After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 703922 - The mpegpsmux plugins crashed sometimes
The mpegpsmux plugins crashed sometimes
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-bad
1.1.1
Other All
: Normal blocker
: 1.0.5
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2013-07-10 07:02 UTC by wangkun
Modified: 2013-07-15 10:59 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
the attachment fixed the bugs and stability run over one week. (1.76 KB, patch)
2013-07-10 07:02 UTC, wangkun
rejected Details | Review

Description wangkun 2013-07-10 07:02:39 UTC
Created attachment 248803 [details] [review]
the attachment fixed the bugs and stability run over one week.

title: mpegpsmux crashed sometimes

reproduce step:
run the commands for h264/ps/rtp streaming test:
gst-launch-0.10 artpecsrc bitrate=128 text="AXIS Tesing Videos:" textsize=0 textcolor=black textbgcolor=transparent ! video/x-h264,width=320,height=240,framerate=15/2 !
 cachesink async=false cachesrc ! mpegpsmux ! rtpmp2pspay pt=96 ssrc=0x12345678 ! udpsink host=192.168.77.248 port=11118
(Actually, in order to debug conveniently, I run another test program "streambin" which run the same commands by gst_parse_launch function).

bug description:
1. when run mpegpsmux plugins for real-time streaming, it might cause a crash sometimes.
2. the crash bug reproduce in all mpegpsmux version.
3. when crashed, core dump backtrace as following (sometimes):

  • #0 __GI_raise
    at ../nptl/sysdeps/unix/sysv/linux/raise.c line 67
  • #1 __GI_abort
    at abort.c line 91
  • #2 __libc_message
    at ../sysdeps/unix/sysv/linux/libc_fatal.c line 201
  • #3 malloc_printerr
  • #4 g_print
    at /home/kunwg/source/P3367/unpacked/libs/glib-IR2.32.4-4/glib/glib/gmessages.c line 1335
  • #5 psmux_stream_get_data
    at /home/kunwg/source/P3367/libs/gst-plugins-bad/gst-plugins-bad/gst/mpegpsmux/psmuxstream.c line 320
  • #6 ??

4. when crashed, program throw exception:

*** glibc detected *** ./streambin: free(): invalid next size (normal): 0x7540b4a0 ***

5. the core backtrace usual output different function call stack. 

root cause:
1. one memory buffer visit out of range.
2. when mpegpsmux initial memory buffer to store PS header, it set an  improper size.
3. so if the PS header length bigger than the initial buffer, would cause a crash due to visit undefined memory address.

solution:
1. modify the initial memory buffer to enough size to store PS header.

one optional solution like this attachment source code:
Comment 1 Sebastian Dröge (slomo) 2013-07-10 07:37:12 UTC
This doesn't seem to be a problem anymore with 1.0 and latest git. Can you confirm?
Comment 2 Sebastian Dröge (slomo) 2013-07-10 07:37:45 UTC
Comment on attachment 248803 [details] [review]
the attachment fixed the bugs and stability run over one week.

The patch is against an old version and does not apply to 1.0 or latest git anymore.
Comment 3 wangkun 2013-07-15 10:48:29 UTC
OK. Thanks! I have double checked it. the bug had fixed in 1.0.5. thanks!