Recherche avancée

Sur d’autres sites (9790)

• Ffmpeg creates a picture and prompts "End of file"

  15 décembre 2022, par SunnyWu

  When I use ffmpeg to generate video screenshots, it prompts me "End of file". I don't know where this problem occurs.

  


  My video source can be played normally in the VLC player.

  


  I tried to use the same ffmpeg command to replace other video sources. It can generate video screenshots normally.

  


  ---

  


  OS:Centon 7

  


  ffmpeg version:4.8.5

  


  Video source address protocol:HTTP-FLV

  


  ---

  


  The following is the command I executed to generate screenshots :

  


  ffmpeg  -i http://172.20.32.33:2000/live -ss 00:00:05 -vframes 1 -f image2 /root/project/img/tttt.jpeg && echo succeeded ||echo failed

ffmpeg version 4.1 Copyright (c) 2000-2018 the FFmpeg developers
  built with gcc 4.8.5 (GCC) 20150623 (Red Hat 4.8.5-44)
  configuration: --enable-libx265 --enable-libx264 --enable-gpl
  libavutil      56. 22.100 / 56. 22.100
  libavcodec     58. 35.100 / 58. 35.100
  libavformat    58. 20.100 / 58. 20.100
  libavdevice    58.  5.100 / 58.  5.100
  libavfilter     7. 40.101 /  7. 40.101
  libswscale      5.  3.100 /  5.  3.100
  libswresample   3.  3.100 /  3.  3.100
  libpostproc    55.  3.100 / 55.  3.100

http://172.20.32.33:2000/live: End of file
failed


  


  enter image description here

  


• avcodec/wmalosslessdec : Check channels after setting them

  31 mars 2022, par Michael Niedermayer

  avcodec/wmalosslessdec : Check channels after setting them
  Fixes : 46194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-580292873827123
  
  Fixes : stack-buffer-overflow on address 0x7ffc0ce69b30 at pc 0x00000062fb03 bp 0x7ffc0ce69af0 sp 0x7ffc0ce69ae8
  
  Fixes : 46205/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5354894996930560
  
  Fixes : 47861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4817404984688640
  Found-by : continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  
  Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavcodec/wmalosslessdec.c

• `free() : invalid next size (normal)` after loading some frames of some videos using ffmpeg libs

  17 septembre 2024, par rakivo

  here is the function :

  


  uint8_t *load_first_frame(const char *file_path, AVFrame **frame)
{
    int ret;
    AVFormatContext *format_ctx = NULL;
    if ((ret = avformat_open_input(&format_ctx, file_path, NULL, NULL)) < 0) {
        eprintf("could not open input file\n");
        return NULL;
    }

    if ((ret = avformat_find_stream_info(format_ctx, NULL)) < 0) {
        eprintf("could not find stream info\n");
        avformat_close_input(&format_ctx);
        return NULL;
    }

    int stream_idx = -1;
    for (unsigned int i = 0; i < format_ctx->nb_streams; i++) {
        if (format_ctx->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
            stream_idx = i;
            break;
        }
    }

    if (stream_idx == -1) {
        eprintf("could not find video stream\n");
        avformat_close_input(&format_ctx);
        return NULL;
    }

    AVCodecParameters *codec_par = format_ctx->streams[stream_idx]->codecpar;
    const AVCodec *codec = avcodec_find_decoder(codec_par->codec_id);
    if (!codec) {
        eprintf("could not find decoder\n");
        avformat_close_input(&format_ctx);
        return NULL;
    }

    AVCodecContext *codec_ctx = avcodec_alloc_context3(codec);
    if ((ret = avcodec_parameters_to_context(codec_ctx, codec_par)) < 0) {
        eprintf("could not copy codec parameters to context\n");
        avformat_close_input(&format_ctx);
        avcodec_free_context(&codec_ctx);
        return NULL;
    }

    if ((ret = avcodec_open2(codec_ctx, codec, NULL)) < 0) {
        eprintf("could not open codec\n");
        avformat_close_input(&format_ctx);
        avcodec_free_context(&codec_ctx);
        return NULL;
    }

