[mythtv] Seg Fault in mediacodec

[Peter Bennett]

On 07/05/2018 01:08 PM, David Engel wrote:
>> I reduced the number of buffers so that it displays a couple of frames
>> before crashing. I see a fat green line along the bottom. I suspect that it
>> is trying to use a frame size of 1920x1088 instead of 1920x1080 (see the
>> trace I sent, it shows slice-height 1088). I plan to step through the ffmpeg
>> code and see if perhaps it is copying 8 rows more than it should. I don't
>> know what the slice-height refers to, but it looks suspicious.
>>
>> It may be that the problem is associated with 1080 rows. Of the resolutions
>> I have tried, only 1080 is not divisible by 16. I have tried 480, 720, 2160
>> - all work without seg fault.
> You could be on to something.  The a/v side of things is not an area
> with which I'm intimately familier, however, I vaguely recall various
> issues with 1080 vs. 1088 popping up in the past.  Where's Mike Dean
> when we need him?:)
It turns out that is in fact the cause of the crash. The second plane in 
the buffer follows on immediately after 1080 lines of the first plane, 
but the code assumes it is after 1088 lines of the first plane, based on 
slice_height. Is slice_height supposed to tell the height of the plane? 
It crashes on copying data for the second plane when it hits the actual 
end of the data and starts accessing addresses beyond that.

This is the patch that fixes it. Instead of using slice_height here, use 
height. I suspect that this may cause a failure in Nougat or other 
systems if they do in fact have a gap between planes.

--- a/mythtv/external/FFmpeg/libavcodec/mediacodec_sw_buffer.c
+++ b/mythtv/external/FFmpeg/libavcodec/mediacodec_sw_buffer.c
@@ -150,7 +150,8 @@ void 
ff_mediacodec_sw_buffer_copy_yuv420_semi_planar(AVCodecContext *avctx,
          } else if (i == 1) {
              height = avctx->height / 2;

-            src += s->slice_height * s->stride;
+            src += s->height * s->stride;
              src += s->crop_top * s->stride;
              src += s->crop_left;
          }

Aman - please let me know if this is the correct fix and if you can 
incorporate it into FFmpeg.

Peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mythtv.org/pipermail/mythtv-dev/attachments/20180705/50785b3d/attachment.html>