Skip to content

[3.0/4.0?] crash (memory corruption?) when resuming rtsp

Can be reproduced on VLC for Android 3.x, systematic, when playing a freebox stream: rtsp://mafreebox.freebox.fr/fbxtv_pub/stream?namespace=1&service=201

********** Crash dump: **********
Build fingerprint: 'google/bluejay_beta/bluejay:14/AP11.231117.006/11174680:user/release-keys'
#00 0x00000000004a82e4 /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             EsOutSend
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/src/../../src/input/es_out.c:2106:14
#01 0x00000000004af014 /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             es_out_Send
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/src/../../include/vlc_es_out.h:136:12
                                             CmdExecuteSend
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/src/../../src/input/es_out_timeshift.c:1350:0
                                             Send
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/src/../../src/input/es_out_timeshift.c:472:0
#02 0x00000000006c929c /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             es_out_Send
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../include/vlc_es_out.h:136:12
                                             SendDataChain
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../modules/demux/mpeg/ts.c:1416:0
                                             ParsePESDataChain
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../modules/demux/mpeg/ts.c:1650:0
                                             PushPESBlock
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../modules/demux/mpeg/ts.c:1689:0
#03 0x00000000006c8454 /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             PushPESBlock
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../modules/demux/mpeg/ts.c:1714:16
#04 0x00000000006c64f4 /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             GatherPESData
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../modules/demux/mpeg/ts.c:0:30
                                             Demux
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/modules/../../modules/demux/mpeg/ts.c:736:0
#05 0x00000000007d1640 /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             demux_Demux
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/src/../../include/vlc_demux.h:358:12
                                             vlc_demux_chained_Thread
                                             /home/nicolas/git/vlc-android/libvlcjni/vlc/build-android-aarch64-linux-android/src/../../src/input/demux_chained.c:92:0
#06 0x0000000000493944 /lib/arm64/libvlc.so (BuildId: 3acc08cb091b0cc4f517f09f400320f8b506e9ec)
                                             joinable_thread
                                                                                 

After a first look in ts.c, es->id is always correctly allocated or freed (but never used again).

This may be a memory corruption.

Edited by Thomas Guillem
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information