    AVPacket *packet = av_packet_alloc();
    uint8_t *rgb_buffer = NULL;
    while (av_read_frame(format_ctx, packet) >= 0) {
        if (packet->stream_index != stream_idx) {
            av_packet_unref(packet);
            continue;
        }

        if (avcodec_send_packet(codec_ctx, packet) != 0) {
            av_packet_unref(packet);
            continue;
        }

        ret = avcodec_receive_frame(codec_ctx, *frame);
        if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF) {
            av_packet_unref(packet);
            continue;
        } else if (ret < 0) {
            eprintf("error receiving frame: %d\n", ret);
            av_packet_unref(packet);
            av_packet_free(&packet);
            avformat_close_input(&format_ctx);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        struct SwsContext *sws_ctx = sws_getContext(
            (*frame)->width, (*frame)->height, codec_ctx->pix_fmt,
            (*frame)->width, (*frame)->height, AV_PIX_FMT_RGB24,
            SWS_BILINEAR, NULL, NULL, NULL
        );

        if (!sws_ctx) {
            eprintf("failed to create SwsContext\n");
            av_packet_unref(packet);
            av_packet_free(&packet);
            av_frame_free(frame);
            avformat_close_input(&format_ctx);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        int rgb_buffer_size = av_image_get_buffer_size(AV_PIX_FMT_RGB24, (*frame)->width, (*frame)->height, 1);
        if (rgb_buffer_size < 0) {
            eprintf("could not get buffer size\n");
            sws_freeContext(sws_ctx);
            av_packet_unref(packet);
            av_packet_free(&packet);
            av_frame_free(frame);
            avformat_close_input(&format_ctx);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        rgb_buffer = (uint8_t *) malloc(rgb_buffer_size);
        if (rgb_buffer == NULL) {
            eprintf("failed to allocate RGB buffer\n");
            sws_freeContext(sws_ctx);
            av_packet_unref(packet);
            av_packet_free(&packet);
            avformat_close_input(&format_ctx);
            av_frame_free(frame);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        uint8_t *dst[4] = {rgb_buffer, NULL, NULL, NULL};
        int dst_linesize[4] = {0};
        av_image_fill_linesizes(dst_linesize, AV_PIX_FMT_RGB24, (*frame)->width);

        sws_scale(sws_ctx,
                            (const uint8_t *const *)(*frame)->data,
                            (*frame)->linesize,
                            0,
                            (*frame)->height,
                            dst,
                            dst_linesize);

        sws_freeContext(sws_ctx);
        av_packet_unref(packet);
        break;
    }

    av_packet_unref(packet);
    av_packet_free(&packet);
    avformat_close_input(&format_ctx);
    avcodec_free_context(&codec_ctx);

    return rgb_buffer;
}


  


  It loads up first frames of mp4s. The problem is that it works only first 7 times, and then, on 8th call of the showed function malloc(): corrupted top size happens. Specifically when call avcodec_send_packet in the while loop. Executing program using valgrind outputs that :

  


  ==21777== Invalid write of size 8
==21777==    at 0x7426956: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777==    by 0x18497CBF: ???
==21777==    by 0x35E3AD3F: ???
==21777==  Address 0x37f563f0 is 0 bytes after a block of size 2,194,560 alloc'd
==21777==    at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777==    by 0x1113CB: load_first_frame (main.c:503)
==21777==    by 0x111995: draw_preview (main.c:605)
==21777==    by 0x111E7F: render_files (main.c:672)
==21777==    by 0x11209E: main (main.c:704)
==21777==
==21777== Invalid write of size 8
==21777==    at 0x742695B: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777==    by 0x18497CBF: ???
==21777==    by 0x35E3AD3F: ???
==21777==  Address 0x37f563f8 is 8 bytes after a block of size 2,194,560 alloc'd
==21777==    at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777==    by 0x1113CB: load_first_frame (main.c:503)
==21777==    by 0x111995: draw_preview (main.c:605)
==21777==    by 0x111E7F: render_files (main.c:672)
==21777==    by 0x11209E: main (main.c:704)
==21777==
==21777== Invalid write of size 8
==21777==    at 0x7426956: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777==    by 0x183FE37F: ???
==21777==    by 0x185D16FF: ???
==21777==  Address 0x389b94e0 is 0 bytes after a block of size 943,200 alloc'd
==21777==    at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777==    by 0x1113CB: load_first_frame (main.c:503)
==21777==    by 0x111995: draw_preview (main.c:605)
==21777==    by 0x111E7F: render_files (main.c:672)
==21777==    by 0x11209E: main (main.c:704)


  


  The 503th line is : rgb_buffer = (uint8_t *) malloc(rgb_buffer_size);.

  


  Apparently, I double freed something somewhere, but I can't see where exactly. AVFrame **frame that is passed to the function is allocated and freed properly every time using av_frame_alloc and av_frame_free. The mp4 file from file_path is always just a normal video, and it always exists.

  


  I've tried loading up different mp4 files, the crash happens every time exactly on 8th call of the function