[Bug 782359] New: double free or crash in gst_vpx_dec_release_buffer_cb

[GStreamer (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=782359

            Bug ID: 782359
           Summary: double free or crash in gst_vpx_dec_release_buffer_cb
    Classification: Platform
           Product: GStreamer
           Version: 1.10.4
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
          Assignee: gstreamer-bugs at lists.freedesktop.org
          Reporter: fpn at bebo.com
        QA Contact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

Running a test where we have rtp media VP9 and we have muted the video (no
frames) and bring media in again and repeat. After a while we see our gstreamer
pipeline crash in:

#0  0x00007f853c597067 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007f853c598448 in __GI_abort () at abort.c:89
#2  0x00007f853c5d51b4 in __libc_message (do_abort=do_abort at entry=1,
fmt=fmt at entry=0x7f853c6ca210 "*** Error in `%s': %s: 0x%s ***\n") at
../sysdeps/posix/libc_fatal.c:175
#3  0x00007f853c5da98e in malloc_printerr (action=1, str=0x7f853c6ca3f8 "double
free or corruption (fasttop)", ptr=<optimized out>) at malloc.c:4996
#4  0x00007f853c5db696 in _int_free (av=<optimized out>, p=<optimized out>,
have_lock=0) at malloc.c:3840
#5  0x00007f850c30dd06 in gst_vpx_dec_release_buffer_cb (priv=0x5c16,
fb=0x5f83) at gstvpxdec.c:493
#6  0x00007f84f5589b23 in ?? () from /usr/lib/x86_64-linux-gnu/libvpx.so.4
#7  0x00007f84f5578d92 in ?? () from /usr/lib/x86_64-linux-gnu/libvpx.so.4
#8  0x00007f84f546d607 in ?? () from /usr/lib/x86_64-linux-gnu/libvpx.so.4
#9  0x00007f84f5579569 in ?? () from /usr/lib/x86_64-linux-gnu/libvpx.so.4
#10 0x00007f84f557a12a in ?? () from /usr/lib/x86_64-linux-gnu/libvpx.so.4
#11 0x00007f84f53faa99 in vpx_codec_decode () from
/usr/lib/x86_64-linux-gnu/libvpx.so.4
#12 0x00007f850c30e64a in gst_vpx_dec_handle_frame (decoder=0x109d9a0,
frame=0x7f84b807f9c0) at gstvpxdec.c:676
#13 0x00007f8535c48cd6 in gst_video_decoder_decode_frame (decoder=0x109d9a0,
frame=0x7f84b807f9c0) at gstvideodecoder.c:3389
#14 0x00007f8535c4b792 in gst_video_decoder_chain_forward (decoder=0x109d9a0,
buf=0x7f84b8116670, at_eos=0) at gstvideodecoder.c:2131
#15 0x00007f8535c4be23 in gst_video_decoder_chain (pad=0x5c16,
parent=0x109d9a0, buf=0x7f84b8116670) at gstvideodecoder.c:2443
#16 0x00007f8538eb4cda in gst_pad_chain_data_unchecked (data=<optimized out>,
type=<optimized out>, pad=<optimized out>) at gstpad.c:4202
#17 gst_pad_push_data (pad=0x1087d80, type=902085424, data=0x7f84b8116670) at
gstpad.c:4454
#18 0x00007f8538ebca4e in gst_pad_push (pad=0x1087d80, buffer=0x7f84b8116670)
at gstpad.c:4573
#19 0x00007f85240b096e in gst_rtp_base_depayload_push (filter=0x1094110,
out_buf=0x7f84b8116670) at gstrtpbasedepayload.c:823
#20 0x00007f85240b0ed1 in gst_rtp_base_depayload_handle_buffer
(filter=0x1094110, in=0x7f84b807f360, bclass=<optimized out>, bclass=<optimized
out>) at gstrtpbasedepayload.c:477
#21 0x00007f8538eb4cda in gst_pad_chain_data_unchecked (data=<optimized out>,
type=<optimized out>, pad=<optimized out>) at gstpad.c:4202
#22 gst_pad_push_data (pad=0x1087900, type=604706976, data=0x7f84b807f360) at
gstpad.c:4454
#23 0x00007f8538ebca4e in gst_pad_push (pad=0x1087900, buffer=0x7f84b807f360)
at gstpad.c:4573
#24 0x00007f853632933f in gst_queue_push_one (queue=<optimized out>) at
gstqueue.c:1361
#25 gst_queue_loop (pad=0x5c16) at gstqueue.c:1508
#26 0x00007f8538ee78b1 in gst_task_func (task=0x1079ef0) at gsttask.c:334
#27 0x00007f853a070f58 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#28 0x00007f853a0705c5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#29 0x00007f853d238064 in start_thread (arg=0x7f84f4cda700) at
pthread_create.c:309
#30 0x00007f853c64a62d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.