Opened 9 years ago
Closed 9 years ago
#4856 closed defect (fixed)
Crash in swscale when resizing to rgb24
Reported by: | rxt | Owned by: | |
---|---|---|---|
Priority: | important | Component: | swscale |
Version: | git-master | Keywords: | crash SIGSEGV regression |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description (last modified by )
Summary of the bug:
Segmentation fault within swscale when resizing to rgb24.
Happens only for some values of destination height (eg. 1079 to 1088 ok, 1089 to 1102 not ok), so seems related to buffer alignment (align to 16).
Component undetermined, probably swscale but could also be ffmpeg.
How to reproduce:
% ffmpeg -f rawvideo -s 1920x1080 -i /dev/zero -dsth 1096 -pix_fmt rgb24 -f null /dev/null ffmpeg version N-74636-g164cd9b Copyright (c) 2000-2015 the FFmpeg developers built with gcc 4.9.2 (Debian 4.9.2-10) configuration: --enable-gpl --enable-postproc --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-nonfree --enable-version3 --enable-libmp3lame --samples=fate-suite/ libavutil 55. 2.100 / 55. 2.100 libavcodec 57. 2.100 / 57. 2.100 libavformat 57. 2.100 / 57. 2.100 libavdevice 57. 0.100 / 57. 0.100 libavfilter 6. 4.100 / 6. 4.100 libswscale 4. 0.100 / 4. 0.100 libswresample 2. 0.100 / 2. 0.100 libpostproc 54. 0.100 / 54. 0.100 Input #0, rawvideo, from '/dev/zero': Duration: N/A, start: 0.000000, bitrate: 622080 kb/s Stream #0:0: Video: rawvideo (I420 / 0x30323449), yuv420p, 1920x1080, 622080 kb/s, 25 tbr, 25 tbn, 25 tbc Output #0, null, to '/dev/null': Metadata: encoder : Lavf57.2.100 Stream #0:0: Video: rawvideo (RGB[24] / 0x18424752), rgb24, 1920x1080, q=2-31, 200 kb/s, 25 fps, 25 tbn, 25 tbc Metadata: encoder : Lavc57.2.100 rawvideo Stream mapping: Stream #0:0 -> #0:0 (rawvideo (native) -> rawvideo (native)) Press [q] to stop, [?] for help Errore di segmentazione
gdb
Starting program: /usr/local/src/ffmpeg/ffmpeg_g -f rawvideo -s 1920x1080 -i /dev/zero -dsth 1096 -pix_fmt rgb24 -f null /dev/null [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". ffmpeg version N-74636-g164cd9b Copyright (c) 2000-2015 the FFmpeg developers built with gcc 4.9.2 (Debian 4.9.2-10) configuration: --enable-gpl --enable-postproc --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-nonfree --enable-version3 --enable-libmp3lame --samples=fate-suite/ libavutil 55. 2.100 / 55. 2.100 libavcodec 57. 2.100 / 57. 2.100 libavformat 57. 2.100 / 57. 2.100 libavdevice 57. 0.100 / 57. 0.100 libavfilter 6. 4.100 / 6. 4.100 libswscale 4. 0.100 / 4. 0.100 libswresample 2. 0.100 / 2. 0.100 libpostproc 54. 0.100 / 54. 0.100 Input #0, rawvideo, from '/dev/zero': Duration: N/A, start: 0.000000, bitrate: 622080 kb/s Stream #0:0: Video: rawvideo (I420 / 0x30323449), yuv420p, 1920x1080, 622080 kb/s, 25 tbr, 25 tbn, 25 tbc [New Thread 0x7ffff4668700 (LWP 24144)] [New Thread 0x7ffff3e67700 (LWP 24145)] [New Thread 0x7ffff3666700 (LWP 24146)] [New Thread 0x7ffff2e65700 (LWP 24147)] [New Thread 0x7ffff2664700 (LWP 24148)] [New Thread 0x7ffff1e63700 (LWP 24149)] [New Thread 0x7ffff1662700 (LWP 24150)] [New Thread 0x7ffff0e61700 (LWP 24151)] [New Thread 0x7ffff0660700 (LWP 24152)] Output #0, null, to '/dev/null': Metadata: encoder : Lavf57.2.100 Stream #0:0: Video: rawvideo (RGB[24] / 0x18424752), rgb24, 1920x1080, q=2-31, 200 kb/s, 25 fps, 25 tbn, 25 tbc Metadata: encoder : Lavc57.2.100 rawvideo Stream mapping: Stream #0:0 -> #0:0 (rawvideo (native) -> rawvideo (native)) Press [q] to stop, [?] for help Program received signal SIGSEGV, Segmentation fault. 