[FFmpeg-trac] #2148(avformat:new): crash reading M3U8 audio file

[FFmpeg]

#2148: crash reading M3U8 audio file
-------------------------------------+-------------------------------------
               Reporter:  saste      |                  Owner:
                   Type:  defect     |                 Status:  new
               Priority:  important  |              Component:  avformat
                Version:  git-       |               Keywords:  m3u8 hls
  master                             |  mov crash
             Blocked By:             |               Blocking:
Reproduced by developer:  1          |  Analyzed by developer:  0
-------------------------------------+-------------------------------------
 Summary of the bug:
 How to reproduce:
 {{{
 ffmpeg -f lavfi -i "aevalsrc=cos(2*PI*t)*sin(2*PI*(440+4*t)*t)::d=20" -f
 segment -segment_time 10 -map 0 -strict -2 -codec:a aac -segment_list
 list.m3u8 out-%03d.mp4
 }}}

 {{{-f lavfi}}} was used to generate the input, but any audio file will do.

 The individual mp4 files generated are playable.

 Then if you try to read the generated file with ffmpeg -i list.m3u8 it
 crashes (same with ffprobe/ffplay):
 {{{
  ffmpeg -i list.m3u8
 ffmpeg version N-48948-gcb9d290 Copyright (c) 2000-2013 the FFmpeg
 developers
   built on Jan 16 2013 23:24:42 with gcc 4.6 (Ubuntu/Linaro
 4.6.3-1ubuntu5)
   configuration: --enable-pic --enable-fontconfig --enable-libschroedinger
 --enable-libass --enable-version3 --prefix=/home/stefano --enable-libx264
 --enable-libfaac --disable-shared --enable-static --enable-debug=3
 --enable-pthreads --enable-libvorbis --enable-gpl --enable-nonfree
 --enable-libmp3lame --enable-libtheora --enable-gpl --enable-x11grab
 --enable-frei0r --enable-libspeex --enable-libcaca --enable-libflite
 --enable-libfreetype --enable-libopencv --enable-libopencore-amrnb
 --enable-libopencore-amrnb --disable-optimizations --disable-mmx
   libavutil      52. 15.100 / 52. 15.100
   libavcodec     54. 89.100 / 54. 89.100
   libavformat    54. 60.101 / 54. 60.101
   libavdevice    54.  3.102 / 54.  3.102
   libavfilter     3. 32.100 /  3. 32.100
   libswscale      2.  1.103 /  2.  1.103
   libswresample   0. 17.102 /  0. 17.102
   libpostproc    52.  2.100 / 52.  2.100
 [mov,mp4,m4a,3gp,3g2,mj2 @ 0x24173e0] stream 0, offset 0x2c: partial file
 [mov,mp4,m4a,3gp,3g2,mj2 @ 0x24173e0] Could not find codec parameters for
 stream 0 (Audio: mp3 (mp4a / 0x6134706D), 22050 Hz, 2 channels, s16p, 31
 kb/s): unspecified frame size
 Consider increasing the value for the 'analyzeduration' and 'probesize'
 options
 *** glibc detected *** ffmpeg: corrupted double-linked list:
 0x0000000002455390 ***
 }}}

 Backtrace:
 {{{
 #0  0x00007ffff104e425 in __GI_raise (sig=<optimized out>) at
 ../nptl/sysdeps/unix/sysv/linux/raise.c:64
 #1  0x00007ffff1051b8b in __GI_abort () at abort.c:91
 #2  0x00007ffff108c39e in __libc_message (do_abort=2, fmt=0x7ffff1196008
 "*** glibc detected *** %s: %s: 0x%s ***\n") at
 ../sysdeps/unix/sysv/linux/libc_fatal.c:201
 #3  0x00007ffff1096b96 in malloc_printerr (action=3, str=0x7ffff1196118
 "double free or corruption (!prev)", ptr=<optimized out>) at malloc.c:5007
 #4  0x0000000000d0d970 in av_free (ptr=0x18ae160) at libavutil/mem.c:185
 #5  0x0000000000d0d995 in av_freep (arg=0x18970d0) at libavutil/mem.c:192
 #6  0x00000000004f1ee8 in avio_close (s=0x18970c8) at
 libavformat/aviobuf.c:829
 #7  0x0000000000545a59 in mov_read_close (s=0x189c2d0) at
 libavformat/mov.c:3075
 #8  0x00000000005f4632 in avformat_close_input (ps=0x18971a0) at
 libavformat/utils.c:3244
 #9  0x0000000000515de0 in free_variant_list (c=0x1896070) at
 libavformat/hls.c:137
 #10 0x0000000000517e6e in hls_close (s=0x1895ab0) at libavformat/hls.c:709
 #11 0x00000000005f4632 in avformat_close_input (ps=0x189de00) at
 libavformat/utils.c:3244
 #12 0x000000000043e92a in exit_program () at ffmpeg.c:452
 #13 0x00007ffff1053901 in __run_exit_handlers (status=1,
 listp=0x7ffff13d0688, run_list_atexit=true) at exit.c:78
 #14 0x00007ffff1053985 in __GI_exit (status=<optimized out>) at exit.c:100
 #15 0x000000000044aef9 in main (argc=3, argv=0x7fffffffe618) at
 ffmpeg.c:3235
 }}}

 exactly in mov_read_close(), when calling avio_close().

-- 
Ticket URL: <https://ffmpeg.org/trac/ffmpeg/ticket/2148>
FFmpeg <http://ffmpeg.org>
FFmpeg issue tracker