Memory leak with RTP subsession

[googuy@…]

Trying to play a RTP session with an audio and video subsession, if the video fail because it's RTP frame its too large, MPlayer keep going with only the audio subsession but have a memory leak.

Output of mplayer:
(...)
Initiated "video/MP4V-ES" RTP subsession on port 1234
Initiated "audio/PCMA" RTP subsession on port 1236
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 249 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 250 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
demux_rtp: Failed to guess the video frame rate
VIDEO: [mp4v] 0x0 0bpp 0.000 fps 0.0 kbps ( 0.0 kbyte/s)
FPS not specified in the header or invalid, use the -fps option.
(...)

mplayer continue with only the audio but those video frames or part of it seems to keep going into memory, so the memory allocated by the mplayer slowly increase with apparenlty no limit.

If you only have one subsession with the RTP frame too big, MPlayer exits because it doesn't keep going with another stream, and obviously you don't see any memory allocation problem.

Tested on a Windows XP system with MPlayer 1.0rc2-4.2.1 and in a Ubuntu Studio 8.04 x86 with MPlayer 1.0rc2-4.2.3.

Don't know if the error is live555, ffmpeg or mplayer related.

[compn]

a sample rtp stream and valgrind output (on linux) using svn mplayer would be nice.

[googuy@…]

(In reply to comment #1)

a sample rtp stream and valgrind output (on linux) using svn mplayer would be
nice.

RTP stream is dificult as is a live stream from a hardware encoder. But possible it could be simulated creating a stream with a D1 resolution image and 2Mbits/s or more bitrate.

The valgrind output:

valgrind --leak-check=full mplayer sdp://videoaudiopayload10.sdp
==6087== Memcheck, a memory error detector.
==6087== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==6087== Using LibVEX rev 1804, a library for dynamic binary translation.
==6087== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==6087== Using valgrind-3.3.0-Debian, a dynamic binary instrumentation framework.
==6087== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==6087== For more details, rerun with: -v
==6087==
MPlayer 1.0rc2-4.2.3 (C) 2000-2007 MPlayer Team
CPU: Intel Pentium 4/Celeron 4 Northwood; Pentium 4 EE/Xeon Prestonia,Gallatin (Family: 15, Model: 2, Stepping: 7)
CPUflags: MMX: 1 MMX2: 1 3DNow: 0 3DNow2: 0 SSE: 1 SSE2: 1
Compiled with runtime CPU detection.
mplayer: could not connect to socket
mplayer: No such file or directory
Failed to open LIRC support. You will not be able to use your remote control.

Playing sdp://videoaudiopayload10.sdp.

file format detected.

Initiated "video/MP4V-ES" RTP subsession on port 1234
Initiated "audio/L16" RTP subsession on port 1236
demux_rtp: Failed to guess the video frame rate
VIDEO: [mp4v] 0x0 0bpp 0.000 fps 0.0 kbps ( 0.0 kbyte/s)
FPS not specified in the header or invalid, use the -fps option.
==========================================================================
Forced audio codec: mad
Opening audio decoder: [pcm] Uncompressed PCM audio decoder
AUDIO: 44100 Hz, 2 ch, s16be, 0.0 kbit/0.00% (ratio: 0->176400)
Selected audio codec: [pcm] afm: pcm (Uncompressed PCM)
==========================================================================
AO: [pulse] 44100Hz 2ch s16be (2 bytes per sample)
Video: no video
Starting playback...
A: -0.4 (unknown) of 0.0 (unknown) 94.8%

