Haunting bug in DVD subtitle handling [long]

Stepan Roh stepan at srnet.cz
Sun Jul 15 01:18:27 CEST 2001


As I reported earlier, vlc crashes on all of my DVDs in certain places
when I have subtitles on. Tonight I tried to found that bug and, honestly,
I was not successful. Maybe following will help someone to find where is
the problem.

I tested it with kernel 2.4.5, IDE DVD-ROM, glibc 2.2.3 and X 4.0.3 using
vlc from latest (Jul 15 00:30 CEST) CVS. I tried DVD "Blade Runner"
produced in 1992 by some division of Warner Bros. (it has no special
features, by the way). It crashes a few seconds after 00:02:44 (just
Jump... and see). DVD subtitles thread goes somewhere into the hell
(subtitles will disappear)  and after a second or two it segfaults. I
tried it with Czech (crash) and English subtitles (doesn't crash on this
place, but as I saw on other DVDs, it may crash also). I'm using x11 vout
and it does not depend on aout.

This is what was produced using vlc -vvvvvv :

intf: playlist initialized
module: checking built-in modules
module: new builtin module `es', ISO 13818-1 MPEG Elementary Stream input module
module: new builtin module `ps', ISO 13818-1 MPEG Program Stream input module
module: new builtin module `ts', ISO 13818-1 MPEG Transport Stream input module
module: new builtin module `yuv', YUV transformations module
module: new builtin module `idct', IDCT module
module: new builtin module `idctclassic', classic IDCT module
module: new builtin module `motion', motion compensation module
module: new builtin module `imdct', AC3 IMDCT module
module: new builtin module `downmix', AC3 downmix module
module: new builtin module `dvd', full DVD input module with CSS decryption
module: new builtin module `dummy', dummy functions module
module: new builtin module `null', the Null module that does nothing
module: new builtin module `rc', remote control interface module
module: checking plugin modules
module: browsing `.'
module: browsing `plugins'
module: browsing `/usr/local/lib/videolan/vlc'
module: new plugin module `dsp', Linux OSS /dev/dsp module
module: new plugin module `sdl', Simple DirectMedia Layer module
module: new plugin module `gtk', Gtk+ interface module
module: new plugin module `x11', X11 module
module: new plugin module `xvideo', XVideo extension module
module: module bank initialized
module: locking module `gtk'
intf: interface initialized
intf: added `dvd:/dev/dvd' to playlist
module: locking module `dvd'
dvd info: netlist initialized
ifo info: vmg initialized
dvd info: number of titles: 2
ifo info: vts 1 initialized
dvd: title 1 vts_title 1 pgc 1
dvd info: title: 1
    vobstart at: 5960 blocks
    stream size: 2128328 blocks
    number of chapters: 36
    number of angles: 1
dvd info: video
    compression: mpeg-2
    tv system: pal 625/50 Hz
    aspect ratio: 16:9
    display mode: letterboxed
    line21-1:
    line21-2:
    source res: 720x480 ntsc or 720x576 pal
    letterboxed: no
    mode: camera
module: locking module `motion'
module: locking module `idctclassic'
dvd info: audio 1
    language: English
    mode: ac3
    channel(s): 2
    sampling: 48000 Hz
    appl_mode: not specified
    caption:
    quantization: drc
    status: 0
dvd info: audio 2
    language: Deutsch
    mode: ac3
    channel(s): 2
    sampling: 48000 Hz
    appl_mode: not specified
    caption:
    quantization: drc
    status: 1
dvd info: spu 1
    caption: 0
    language: English
    prefix: 100
    status: 4:3 0 wide 0 letter 0 pan 0
dvd info: spu 2
    caption: 0
    language: Deutsch
    prefix: 100
    status: 4:3 0 wide 1 letter 1 pan 0
dvd info: spu 3
    caption: 0
    language: Espanol
    prefix: 100
    status: 4:3 0 wide 2 letter 2 pan 0
dvd info: spu 4
    caption: 0
    language: Nederlands
    prefix: 100
    status: 4:3 0 wide 3 letter 3 pan 0
dvd info: spu 5
    caption: 0
    language: Svenska
    prefix: 100
    status: 4:3 0 wide 4 letter 4 pan 0
dvd info: spu 6
    caption: 0
    language: Norsk
    prefix: 100
    status: 4:3 0 wide 5 letter 5 pan 0
dvd info: spu 7
    caption: 0
    language: Dansk
