[gstreamer-bugs] [Bug 334965] New: dvdec crashes after a while

[GStreamer (bugzilla.gnome.org)]

Do not reply to this via email (we are currently unable to handle email
responses and they get discarded).  You can add comments to this bug at
http://bugzilla.gnome.org/show_bug.cgi?id=334965
 GStreamer | gst-plugins-good | Ver: HEAD CVS

           Summary: dvdec crashes after a while
           Product: GStreamer
           Version: HEAD CVS
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: sxpert at esitcom.org
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: Unspecified
   GNOME milestone: Unspecified


(you need a super long DV file for this bug to potentially appear. been having
it consistently with files longer than 50G or so)

I'm using the following pipeline to tranform the dv file into a nice
ogg/theora/vorbis file

gst-launch-0.10 -v -v \
        filesrc location=$1 ! decodebin name=demux \
        \
        demux. ! \
        queue ! ffmpegcolorspace ! 'video/x-raw-yuv,format=(fourcc)I420' ! \
        ffvideoscale ! 'video/x-raw-yuv,width=384,height=288' ! \
        queue ! theoraenc keyframe-force=8 ! mux. \
        \
        demux. ! queue ! audioconvert ! vorbisenc ! mux. \
        \
        oggmux name=mux ! filesink location=$2

this works for a while, but eventually crashes :

#0  dv_parse_ac_coeffs (seg=0xb47efda0) at bitstream.h:200
200       bs->next_word = *(uint32_t *)(bs->buf + bs->bufoffset);
(gdb) bt
#0  dv_parse_ac_coeffs (seg=0xb47efda0) at bitstream.h:200
#1  0xb5c06a36 in dv_decode_full_frame (dv=0x81afa00,
    buffer=0xb5758d80 <Address 0xb5758d80 out of bounds>,
color_space=e_dv_color_yuv, pixels=0xb47f1210,
    pitches=0xb47f1200) at dv.c:484
#2  0xb5c4b52b in gst_dvdec_chain (pad=0xb47f1140, buf=0x81c34b0) at
gstdvdec.c:341
#3  0xb7f6fd6e in gst_pad_chain (pad=0x81c5cc8, buffer=0x81c34b0) at
gstpad.c:3215
#4  0xb7f70667 in gst_pad_push (pad=0x81c5b48, buffer=0x81c34b0) at
gstpad.c:3329
#5  0xb7a7f599 in gst_queue_loop (pad=0x1) at gstqueue.c:762
#6  0xb7f859c0 in gst_task_func (task=0x81a2a98, tclass=0x81f4300) at
gsttask.c:193
#7  0xb7d3c6ab in g_thread_pool_thread_proxy (data=0x81f4390) at
gthreadpool.c:158
#8  0xb7d3a669 in g_thread_create_proxy (data=0x81ebbd0) at gthread.c:582
#9  0xb7d8c380 in start_thread () from /lib/libpthread.so.0
#10 0xb7c96d3e in clone () from /lib/libc.so.6

at this point, frame #2 has the following information :
(gdb) print dvdec->decoder
$1 = (dv_decoder_t *) 0x81afa00
(gdb) print inframe
$2 = (guint8 *) 0xb5758d80 <Address 0xb5758d80 out of bounds>
(gdb) print outframe_pitches
$3 = {1440, 288, 288}

which seems to point to a bug somewhere prior to getting into this function
(demuxer maybe).
here's the buffer passed to the function :
(gdb) print buf
$7 = (GstBuffer *) 0x81c34b0
(gdb) print *buf
$8 = {mini_object = {instance = {g_class = 0x8064638}, refcount = 1, flags = 1,
_gst_reserved = 0x0},
  data = 0xb5758d80 <Address 0xb5758d80 out of bounds>, size = 144000,
timestamp = 3737560000000,
  duration = 40000000, caps = 0x824acc0, offset = 93439, offset_end = 93440,
malloc_data = 0x0,
  _gst_reserved = {0x0, 0x0, 0x0, 0x0}}

in which the data is broken already


-- 
Configure bugmail: http://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.