Opened 11 years ago

Closed 11 years ago

#1267 closed defect (duplicate)

mp_seek infinite loop demuxing MP4

Reported by: rectalogic@… Owned by: r_togni@…
Priority: normal Component: demuxer
Version: HEAD Severity: major
Keywords: Cc:
Blocked By: Blocking:
Reproduced by developer: Analyzed by developer:

Description

mplayer gets stuck in an infinite loop while trying to parse the 'udta' tag of a number of different MP4 files. I uploaded a sample to upload.mplayerhq.hu:/MPlayer/incoming/seekhang/seekhang.mp4

File is 21718565 bytes long, attempting to mp_seek to last byte of file to parse the 'udta' tag. This seek fails, and the stream is reset to pos 0. It then starts parsing garbage tags and gets stuck in an infinite loop parsing the same garbage tag and seeking back to the same position.

Attached patch checks if we are seeking to the current pos in mp_seek and does not seek the stream if we are.

Backtrace for initial seek to 21718565 that fails:

#0 seek (s=0x1812400, newpos=21716992) at stream/stream_file.c:53
#1 0x00108265 in stream_seek_long (s=0x1812400, pos=1573) at stream/stream.c:345
#2 0x00178852 in cache_stream_seek_long (stream=0x1812400, pos=21718565) at stream/cache2.c:410
#3 0x00142dab in stream_seek (s=0x1812400, pos=21718565) at stream.h:270
#4 0x00142c8a in mp_seek (opaque=0x1812400, pos=21718565, whence=0) at libmpdemux/demux_lavf.c:118
#5 0x001e05a2 in url_fseek (s=0x162daf0, offset=21718565, whence=0) at aviobuf.c:168
#6 0x00218b3b in mov_read_udta (c=0x180ce00, pb=0x162daf0, atom={type = 1635017845, offset = 21718462, size = 103}) at mov.c:1406
#7 0x00215454 in mov_read_default (c=0x180ce00, pb=0x162daf0, atom={type = 1987014509, offset = 21634616, size = 83949}) at mov.c:215
#8 0x00215f20 in mov_read_moov (c=0x180ce00, pb=0x162daf0, atom={type = 1987014509, offset = 21634616, size = 83949}) at mov.c:455
#9 0x00215454 in mov_read_default (c=0x180ce00, pb=0x162daf0, atom={type = 0, offset = 0, size = 21718565}) at mov.c:215
#10 0x00219c44 in mov_read_header (s=0x1812e00, ap=0xbfffe3ec) at mov.c:1811
#11 0x001d649d in av_open_input_stream (ic_ptr=0xbfffe41c, pb=0x162daf0, filename=0xbfffe2ec "mp:/Users/aw/Desktop/seekhang.mp4", fmt=0x8024a0, ap=0xbfffe3ec) at utils.c:475
#12 0x00143fe8 in demux_open_lavf (demuxer=0x180c400) at libmpdemux/demux_lavf.c:469
#13 0x000b63de in demux_open_stream (stream=0x1812400, file_format=44, force=0, audio_id=-1, video_id=-1, dvdsub_id=-2, filename=0x162b310 "/Users/aw/Desktop/seekhang.mp4") at libmpdemux/demuxer.c:818
#14 0x000b6ada in demux_open (vs=0x1812400, file_format=0, audio_id=-1, video_id=-1, dvdsub_id=-2, filename=0x162b310 "/Users/aw/Desktop/seekhang.mp4") at libmpdemux/demuxer.c:998
#15 0x000093b6 in main (argc=2, argv=0xbffff80c) at mplayer.c:3237

Subsequent backtrace when caught in infinite loop reparsing the same garbage tag:

#0 url_fseek (s=0x162daf0, offset=21718470, whence=0) at aviobuf.c:176
#1 0x00218b3b in mov_read_udta (c=0x180ce00, pb=0x162daf0, atom={type = 1635017845, offset = 21718462, size = 103}) at mov.c:1406
#2 0x00215454 in mov_read_default (c=0x180ce00, pb=0x162daf0, atom={type = 1987014509, offset = 21634616, size = 83949}) at mov.c:215
#3 0x00215f20 in mov_read_moov (c=0x180ce00, pb=0x162daf0, atom={type = 1987014509, offset = 21634616, size = 83949}) at mov.c:455
#4 0x00215454 in mov_read_default (c=0x180ce00, pb=0x162daf0, atom={type = 0, offset = 0, size = 21718565}) at mov.c:215
#5 0x00219c44 in mov_read_header (s=0x1812e00, ap=0xbfffe3ec) at mov.c:1811
#6 0x001d649d in av_open_input_stream (ic_ptr=0xbfffe41c, pb=0x162daf0, filename=0xbfffe2ec "mp:/Users/aw/Desktop/seekhang.mp4", fmt=0x8024a0, ap=0xbfffe3ec) at utils.c:475
#7 0x00143fe8 in demux_open_lavf (demuxer=0x180c400) at libmpdemux/demux_lavf.c:469
#8 0x000b63de in demux_open_stream (stream=0x1812400, file_format=44, force=0, audio_id=-1, video_id=-1, dvdsub_id=-2, filename=0x162b310 "/Users/aw/Desktop/seekhang.mp4") at libmpdemux/demuxer.c:818
#9 0x000b6ada in demux_open (vs=0x1812400, file_format=0, audio_id=-1, video_id=-1, dvdsub_id=-2, filename=0x162b310 "/Users/aw/Desktop/seekhang.mp4") at libmpdemux/demuxer.c:998
#10 0x000093b6 in main (argc=2, argv=0xbffff80c) at mplayer.c:3237

Attachments (2)

mpseek.diff (516 bytes) - added by rectalogic@… 11 years ago.
Patch to demux_lavf.c:mp_seek
mplayer.log (5.3 KB) - added by rectalogic@… 11 years ago.
mplayer log

Download all attachments as: .zip

Change History (7)

Changed 11 years ago by rectalogic@…

Patch to demux_lavf.c:mp_seek

comment:1 Changed 11 years ago by rectalogic@…

Changed 11 years ago by rectalogic@…

mplayer log

comment:2 Changed 11 years ago by rectalogic@…

comment:3 Changed 11 years ago by t.artem@…

Probably this bug is solved.

See bug 1256.

comment:4 Changed 11 years ago by compn

yes, please retry in latest svn.

comment:5 Changed 11 years ago by rectalogic@…

  • Resolution set to duplicate
  • Status changed from new to closed

Yes, works with mplayer r27688

* This bug has been marked as a duplicate of bug 1256 *

Note: See TracTickets for help on using tickets.