[Bug 737199] New: rtph264depay seg fault with IQEye camera

Tue Sep 23 09:58:36 PDT 2014

https://bugzilla.gnome.org/show_bug.cgi?id=737199
  GStreamer | gst-plugins-good | 1.4.1

           Summary: rtph264depay seg fault with IQEye camera
    Classification: Platform
           Product: GStreamer
           Version: 1.4.1
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: jake.foytik at ipconfigure.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

Created an attachment (id=286897)
 --> (https://bugzilla.gnome.org/attachment.cgi?id=286897)
Logging for rtph264depay

Summary: Streaming H264 from an IQEye IP camera results in a Segmentation Fault
for gstreamer 1.4.1.

Details:

The following pipeline fails with an IQEye camera and gstreamer 1.4.1 :
gst-launch-1.0 rtspsrc
location="rtsp://admin:admin@192.168.103.124/rtsp/stream1" ! rtph264depay !
fakesink

However, this pipeline does work with gst-launch-0.10 (Provided in Ubuntu
14.04)

Looking at the stack trace, it appears the issue is associated with a
gst_buffer_new_and_alloc() call in gstrtph264depay.c. See stack trace below : 

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffaffff700 (LWP 32599)]
0x00007ffff75b3297 in g_slice_alloc () from
/lib/x86_64-linux-gnu/libglib-2.0.so.0
(gdb) bt
#0  0x00007ffff75b3297 in g_slice_alloc () from
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#1  0x00007ffff7ad61fe in _sysmem_new_block (flags=(unknown: 0), maxsize=68,
align=7, offset=0, size=61) at gstallocator.c:414
#2  0x00007ffff7ad65f2 in default_alloc (allocator=0x619040, size=61,
params=0x7ffff7dd8560 <defparams>) at gstallocator.c:513
#3  0x00007ffff7ad5e84 in gst_allocator_alloc (allocator=0x619040, size=61,
params=0x7ffff7dd8560 <defparams>) at gstallocator.c:311
#4  0x00007ffff7ae2a6f in gst_buffer_new_allocate (allocator=0x0, size=61,
params=0x0) at gstbuffer.c:669
#5  0x00007ffff38ef799 in gst_rtp_h264_depay_process (depayload=0x68c0e0,
buf=0x7fffc0097900) at gstrtph264depay.c:1038
#6  0x00007ffff5c6def4 in gst_rtp_base_depayload_chain (pad=0x68e140,
parent=0x68c0e0, in=0x7fffc0097900) at gstrtpbasedepayload.c:431
#7  0x00007ffff7b283ef in gst_pad_chain_data_unchecked (pad=0x68e140,
type=4112, data=0x7fffc0097900) at gstpad.c:3836
#8  0x00007ffff7b28eae in gst_pad_push_data (pad=0x7fffc00089c0, type=4112,
data=0x7fffc0097900) at gstpad.c:4069
#9  0x00007ffff7b2946e in gst_pad_push (pad=0x7fffc00089c0,
buffer=0x7fffc0097900) at gstpad.c:4180
#10 0x00007ffff7b0ddf7 in gst_proxy_pad_chain_default (pad=0x7fffec045490,
parent=0x7fffc00089c0, buffer=0x7fffc0097900) at gstghostpad.c:126
#11 0x00007ffff7b283ef in gst_pad_chain_data_unchecked (pad=0x7fffec045490,
type=4112, data=0x7fffc0097900) at gstpad.c:3836
#12 0x00007ffff7b28eae in gst_pad_push_data (pad=0x7fffc0008760, type=4112,
data=0x7fffc0097900) at gstpad.c:4069
#13 0x00007ffff7b2946e in gst_pad_push (pad=0x7fffc0008760,
buffer=0x7fffc0097900) at gstpad.c:4180
#14 0x00007ffff7b0ddf7 in gst_proxy_pad_chain_default (pad=0x7fffec045250,
parent=0x7fffc0008760, buffer=0x7fffc0097900) at gstghostpad.c:126
#15 0x00007ffff7b283ef in gst_pad_chain_data_unchecked (pad=0x7fffec045250,
type=4112, data=0x7fffc0097900) at gstpad.c:3836
#16 0x00007ffff7b28eae in gst_pad_push_data (pad=0x7fffc000ae40, type=4112,
data=0x7fffc0097900) at gstpad.c:4069
#17 0x00007ffff7b2946e in gst_pad_push (pad=0x7fffc000ae40,
buffer=0x7fffc0097900) at gstpad.c:4180
#18 0x00007ffff019e0a2 in gst_rtp_pt_demux_chain (pad=0x7fffc000a580,
parent=0x7fffec0616c0, buf=0x7fffc0097900) at gstrtpptdemux.c:442
#19 0x00007ffff7b283ef in gst_pad_chain_data_unchecked (pad=0x7fffc000a580,
type=4112, data=0x7fffc0097900) at gstpad.c:3836
#20 0x00007ffff7b28eae in gst_pad_push_data (pad=0x7fffc000a120, type=4112,
data=0x7fffc0097900) at gstpad.c:4069
#21 0x00007ffff7b2946e in gst_pad_push (pad=0x7fffc000a120,
buffer=0x7fffc0097900) at gstpad.c:4180
#22 0x00007ffff01960fb in pop_and_push_next (jitterbuffer=0x7fffbc0090d0,
seqnum=60140) at gstrtpjitterbuffer.c:2541
#23 0x00007ffff0196443 in handle_next_buffer (jitterbuffer=0x7fffbc0090d0) at
gstrtpjitterbuffer.c:2633
#24 0x00007ffff0198768 in gst_rtp_jitter_buffer_loop
(jitterbuffer=0x7fffbc0090d0) at gstrtpjitterbuffer.c:3017
#25 0x00007ffff7b5d6dd in gst_task_func (task=0x7fffec061830) at gsttask.c:317
#26 0x00007ffff7b5e7e6 in default_func (tdata=0x7fffc0004480, pool=0x61e890) at
gsttaskpool.c:68
#27 0x00007ffff75bd89c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#28 0x00007ffff75bcf15 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#29 0x00007ffff7339182 in start_thread (arg=0x7fffaffff700) at
pthread_create.c:312
#30 0x00007ffff7065fbd in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb) 

Also, before the process crashes several gstreamer critical messages are posted
:
** (gst-launch-1.0:385): CRITICAL **: gst_adapter_take_buffer: assertion
'nbytes > 0' failed

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_buffer_map_range: assertion
'GST_IS_BUFFER (buffer)' failed
0:00:00.391883630   385 0x7fffd4002540 DEBUG           rtph264depay
gstrtph264depay.c:678:gst_rtp_h264_depay_handle_nal:<rtph264depay0> handle NAL
type 8

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_buffer_get_sizes_range:
assertion 'GST_IS_BUFFER (buffer)' failed

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_buffer_copy_region: assertion
'buffer != NULL' failed

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_buffer_map_range: assertion
'GST_IS_BUFFER (buffer)' failed

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_buffer_unmap: assertion
'GST_IS_BUFFER (buffer)' failed

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_buffer_unmap: assertion
'GST_IS_BUFFER (buffer)' failed

(gst-launch-1.0:385): GStreamer-CRITICAL **: gst_mini_object_unref: assertion
'mini_object != NULL' failed

I have attached a log file that contains the output of the process with
gst-debug=rtph264depay:5.

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.