MPlayer interrupted by signal 2 in module: decode_audio
==6087== Mismatched free() / delete / delete []
==6087== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6087== by 0x8239DAA: ReadBufferQueue::~ReadBufferQueue() (in /usr/bin/mplayer)
==6087== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6087== by 0x823A070: (within /usr/bin/mplayer)
==6087== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6087== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6087== Address 0x6738fe0 is 0 bytes inside a block of size 6 alloc'd
==6087== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6087== by 0x54D3FCF: strdup (in /lib/tls/i686/cmov/libc-2.7.so)
==6087== by 0x8239881: demux_open_rtp (in /usr/bin/mplayer)
==6087== by 0x88122F4: (within /usr/bin/mplayer)
==6087==
==6087== Mismatched free() / delete / delete []
==6087== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6087== by 0x82390F0: demux_close_rtp (in /usr/bin/mplayer)
==6087== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6087== by 0x823A070: (within /usr/bin/mplayer)
==6087== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6087== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6087== Address 0x5d3a878 is 0 bytes inside a block of size 286 alloc'd
==6087== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6087== by 0x825B33D: (within /usr/bin/mplayer)
==6087==
==6087== Invalid read of size 4
==6087== at 0x81D8A8B: ds_free_packs (in /usr/bin/mplayer)
==6087== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6087== by 0x823A070: (within /usr/bin/mplayer)
==6087== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6087== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6087== Address 0x10639548 is not stack'd, malloc'd or (recently) free'd
==6087==
==6087== Invalid read of size 4
==6087== at 0x81D8ACF: ds_free_packs (in /usr/bin/mplayer)
==6087== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6087== by 0x823A070: (within /usr/bin/mplayer)
==6087== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6087== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6087== Address 0x10639544 is not stack'd, malloc'd or (recently) free'd
==6087==
==6087== Invalid write of size 4
==6087== at 0x81D8AD3: ds_free_packs (in /usr/bin/mplayer)
==6087== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6087== by 0x823A070: (within /usr/bin/mplayer)
==6087== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6087== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6087== Address 0x10639544 is not stack'd, malloc'd or (recently) free'd
==6087==
==6087== ERROR SUMMARY: 6 errors from 5 contexts (suppressed: 233 from 1)
==6087== malloc/free: in use at exit: 86,633 bytes in 42 blocks.
==6087== malloc/free: 583,791 allocs, 583,749 frees, 4,253,095,658 bytes allocated.
==6087== For counts of detected errors, rerun with: -v
==6087== searching for pointers to 42 not-freed blocks.
==6087== checked 5,218,420 bytes.
==6087==
==6087==
==6087== 32 bytes in 1 blocks are definitely lost in loss record 5 of 19
==6087== at 0x4023294: operator new(unsigned) (vg_replace_malloc.c:224)
==6087== by 0x8737A26: BasicTaskScheduler0::scheduleDelayedTask(long long, void (*)(void*), void*) (in /usr/bin/mplayer)
==6087== by 0x823A05D: (within /usr/bin/mplayer)
==6087== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6087== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6087==
==6087== LEAK SUMMARY:
==6087== definitely lost: 32 bytes in 1 blocks.
==6087== possibly lost: 0 bytes in 0 blocks.
==6087== still reachable: 86,601 bytes in 41 blocks.
==6087== suppressed: 0 bytes in 0 blocks.
==6087== Reachable blocks (those to which a pointer was found) are not shown.
==6087== To see them, rerun with: --leak-check=full --show-reachable=yes

[googuy@…]

(In reply to comment #1)

a sample rtp stream and valgrind output (on linux) using svn mplayer would be
nice.

Second run with video data increased from 1Mbits/s to 4Mbits/s.

valgrind --leak-check=full mplayer sdp://videoaudiopayload10.sdp
==6127== Memcheck, a memory error detector.
==6127== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==6127== Using LibVEX rev 1804, a library for dynamic binary translation.
==6127== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==6127== Using valgrind-3.3.0-Debian, a dynamic binary instrumentation framework.
==6127== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==6127== For more details, rerun with: -v
==6127==
MPlayer 1.0rc2-4.2.3 (C) 2000-2007 MPlayer Team
CPU: Intel Pentium 4/Celeron 4 Northwood; Pentium 4 EE/Xeon Prestonia,Gallatin (Family: 15, Model: 2, Stepping: 7)
CPUflags: MMX: 1 MMX2: 1 3DNow: 0 3DNow2: 0 SSE: 1 SSE2: 1
Compiled with runtime CPU detection.
mplayer: could not connect to socket
mplayer: No such file or directory
Failed to open LIRC support. You will not be able to use your remote control.

Playing sdp://videoaudiopayload10.sdp.

file format detected.

Initiated "video/MP4V-ES" RTP subsession on port 1234
Initiated "audio/L16" RTP subsession on port 1236
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 350 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 350 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 300 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 350 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 300 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
MultiFramedRTPSource::doGetNextFrame1(): The total received frame size exceeds the client's buffer size (50000). 350 bytes of trailing data will be dropped!
Saw an input frame too large (>=50000). Increase MAX_RTP_FRAME_SIZE in "demux_rtp.cpp".
demux_rtp: Failed to guess the video frame rate
VIDEO: [mp4v] 0x0 0bpp 0.000 fps 0.0 kbps ( 0.0 kbyte/s)
FPS not specified in the header or invalid, use the -fps option.
==========================================================================
Forced audio codec: mad
Opening audio decoder: [pcm] Uncompressed PCM audio decoder
AUDIO: 44100 Hz, 2 ch, s16be, 0.0 kbit/0.00% (ratio: 0->176400)
Selected audio codec: [pcm] afm: pcm (Uncompressed PCM)
==========================================================================
AO: [pulse] 44100Hz 2ch s16be (2 bytes per sample)
Video: no video
Starting playback...
A: -0.5 (unknown) of 0.0 (unknown) 96.6%

