[Bug 666174] New: [ffdec] segfault because gst_pad_alloc_buffer_and_set_caps return a buffer with a size of 0

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=666174
  GStreamer | gst-ffmpeg | git

           Summary: [ffdec] segfault because
                    gst_pad_alloc_buffer_and_set_caps return a buffer with
                    a size of 0
    Classification: Platform
           Product: GStreamer
           Version: git
        OS/Version: All
            Status: UNCONFIRMED
          Severity: critical
          Priority: Normal
         Component: gst-ffmpeg
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: julien.isorce at gmail.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---


Created an attachment (id=203461)
 --> (https://bugzilla.gnome.org/attachment.cgi?id=203461)
flv video sample to reproduce the problem

Steps to reproduce:

 - build the attached 100 lines code test.c (gcc -Wall test.c -o test
$(pkg-config --cflags --libs gstreamer-0.10)
 - download the attached sample_small.flv file
 - run./test file:///home/julien/Videos/flv/sample_small.flv

Actual result:

Segmentation fault:

because gst_pad_alloc_buffer_and_set_caps (gstffmpegdec:line 958) return a
buffer with size of 0 but the return code is GST_FLOW_OK so alloc_output_buffer
(gstffmpegdec:line 1617) does not fail.
Finally, av_picture_copy (gstffmpegdec:line 1634) just crashes.

Other informations:

Maybe tt's similar to the recent segfault in a52dec (see:
https://bugzilla.gnome.org/show_bug.cgi?id=665989) but I think this time
gstffmpegdec is supposed to handle renegociation)

I just noticed that you can reproduce the problem using gst-launch:

gst-launch-0.10 uridecodebin
uri=file:///home/julien/Videos/flv/sample_small.flv ! "video/x-raw-yuv,
format=(fourcc)I420" ! xvimagesink

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.