Recherche avancée

Sur d’autres sites (13771)

• `free() : invalid next size (normal)` after loading some frames of some videos using ffmpeg libs

  17 septembre 2024, par rakivo

  here is the function :

  


  uint8_t *load_first_frame(const char *file_path, AVFrame **frame)
{
    int ret;
    AVFormatContext *format_ctx = NULL;
    if ((ret = avformat_open_input(&format_ctx, file_path, NULL, NULL)) < 0) {
        eprintf("could not open input file\n");
        return NULL;
    }

    if ((ret = avformat_find_stream_info(format_ctx, NULL)) < 0) {
        eprintf("could not find stream info\n");
        avformat_close_input(&format_ctx);
        return NULL;
    }

    int stream_idx = -1;
    for (unsigned int i = 0; i < format_ctx->nb_streams; i++) {
        if (format_ctx->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
            stream_idx = i;
            break;
        }
    }

    if (stream_idx == -1) {
        eprintf("could not find video stream\n");
        avformat_close_input(&format_ctx);
        return NULL;
    }

    AVCodecParameters *codec_par = format_ctx->streams[stream_idx]->codecpar;
    const AVCodec *codec = avcodec_find_decoder(codec_par->codec_id);
    if (!codec) {
        eprintf("could not find decoder\n");
        avformat_close_input(&format_ctx);
        return NULL;
    }

    AVCodecContext *codec_ctx = avcodec_alloc_context3(codec);
    if ((ret = avcodec_parameters_to_context(codec_ctx, codec_par)) < 0) {
        eprintf("could not copy codec parameters to context\n");
        avformat_close_input(&format_ctx);
        avcodec_free_context(&codec_ctx);
        return NULL;
    }

    if ((ret = avcodec_open2(codec_ctx, codec, NULL)) < 0) {
        eprintf("could not open codec\n");
        avformat_close_input(&format_ctx);
        avcodec_free_context(&codec_ctx);
        return NULL;
    }

    AVPacket *packet = av_packet_alloc();
    uint8_t *rgb_buffer = NULL;
    while (av_read_frame(format_ctx, packet) >= 0) {
        if (packet->stream_index != stream_idx) {
            av_packet_unref(packet);
            continue;
        }

        if (avcodec_send_packet(codec_ctx, packet) != 0) {
            av_packet_unref(packet);
            continue;
        }

        ret = avcodec_receive_frame(codec_ctx, *frame);
        if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF) {
            av_packet_unref(packet);
            continue;
        } else if (ret < 0) {
            eprintf("error receiving frame: %d\n", ret);
            av_packet_unref(packet);
            av_packet_free(&packet);
            avformat_close_input(&format_ctx);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        struct SwsContext *sws_ctx = sws_getContext(
            (*frame)->width, (*frame)->height, codec_ctx->pix_fmt,
            (*frame)->width, (*frame)->height, AV_PIX_FMT_RGB24,
            SWS_BILINEAR, NULL, NULL, NULL
        );

        if (!sws_ctx) {
            eprintf("failed to create SwsContext\n");
            av_packet_unref(packet);
            av_packet_free(&packet);
            av_frame_free(frame);
            avformat_close_input(&format_ctx);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        int rgb_buffer_size = av_image_get_buffer_size(AV_PIX_FMT_RGB24, (*frame)->width, (*frame)->height, 1);
        if (rgb_buffer_size < 0) {
            eprintf("could not get buffer size\n");
            sws_freeContext(sws_ctx);
            av_packet_unref(packet);
            av_packet_free(&packet);
            av_frame_free(frame);
            avformat_close_input(&format_ctx);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        rgb_buffer = (uint8_t *) malloc(rgb_buffer_size);
        if (rgb_buffer == NULL) {
            eprintf("failed to allocate RGB buffer\n");
            sws_freeContext(sws_ctx);
            av_packet_unref(packet);
            av_packet_free(&packet);
            avformat_close_input(&format_ctx);
            av_frame_free(frame);
            avcodec_free_context(&codec_ctx);
            return NULL;
        }