MPlayer interrupted by signal 2 in module: decode_audio
==6127== Mismatched free() / delete / delete []
==6127== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6127== by 0x8239DAA: ReadBufferQueue::~ReadBufferQueue() (in /usr/bin/mplayer)
==6127== by 0x8715E80: MultiFramedRTPSource::networkReadHandler(MultiFramedRTPSource*, int) (in /usr/bin/mplayer)
==6127== by 0x8735CA6: BasicTaskScheduler::SingleStep(unsigned) (in /usr/bin/mplayer)
==6127== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6127== by 0x823A070: (within /usr/bin/mplayer)
==6127== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6127== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6127== Address 0x6338fe0 is 0 bytes inside a block of size 6 alloc'd
==6127== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6127== by 0x54D3FCF: strdup (in /lib/tls/i686/cmov/libc-2.7.so)
==6127== by 0x8239881: demux_open_rtp (in /usr/bin/mplayer)
==6127== by 0x88122F4: (within /usr/bin/mplayer)
==6127==
==6127== Mismatched free() / delete / delete []
==6127== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6127== by 0x82390F0: demux_close_rtp (in /usr/bin/mplayer)
==6127== by 0x8715E80: MultiFramedRTPSource::networkReadHandler(MultiFramedRTPSource*, int) (in /usr/bin/mplayer)
==6127== by 0x8735CA6: BasicTaskScheduler::SingleStep(unsigned) (in /usr/bin/mplayer)
==6127== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6127== by 0x823A070: (within /usr/bin/mplayer)
==6127== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6127== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6127== Address 0x5d3a878 is 0 bytes inside a block of size 286 alloc'd
==6127== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6127== by 0x825B33D: (within /usr/bin/mplayer)
==6127==
==6127== Invalid read of size 4
==6127== at 0x81D8A8B: ds_free_packs (in /usr/bin/mplayer)
==6127== by 0x8715E80: MultiFramedRTPSource::networkReadHandler(MultiFramedRTPSource*, int) (in /usr/bin/mplayer)
==6127== by 0x8735CA6: BasicTaskScheduler::SingleStep(unsigned) (in /usr/bin/mplayer)
==6127== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6127== by 0x823A070: (within /usr/bin/mplayer)
==6127== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6127== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6127== Address 0x17c2f700 is not stack'd, malloc'd or (recently) free'd
==6127==
==6127== Invalid read of size 4
==6127== at 0x81D8ACF: ds_free_packs (in /usr/bin/mplayer)
==6127== by 0x8715E80: MultiFramedRTPSource::networkReadHandler(MultiFramedRTPSource*, int) (in /usr/bin/mplayer)
==6127== by 0x8735CA6: BasicTaskScheduler::SingleStep(unsigned) (in /usr/bin/mplayer)
==6127== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6127== by 0x823A070: (within /usr/bin/mplayer)
==6127== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6127== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6127== Address 0x17c2f6fc is not stack'd, malloc'd or (recently) free'd
==6127==
==6127== Invalid write of size 4
==6127== at 0x81D8AD3: ds_free_packs (in /usr/bin/mplayer)
==6127== by 0x8715E80: MultiFramedRTPSource::networkReadHandler(MultiFramedRTPSource*, int) (in /usr/bin/mplayer)
==6127== by 0x8735CA6: BasicTaskScheduler::SingleStep(unsigned) (in /usr/bin/mplayer)
==6127== by 0x87374BF: BasicTaskScheduler0::doEventLoop(char*) (in /usr/bin/mplayer)
==6127== by 0x823A070: (within /usr/bin/mplayer)
==6127== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6127== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6127== Address 0x17c2f6fc is not stack'd, malloc'd or (recently) free'd
==6127==
==6127== ERROR SUMMARY: 6 errors from 5 contexts (suppressed: 233 from 1)
==6127== malloc/free: in use at exit: 96,693 bytes in 44 blocks.
==6127== malloc/free: 257,274 allocs, 257,230 frees, 1,499,386,091 bytes allocated.
==6127== For counts of detected errors, rerun with: -v
==6127== searching for pointers to 44 not-freed blocks.
==6127== checked 5,228,572 bytes.
==6127==
==6127==
==6127== 32 bytes in 1 blocks are definitely lost in loss record 5 of 21
==6127== at 0x4023294: operator new(unsigned) (vg_replace_malloc.c:224)
==6127== by 0x8737A26: BasicTaskScheduler0::scheduleDelayedTask(long long, void (*)(void*), void*) (in /usr/bin/mplayer)
==6127== by 0x823A05D: (within /usr/bin/mplayer)
==6127== by 0x823A5B0: demux_rtp_fill_buffer (in /usr/bin/mplayer)
==6127== by 0x81D99A1: ds_fill_buffer (in /usr/bin/mplayer)
==6127==
==6127== LEAK SUMMARY:
==6127== definitely lost: 32 bytes in 1 blocks.
==6127== possibly lost: 0 bytes in 0 blocks.
==6127== still reachable: 96,661 bytes in 43 blocks.
==6127== suppressed: 0 bytes in 0 blocks.
==6127== Reachable blocks (those to which a pointer was found) are not shown.
==6127== To see them, rerun with: --leak-check=full --show-reachable=yes