000-7ff5d52fb000 r-xp 00000000 ca:01 7917 /lib64/libz.so.1.2.3 7ff5d52fb000-7ff5d54fa000 ---p 00015000 ca:01 7917 /lib64/libz.so.1.2.3 7ff5d54fa000-7ff5d54fb000 rw-p 00014000 ca:01 7917 /lib64/libz.so.1.2.3 7ff5d54fb000-7ff5d557e000 r-xp 00000000 ca:01 7617 /lib64/libm-2.12.so 7ff5d557e000-7ff5d577d000 ---p 00083000 ca:01 7617 /lib64/libm-2.12.so 7ff5d577d000-7ff5d577e000 r--p 00082000 ca:01 7617 /lib64/libm-2.12.so 7ff5d577e000-7ff5d577f000 rw-p 00083000 ca:01 7617 /lib64/libm-2.12.so 7ff5d577f000-7ff5d578e000 r-xp 00000000 ca:01 31502 /usr/local/lib/libfaac.so.0.0.0 7ff5d578e000-7ff5d598e000 ---p 0000f000 ca:01 31502 /usr/local/lib/libfaac.so.0.0.0 7ff5d598e000-7ff5d5991000 rw-p 0000f000 ca:01 31502 /usr/local/lib/libfaac.so.0.0.0 7ff5d5991000-7ff5d5a17000 r-xp 00000000 ca:01 14584 /usr/local/lib/libfreetype.so.6.7.2 7ff5d5a17000-7ff5d5c17000 ---p 00086000 ca:01 14584 /usr/local/lib/libfreetype.so.6.7.2 7ff5d5c17000-7ff5d5c1d000 rw-p 00086000 ca:01 14584 /usr/local/lib/libfreetype.so.6.7.2 7ff5d5c1d000-7ff5d5c76000 r-xp 00000000 ca:01 24206 /usr/local/lib/libmp3lame.so.0.0.0 7ff5d5c76000-7ff5d5e75000 ---p 00059000 ca:01 24206 /usr/local/lib/libmp3lame.so.0.0.0 7ff5d5e75000-7ff5d5e77000 rw-p 00058000 ca:01 24206 /usr/local/lib/libmp3lame.so.0.0.0 7ff5d5e77000-7ff5d5ea7000 rw-p 00000000 00:00 0 7ff5d5ea7000-7ff5d5fbb000 r-xp 00000000 ca:01 31544 /usr/local/lib/libx264.so.119 7ff5d5fbb000-7ff5d61ba000 ---p 00114000 ca:01 31544 /usr/local/lib/libx264.so.119 7ff5d61ba000-7ff5d61bd000 rw-p 00113000 ca:01 31544 /usr/local/lib/libx264.so.119 7ff5d61bd000-7ff5d61f8000 rw-p 00000000 00:00 0 7ff5d61f8000-7ff5d6218000 r-xp 00000000 ca:01 7602 /lib64/ld-2.12.so 7ff5d633e000-7ff5d639a000 rw-p 00000000 00:00 0 7ff5d6409000-7ff5d640e000 rw-p 00000000 00:00 0 7ff5d6416000-7ff5d6417000 rw-p 00000000 00:00 0 7ff5d6417000-7ff5d6418000 r--p 0001f000 ca:01 7602 /lib64/ld-2.12.so 7ff5d6418000-7ff5d6419000 rw-p 00020000 ca:01 7602 /lib64/ld-2.12.so 7ff5d6419000-7ff5d641a000 rw-p 00000000 00:00 0 7fff69c1e000-7fff69c3f000 rw-p 00000000 00:00 0 [stack] 7fff69de4000-7fff69de5000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

follow-up: 6 comment:5 by Carl Eugen Hoyos, 13 years ago

Cc: danwax added

Since both the original crash is unreproducible and your command line works fine with a random input file, please either provide some indication that this is indeed the same problem or open a new ticket (with command line, complete, uncut output including backtrace - see above and http://ffmpeg.org/bugreports.html - and a sample if necessary to reproduce).

in reply to: 5 comment:6 by danwax, 13 years ago

Replying to cehoyos:

Since both the original crash is unreproducible and your command line works fine with a random input file, please either provide some indication that this is indeed the same problem or open a new ticket (with command line, complete, uncut output including backtrace - see above and http://ffmpeg.org/bugreports.html - and a sample if necessary to reproduce).

I have opened a new ticket as you suggest, as there are dissimilar elements of the problem I have produced. Thanks cehoyos. I have cc'd you in the other ticket for ref.

comment:7 by Carl Eugen Hoyos, 13 years ago

Resolution: → fixed

Status: reopened → closed

This is now also fixed in future releases.

Note: See TracTickets for help on using tickets.

Download in other formats:

RSS Feed

Comma-delimited Text

Tab-delimited Text

Component:	undetermined → avfilter
Reproduced by developer:	set
Version:	unspecified → git-master