[vlc-devel] h264: support frame parameter changes during frame-mt

[Rafaël Carré]

Le 26/12/2012 01:41, Janne Grunau a écrit :
> On 2012-12-25 22:51:06 +0100, Rafaël Carré wrote:
>> Hello,
>>
>> Le 18/12/2012 20:01, Janne Grunau a écrit :
>>> Module: libav
>>> Branch: master
>>> Commit: 9e696d2e5ffaa763c564682ec18c3b51b3e5fccc
>>>
>>> Author:    Janne Grunau <janne-libav-w2YMFpIX6D+sTnJN9+BGXg at public.gmane.org>
>>> Committer: Janne Grunau <janne-libav-w2YMFpIX6D+sTnJN9+BGXg at public.gmane.org>
>>> Date:      Thu Sep  6 13:30:08 2012 +0200
>>>
>>> h264: support frame parameter changes during frame-mt
>>>
>>> Fixes CVE-2012-2782.
>>
>> This libav commit broke vaapi support in VLC :
>>
>> libva: VA-API version 0.32.0
>> libva: va_getDriverName() returns 0
>> libva: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
>> libva: va_openDriver() returns 0
>> [0x7ff658000ce8] main generic debug: using hw decoder module "vaapi"
>> [0x7ff64d059ec8] avcodec decoder debug: Available decoder output format
>> 61 (dxva2_vld)
>> [0x7ff64d059ec8] avcodec decoder debug: Available decoder output format
>> 53 (vaapi_vld)
>> [0x7ff64d059ec8] avcodec decoder: Using VA API version 0.32 for hardware
>> decoding.
>> [0x7ff658e620f8] main generic debug: looking for hw decoder module
>> matching "vaapi": 1 candidates
>> libva: VA-API version 0.32.0
>> libva: va_getDriverName() returns 0
>> libva: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
>> libva: va_openDriver() returns 0
>> [0x7ff658e620f8] main generic debug: using hw decoder module "vaapi"
>> [0x7ff64d059ec8] avcodec decoder debug: Available decoder output format
>> 61 (dxva2_vld)
>> [0x7ff64d059ec8] avcodec decoder debug: Available decoder output format
>> 53 (vaapi_vld)
>> [0x7ff64d059ec8] avcodec decoder: Using VA API version 0.32 for hardware
>> decoding.
>> zsh: segmentation fault (core dumped)  cvlc --ignore-config -vv
>> --avcodec-hw vaapi bbb-1080-stereo.mp4
>>
>>
>> As you see the vaapi module is probed multiple times; running VLC
>> multiple times will show that module is probed a random number of times
>> between 2 and 7 before segfaulting.
> 
> Do we or vlc enforces single threaded decoding with hwaccels?

At least VLC does.

> Before the
> commit it was only probed once? When does it get probed? in the
> get_format callback? 

It was probed only once, and you're right, it's done in the get_format
callback:

ffmpeg_GetFormat() -> vlc_va_New()

(Although there's a vlc_va_Delete() call just before)

> A log with libavcodec info or verbose messages might
> be helpful.

I used the attached diff to set log level (and log callback to be sure
log was not getting lost) but I see nothing coming from libav :/

>> I did not debug anything yet, just experienced it and wanted to share
>> git bisect result, so suggestions (or fix) welcome :)
>>
>> backtraces often come from i965_drv_video.so but not always..
>>
>> vlc: i965_drv_video.c:1105: i965_UnmapBuffer: Assertion `obj_buffer &&
>> obj_buffer->buffer_store' failed.
> 
> That looks like the inconsistant state which could be caused by the
> multiple probing.
> 
> Janne
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: verbose.diff
Type: text/x-patch
Size: 936 bytes
Desc: not available
URL: <http://mailman.videolan.org/pipermail/vlc-devel/attachments/20121229/4aa341d5/attachment.bin>