0x0000000000de6ae7 in yuv2rgb_write (hasAlpha=0, target=AV_PIX_FMT_RGB24, y=1088, _b=0x1baad89, _g=0x1baaeec, _r=0x1baadb7, A2=0, A1=0, Y2=<optimized out>, Y1=<optimized out>, i=<optimized out>, _dest=0x7fffefe5f040 "") at libswscale/output.c:1246 1246 dest[i * 6 + 0] = r_b[Y1];
Backtrace
#0 0x0000000000de6ae7 in yuv2rgb_write (hasAlpha=0, target=AV_PIX_FMT_RGB24, y=1088, _b=0x1baad89, _g=0x1baaeec, _r=0x1baadb7, A2=0, A1=0, Y2=<optimized out>, Y1=<optimized out>, i=<optimized out>, _dest=0x7fffefe5f040 "") at libswscale/output.c:1246 #1 yuv2rgb_X_c_template (hasAlpha=0, target=AV_PIX_FMT_RGB24, y=1088, dstW=1920, dest=0x7fffefe5f040 "", alpSrc=0x0, chrFilterSize=4, chrVSrc=0x1b64190, chrUSrc=0x1b6edd0, chrFilter=0x1b6ad60, lumFilterSize=4, lumSrc=0x1b6ecb8, lumFilter=0x1b640e0, c=<optimized out>) at libswscale/output.c:1370 #2 yuv2rgb24_X_c (c=0x1ba4260, lumFilter=0x1b640e0, lumSrc=0x1b6ecb8, lumFilterSize=4, chrFilter=0x1b6ad60, chrUSrc=0x1b6edd0, chrVSrc=0x1b64190, chrFilterSize=4, alpSrc=0x0, dest=0x7fffefe5f040 "", dstW=1920, y=1088) at libswscale/output.c:1515 #3 0x0000000000dcb61e in packed_vscale (c=<optimized out>, desc=<optimized out>, sliceY=1088, sliceH=<optimized out>) at libswscale/vscale.c:129 #4 0x0000000000dc6dc1 in swscale (c=0x1b4b1c0, src=0x1baaeec, srcStride=0x0, srcSliceY=28618424, srcSliceH=28618384, dst=0x1b6edd0, dstStride=0x7fffffffd6d0) at libswscale/swscale.c:682 #5 0x0000000000dc814a in sws_scale (c=0x1b4b1c0, srcSlice=0x7fffffffd6e0, srcStride=0x1b6ecb8, srcSliceY=4, srcSliceH=28749152, dst=0x7fffffffd700, dstStride=0x7fffffffd7b0) at libswscale/swscale.c:1263 #6 0x000000000050a5c8 in scale_slice (y=<optimized out>, link=<optimized out>, field=<optimized out>, mul=<optimized out>, h=<optimized out>, sws=<optimized out>, cur_pic=<optimized out>, out_buf=<optimized out>) at libavfilter/vf_scale.c:477 #7 filter_frame (link=0x1b4a740, in=0x1b61c00) at libavfilter/vf_scale.c:579 #8 0x000000000049f71f in ff_filter_frame_framed (link=0x1b4a740, frame=0x1b61c00) at libavfilter/avfilter.c:1089 #9 0x00000000004a17d9 in ff_filter_frame (link=0x1b4a740, frame=0x1b61c00) at libavfilter/avfilter.c:1173 #10 0x000000000049f71f in ff_filter_frame_framed (link=0x1b4a1c0, frame=0x1b61c00) at libavfilter/avfilter.c:1089 #11 0x00000000004a17d9 in ff_filter_frame (link=0x1b4a1c0, frame=0x1b61c00) at libavfilter/avfilter.c:1173 #12 0x00000000004a58e2 in request_frame (link=0x1b4a1c0) at libavfilter/buffersrc.c:378 #13 0x00000000004a5614 in av_buffersrc_add_frame_internal ( ctx=ctx@entry=0x1b48680, frame=frame@entry=0x1b616e0, flags=flags@entry=4) at libavfilter/buffersrc.c:180 #14 0x00000000004a5b0d in av_buffersrc_add_frame_flags (ctx=0x1b48680, frame=frame@entry=0x1b616e0, flags=flags@entry=4) at libavfilter/buffersrc.c:105 #15 0x0000000000487572 in decode_video (ist=0x1b46bc0, pkt=<optimized out>, got_output=<optimized out>) at ffmpeg.c:2179 #16 0x00000000004718d3 in process_input_packet (pkt=<optimized out>, ist=<optimized out>) at ffmpeg.c:2327 #17 process_input (file_index=<optimized out>) at ffmpeg.c:3833 #18 transcode_step () at ffmpeg.c:3921 #19 transcode () at ffmpeg.c:3974 #20 main (argc=28601280, argv=0x7fffffffdff0) at ffmpeg.c:4157
