[Bug 755102] New: qtdemux: segfault when running reverse playback validate scenario for a particular file

[GStreamer (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=755102

            Bug ID: 755102
           Summary: qtdemux: segfault when running reverse playback
                    validate scenario for a particular file
    Classification: Platform
           Product: GStreamer
           Version: unspecified
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
          Assignee: gstreamer-bugs at lists.freedesktop.org
          Reporter: vineeth.tm at samsung.com
        QA Contact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

I get a segfault when i run reverse playback scenario with a particular mp4
file.

This is the stack trace.
gst_qtdemux_seek_to_previous_keyframe (qtdemux=<optimized out>) at
qtdemux.c:3983
3983      seg_media_start_mov = seg->trak_media_start;
(gdb) bt
#0  gst_qtdemux_seek_to_previous_keyframe (qtdemux=<optimized out>) at
qtdemux.c:3983
#1  gst_qtdemux_loop (pad=0x9b9270) at qtdemux.c:5235
#2  0x00007ffff75ac451 in gst_task_func (task=0x9d75f0) at gsttask.c:331
#3  0x00007ffff702688c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007ffff7025f05 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007ffff6da2182 in start_thread (arg=0x7fffe6bd2700) at
pthread_create.c:312
#6  0x00007ffff6acf47d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111



The crash is because, segment_index is -1.

For this particular sample, in gst_qtdemux_advance_sample

  /* see if we are past the segment */
  if (G_UNLIKELY (QTSAMPLE_DTS (stream, sample) >= segment->media_stop))
    goto next_segment;

This condition gets satisfied and in next_segment label, segment_index is set
to -1.

I was able to solve the crash .. but not sure if it is really correct..

While checking if we are past the segment, >= is being checked, so even though
qtsample time is same as media_stop, we are skipping to next_segment.
Changing the check to '>' fixes the issue. We are really past the segment only
when is greater than media_stop. Not sure if >= is really needed..

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.