        uint8_t *dst[4] = {rgb_buffer, NULL, NULL, NULL};
        int dst_linesize[4] = {0};
        av_image_fill_linesizes(dst_linesize, AV_PIX_FMT_RGB24, (*frame)->width);

        sws_scale(sws_ctx,
                            (const uint8_t *const *)(*frame)->data,
                            (*frame)->linesize,
                            0,
                            (*frame)->height,
                            dst,
                            dst_linesize);

        sws_freeContext(sws_ctx);
        av_packet_unref(packet);
        break;
    }

    av_packet_unref(packet);
    av_packet_free(&packet);
    avformat_close_input(&format_ctx);
    avcodec_free_context(&codec_ctx);

    return rgb_buffer;
}


  


  It loads up first frames of mp4s. The problem is that it works only first 7 times, and then, on 8th call of the showed function malloc(): corrupted top size happens. Specifically when call avcodec_send_packet in the while loop. Executing program using valgrind outputs that :

  


  ==21777== Invalid write of size 8
==21777==    at 0x7426956: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777==    by 0x18497CBF: ???
==21777==    by 0x35E3AD3F: ???
==21777==  Address 0x37f563f0 is 0 bytes after a block of size 2,194,560 alloc'd
==21777==    at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777==    by 0x1113CB: load_first_frame (main.c:503)
==21777==    by 0x111995: draw_preview (main.c:605)
==21777==    by 0x111E7F: render_files (main.c:672)
==21777==    by 0x11209E: main (main.c:704)
==21777==
==21777== Invalid write of size 8
==21777==    at 0x742695B: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777==    by 0x18497CBF: ???
==21777==    by 0x35E3AD3F: ???
==21777==  Address 0x37f563f8 is 8 bytes after a block of size 2,194,560 alloc'd
==21777==    at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777==    by 0x1113CB: load_first_frame (main.c:503)
==21777==    by 0x111995: draw_preview (main.c:605)
==21777==    by 0x111E7F: render_files (main.c:672)
==21777==    by 0x11209E: main (main.c:704)
==21777==
==21777== Invalid write of size 8
==21777==    at 0x7426956: ??? (in /usr/lib/libswscale.so.8.1.100)
==21777==    by 0x183FE37F: ???
==21777==    by 0x185D16FF: ???
==21777==  Address 0x389b94e0 is 0 bytes after a block of size 943,200 alloc'd
==21777==    at 0x48447A8: malloc (vg_replace_malloc.c:446)
==21777==    by 0x1113CB: load_first_frame (main.c:503)
==21777==    by 0x111995: draw_preview (main.c:605)
==21777==    by 0x111E7F: render_files (main.c:672)
==21777==    by 0x11209E: main (main.c:704)


  


  The 503th line is : rgb_buffer = (uint8_t *) malloc(rgb_buffer_size);.

  


  Apparently, I double freed something somewhere, but I can't see where exactly. AVFrame **frame that is passed to the function is allocated and freed properly every time using av_frame_alloc and av_frame_free. The mp4 file from file_path is always just a normal video, and it always exists.

  


  I've tried loading up different mp4 files, the crash happens every time exactly on 8th call of the function

  


• hw_base_encode : Free pictures on close

  15 octobre 2024, par David Rosca

  hw_base_encode : Free pictures on close
  Fixes leaking recon surfaces with VAAPI.
  

  • [DH] libavcodec/hw_base_encode.c

• lavf/matroskaenc.c : Free dyn bufs in mkv_free. Fixes memory leaks when muxing fails.

  26 janvier 2017, par Sasi Inguva

  lavf/matroskaenc.c : Free dyn bufs in mkv_free. Fixes memory leaks when muxing fails.
  Signed-off-by : Sasi Inguva <isasi@google.com>
  
  Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavformat/matroskaenc.c