Disassembly
Dump of assembler code from 0xde6ac7 to 0xde6b07: 0x0000000000de6ac7 <yuv2rgb24_X_c+311>: movslq (%r10,%r11,4),%r10 0x0000000000de6acb <yuv2rgb24_X_c+315>: mov -0x20(%rsp),%r15 0x0000000000de6ad0 <yuv2rgb24_X_c+320>: add 0x2e00(%rdi),%r10 0x0000000000de6ad7 <yuv2rgb24_X_c+327>: mov 0x4600(%rdi),%rdi 0x0000000000de6ade <yuv2rgb24_X_c+334>: movzbl (%rax,%r14,1),%r11d 0x0000000000de6ae3 <yuv2rgb24_X_c+339>: add $0x6,%r15 => 0x0000000000de6ae7 <yuv2rgb24_X_c+343>: mov %r11b,-0x6(%r15) 0x0000000000de6aeb <yuv2rgb24_X_c+347>: movzbl (%r10,%r14,1),%r11d 0x0000000000de6af0 <yuv2rgb24_X_c+352>: mov %r11b,-0x5(%r15) 0x0000000000de6af4 <yuv2rgb24_X_c+356>: movzbl (%rdi,%r14,1),%r11d 0x0000000000de6af9 <yuv2rgb24_X_c+361>: mov %r11b,-0x4(%r15) 0x0000000000de6afd <yuv2rgb24_X_c+365>: movzbl (%rax,%rbx,1),%eax 0x0000000000de6b01 <yuv2rgb24_X_c+369>: mov %al,-0x3(%r15) 0x0000000000de6b05 <yuv2rgb24_X_c+373>: movzbl (%r10,%rbx,1),%eax
Registers
rax 0x1baadb7 29011383 rbx 0x0 0 rcx 0x4 4 rdx 0x1b6ecb8 28765368 rsi 0x1b640e0 28721376 rdi 0x1baad89 29011337 rbp 0x542 0x542 rsp 0x7fffffffd3e8 0x7fffffffd3e8 r8 0x1b6ad60 28749152 r9 0x1b6edd0 28765648 r10 0x1baaeec 29011692 r11 0x0 0 r12 0xa84 2692 r13 0x1b64190 28721552 r14 0x0 0 r15 0x7fffefe60006 140737218215942 rip 0xde6ae7 0xde6ae7 <yuv2rgb24_X_c+343> eflags 0x10206 [ PF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 st0 0 (raw 0x00000000000000000000) st1 0 (raw 0x00000000000000000000) st2 0 (raw 0x00000000000000000000) st3 0 (raw 0x00000000000000000000) st4 0 (raw 0x00000000000000000000) st5 0 (raw 0x00000000000000000000) st6 0 (raw 0x00000000000000000000) st7 0 (raw 0x00000000000000000000) fctrl 0x37f 895 fstat 0x0 0 ftag 0xffff 65535 fiseg 0x0 0 fioff 0x0 0 foseg 0x0 0 fooff 0x0 0 fop 0x0 0 mxcsr 0x1fa8 [ OE PE IM DM ZM OM UM PM ] ymm0 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm1 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm2 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x8000000000000000, 0x8000000000000000, 0x0, 0x0}, v32_int8 = { 0x6d <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x6d6d, 0x6d6d, 0x6d6d, 0x6d6d, 0x6d6d, 0x6d6d, 0x6d6d, 0x6d6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x6d6d6d6d, 0x6d6d6d6d, 0x6d6d6d6d, 0x6d6d6d6d, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x6d6d6d6d6d6d6d6d, 0x6d6d6d6d6d6d6d6d, 0x0, 0x0}, v2_int128 = { 0x6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d, 0x00000000000000000000000000000000}} ymm3 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm4 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm5 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm6 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x8000000000000000, 0x8000000000000000, 0x0, 0x0}, v32_int8 = { 0x0, 0x0, 0x0, 0x0, 0xff <repeats 12 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x0, 0x0, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x0, 0xffffffff, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0x0}, v4_int64 = { 0xffffffff00000000, 0xffffffffffffffff, 0x0, 0x0}, v2_int128 = { 