    prefix: 100
    status: 4:3 0 wide 6 letter 6 pan 0
dvd info: spu 8
    caption: 0
    language: Suomi
    prefix: 100
    status: 4:3 0 wide 7 letter 7 pan 0
dvd info: spu 9
    caption: 0
    language: Portugues
    prefix: 100
    status: 4:3 0 wide 8 letter 8 pan 0
dvd info: spu 10
    caption: 0
    language: *Hebrew
    prefix: 100
    status: 4:3 0 wide 9 letter 9 pan 0
dvd info: spu 11
    caption: 0
    language: *Polish
    prefix: 100
    status: 4:3 0 wide a letter a pan 0
dvd info: spu 12
    caption: 0
    language: *Greek
    prefix: 100
    status: 4:3 0 wide b letter b pan 0
dvd info: spu 13
    caption: 0
    language: *Czech(Ceske)
    prefix: 100
    status: 4:3 0 wide c letter c pan 0
dvd info: spu 14
    caption: 0
    language: *Turkish
    prefix: 100
    status: 4:3 0 wide d letter d pan 0
dvd info: spu 15
    caption: 0
    language: Magyar
    prefix: 100
    status: 4:3 0 wide e letter e pan 0
dvd info: spu 16
    caption: 0
    language: Islenska
    prefix: 100
    status: 4:3 0 wide f letter f pan 0
dvd info: spu 17
    caption: 0
    language: Hrvatski
    prefix: 100
    status: 4:3 0 wide 10 letter 10 pan 0
dvd info: spu 18
    caption: 0
    language: Francais
    prefix: 100
    status: 4:3 0 wide 11 letter 11 pan 0
dvd info: spu 19
    caption: 0
    language: Italiano
    prefix: 100
    status: 4:3 0 wide 12 letter 12 pan 0
dvd info: spu 20
    caption: 1
    language: English
    prefix: 100
    status: 4:3 0 wide 13 letter 13 pan 0
dvd info: spu 21
    caption: 1
    language: Deutsch
    prefix: 100
    status: 4:3 0 wide 14 letter 14 pan 0
module: locking module `downmix'
module: locking module `imdct'
intf info: menus refreshed as stream has changed
vpar: no vout present, spawning one
module: locking module `sdl'
vout info: asking for 720x576, 15/16 bpp (1440 Bpl)
aout: no aout present, spawning one
module: locking module `dsp'
aout info: signed 16 bits stereo thread
aout info: audio output thread 31205 spawned
aout info: fifo #0 allocated, 2 channels, rate 0
vout: video display initialized (720x576, 16/16 bpp)
vout info: got 720x576, 16/16 bpp (1440 Bpl), masks: 0xf800/0x7e0/0x1f
vout: YUV acceleration unavailable !
module: locking module `yuv'
vpar info: stream periodicity changed from B[1] to B[2]
vout warning: late picture skipped (0x8168d88)
vout warning: late picture skipped (0x8168df4)
vout warning: late picture skipped (0x8168e60)
vout warning: late picture skipped (0x8168d88)
vpar info: stream periodicity changed from P[5] to P[4]
vpar synchro warning: dts != current_pts (-66004)
vout warning: late picture skipped (0x8168d88)
spudec: spu decoder thread 31210 spawned
vout warning: late picture skipped (0x8168d88)
vout warning: late picture skipped (0x8168df4)
vout warning: late picture skipped (0x8168e60)
vout warning: late picture skipped (0x8168df4)
vout warning: late picture skipped (0x8168df4)
vout warning: late picture skipped (0x8168df4)
vout warning: late picture skipped (0x8168d88)
vout warning: late picture skipped (0x8168d88)
vout warning: late picture skipped (0x8168e60)
module: hiding unused plugin module `xvideo'
module: hiding unused plugin module `x11'
vout warning: late picture skipped (0x8168d88)
input: seeking position 206640000/4358815744 (0:02:44/0:57:39)
vpar info: stream periodicity changed from B[2] to B[4]
vpar info: stream periodicity changed from B[4] to B[2]
vpar info: stream periodicity changed from P[4] to P[6]
spudec: trying to gather a 0x6b0 long subtitle
spudec: valid subtitle, size: 420x44, position: 150,444
spudec: cropped to: 420x29, position: 150,452
spudec: total size: 0x6b0, RLE offsets: 0x0 0x342
vpar info: stream periodicity changed from P[6] to P[4]
spudec: trying to gather a 0x340 long subtitle
spudec: valid subtitle, size: 142x44, position: 289,444
spudec: cropped to: 142x29, position: 289,452
spudec: total size: 0x340, RLE offsets: 0x0 0x13c
error: subpicture 0x8168fa4 has invalid status 2
error: subpicture 0x8168ff8 has invalid status 2
spudec: trying to gather a 0x424 long subtitle
Segmentation fault

