[Bug 727779] matroskademux: crash while seeking

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=727779
  GStreamer | gst-libav | 1.x

Tim-Philipp Müller <t.i.m> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
                 CC|                            |t.i.m at zen.co.uk
          Component|gst-plugins-good            |gst-libav
     Ever Confirmed|0                           |1
           Severity|critical                    |blocker

--- Comment #2 from Tim-Philipp Müller <t.i.m at zen.co.uk> 2014-04-09 18:28:00 UTC ---
I think that matroskademux commit just exposes a bug in gst-libav/libav and
makes it more likely to run into that when seeking.

I'm marking this as blocker for now, we should really try to fix this for
1.2.4. If we can't fix it we should revert the matroskademux commit to at least
soften the impact, so that it only happens in cornercases and not all the time.

The issue is fixed in gst-libav master which uses libav v10, for what it's
worth, this only affects the 1.2 branch with libav v9.

The problem was introduced or exposed between libav v9.10 and v9.11 by this
commit:

  commit 0e8ae6d10c609bb968c141aa2436413a55852590
  Author: Luca Barbato <lu_zero at gentoo.org>
  Date:   Tue Oct 22 19:17:10 2013 +0200

    mpegvideo: Drop a faulty assert

    That check is easily reachable by faulty input.

    CC:libav-stable at libav.org
    Reported-by: Torsten Sadowski <tsadowski at gmx.net>
    (cherry picked from commit 72072bf9de3241848ea86f68d2297b7a5d6ad49b)
    Signed-off-by: Reinhard Tartler <siretart at tauware.de>

which returns an assert on faulty input into a return AVERROR_INVALIDDATA;

I suspect by default the assert() was compiled out for releases and so didn't
trigger, and the rest of the code just coped, but now an INVALIDDATA error is
propagated, and gst-libav messes up its frame refcounting somewhere (that's my
guess anyway; I more often than not get critical assertions about
frame->refcount being > 0 which makes me think the problem is with gst-libav's
frame refcounting and not buffer handling elsewhere).

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.