0xffffffffffffffffffffffff00000000, 0x00000000000000000000000000000000}} ymm7 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm8 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm9 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm10 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x8000000000000000, 0x8000000000000000, 0x0, 0x0}, v32_int8 = { 0x0, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff, 0xff, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0 <repeats 16 times>}, v16_int16 = {0x0, 0x0, 0xffff, 0xffff, 0x0, 0xff00, 0xffff, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x0, 0xffffffff, 0xff000000, 0xffffffff, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0xffffffff00000000, 0xffffffffff000000, 0x0, 0x0}, v2_int128 = {0xffffffffff000000ffffffff00000000, 0x00000000000000000000000000000000}} ymm11 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x8000000000000000, 0x8000000000000000, 0x0, 0x0}, v32_int8 = { 0x0, 0x0, 0x0, 0x0, 0xff <repeats 12 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x0, 0x0, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x0, 0xffffffff, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0x0}, v4_int64 = { 0xffffffff00000000, 0xffffffffffffffff, 0x0, 0x0}, v2_int128 = { 0xffffffffffffffffffffffff00000000, 0x00000000000000000000000000000000}} ymm12 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, ---Type <return> to continue, or q <return> to quit--- v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = { 0x00000000000000000000000000000000, 0x00000000000000000000000000000000}} ymm13 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x59, 0xbc, 0x0 <repeats 24 times>}, v16_int16 = {0x0, 0x0, 0x8000, 0xbc59, 0x0 <repeats 12 times>}, v8_int32 = {0x0, 0xbc598000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0xbc59800000000000, 0x0, 0x0, 0x0}, v2_int128 = {0x0000000000000000bc59800000000000, 0x00000000000000000000000000000000}} ymm14 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x8e, 0x85, 0x83, 0xe8, 0xf0, 0x24, 0x53, 0x3c, 0x0 <repeats 24 times>}, v16_int16 = {0x858e, 0xe883, 0x24f0, 0x3c53, 0x0 <repeats 12 times>}, v8_int32 = {0xe883858e, 0x3c5324f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x3c5324f0e883858e, 0x0, 0x0, 0x0}, v2_int128 = {0x00000000000000003c5324f0e883858e, 0x00000000000000000000000000000000}} ymm15 {v8_float = {0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x2d, 0x0, 0x0, 0x0}, v32_int8 = {0xc0, 0x9, 0xf2, 0x16, 0xb5, 0xdf, 0x46, 0x40, 0x0 <repeats 24 times>}, v16_int16 = {0x9c0, 0x16f2, 0xdfb5, 0x4046, 0x0 <repeats 12 times>}, v8_int32 = {0x16f209c0, 0x4046dfb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x4046dfb516f209c0, 0x0, 0x0, 0x0}, v2_int128 = {0x00000000000000004046dfb516f209c0, 0x00000000000000000000000000000000}}
Change History (2)
comment:1 by , 9 years ago
Component: | undetermined → swscale |
---|---|
Description: | modified (diff) |
Priority: | normal → important |
Reproduced by developer: | set |
Status: | new → open |
comment:2 by , 9 years ago
Resolution: | → fixed |
---|---|
Status: | open → closed |
"Fixed" in a0af9fd95415293b965bb67e56a11f6429326db1
Note:
See TracTickets
for help on using tickets.
Regression since 6dbaeed6b7b7c858dffdf141b725506b887660e7