(BTW, position and total length is incorrect - total length should be
around 1:52:00 not 0:57:39)

I tried to debug it, so I've build a debug version of vlc (./configure
--enable-debug). It crashed almost immediately after movie started
somewhere in signal handling ("unknown signal ?" and then "segmentation
fault"). I found a combination ./configure --enable-debug
--disable-optimizations --disable-ppro --disable-mmx which produced
running (but very slow) debug version of vlc (those --disable-* options
are not needed if I don't want to debug). I tried launching of vlc from
within gdb, but using gdb-4.38 it completely frozed vlc gtk interface when
movie was running (was still running even after froze) and using gdb-5.0
it said :

[New Thread 2049 (LWP 31044)]
[New Thread 1026 (LWP 31045)]
[New Thread 2051 (LWP 31046)]
[New Thread 3076 (LWP 31047)]
[New Thread 4101 (LWP 31048)]
[New Thread 5126 (LWP 31049)]
[New Thread 6151 (LWP 31050)]
ptrace: No such process.

and stopped. So I debugged only corefile produced by segfaulted vlc :

#0  ShowBits (p_bit_stream=0x812efb8, i_bits=23) at include/input_ext-dec.h:247
---Type <return> to continue, or q <return> to quit---
247         if( p_bit_stream->p_byte <= p_bit_stream->p_end - sizeof(WORD_TYPE) )
(gdb) bt
#0  ShowBits (p_bit_stream=0x812efb8, i_bits=23) at include/input_ext-dec.h:247
#1  0x8079a65 in SliceHeader (p_vpar=0x812efb8, pi_mb_address=0xbf5ffa80, i_mb_base=0, i_vert_code=26, b_mpeg2=1,
    i_coding_type=2, i_structure=3) at src/video_parser/vpar_blocks.c:2055
#2  0x80794b0 in vpar_PictureData (p_vpar=0x812efb8, i_mb_base=0, b_mpeg2=1, i_coding_type=2, i_structure=3)
    at src/video_parser/vpar_blocks.c:2088
#3  0x8077aec in vpar_PictureData2PF (p_vpar=0x812efb8, i_mb_base=0) at src/video_parser/vpar_blocks.c:2136
#4  0x8075672 in PictureHeader (p_vpar=0x812efb8) at src/video_parser/vpar_headers.c:844
#5  0x80747ec in vpar_ParseHeader (p_vpar=0x812efb8) at src/video_parser/vpar_headers.c:277
#6  0x807421e in RunThread (p_vpar=0x812efb8) at src/video_parser/video_parser.c:349
#7  0x40055065 in pthread_start_thread (arg=0xbf5ffc00) at manager.c:274
(gdb) print p_bit_stream
$1 = (bit_stream_t *) 0x812efb8
(gdb) print *p_bit_stream
$2 = {fifo = {buffer = 3800039424, i_available = 10}, p_decoder_fifo = 0x812df68,
  pf_next_data_packet = 0x804de28 <NextDataPacket>, pf_bitstream_callback = 0x80744fc <BitstreamCallback>,
  p_callback_arg = 0x812efb8, p_data = 0x8117e78, p_byte = 0x4051324c "Â\212\022 ", p_end = 0x40513808 "",
  i_showbits_buffer = 3003187200, showbits_data = {p_buffer = 0x0, l_size = 0, p_payload_start = 0x0, p_payload_end = 0x0,
    b_discard_payload = 0, pi_refcount = 0x0, p_next = 0x8116978}}
(gdb) print p_bit_stream->p_byte
$3 = (byte_t *) 0x4051324c "Â\212\022 "
(gdb) print p_bit_stream->p_end
$4 = (byte_t *) 0x40513808 ""
(gdb) print p_bit_stream->p_byte <= p_bit_stream->p_end
$5 = 1
(gdb) print p_bit_stream->p_byte <= p_bit_stream->p_end - 4
$6 = 1

As you can see, nothing bad happened there, which totally confuses me. It
is certainlydifferent thread, but I don't know what to do. I gave up this
night.

Have a nice day.

Stepan Roh





More information about the vlc mailing list