alephone / ffmpeg segfault when starting Excalibur: Morgana's Revenge

[orbea]

OS: Slackware64-current
alephone: 512319b
ffmpeg: FFmpeg/FFmpeg@70463b7

When trying to play the scenario Excalibur: Morgana's Revenge Alephone will segfault in FFMPEG code as soon as a new game is started by selecting Embark.

Thread 1 "alephone" received signal SIGSEGV, Segmentation fault.
0x00007ffff59bb507 in free_side_data (ptr_sd=0x0) at libavutil/frame.c:170
170	    AVFrameSideData *sd = *ptr_sd;
(gdb) bt
#0  0x00007ffff59bb507 in free_side_data (ptr_sd=0x0) at libavutil/frame.c:170
#1  wipe_side_data (frame=<optimized out>) at libavutil/frame.c:182
#2  av_frame_unref (frame=frame@entry=0x7fffffffd7b0) at libavutil/frame.c:560
#3  0x00007ffff5e65d2a in avcodec_receive_frame (avctx=avctx@entry=0x1285d00, 
    frame=frame@entry=0x7fffffffd7b0) at libavcodec/decode.c:745
#4  0x00007ffff5e67ecb in compat_decode (avctx=0x1285d00, frame=0x7fffffffd7b0, 
    got_frame=0x7fffffffd9cc, pkt=0xd72ec0) at libavcodec/decode.c:809
#5  0x000000000086fa69 in SDL_ffmpegDecodeAudioFrame (file=0xc67710, 
    pack=0xd72ec0, frame=0xda8b80) at SDL_ffmpeg.c:2065
#6  0x000000000086ecf2 in SDL_ffmpegGetAudioFrame (file=0xc67710, frame=0xda8b80)
    at SDL_ffmpeg.c:1228
#7  0x0000000000653d28 in show_movie (index=0) at interface.cpp:3118
#8  0x00000000006525b2 in begin_game (user=0, cheat=false) at interface.cpp:2176
#9  0x000000000064efeb in do_menu_item_command (menu_id=129, menu_item=1, 
    cheat=false) at interface.cpp:1398
#10 0x0000000000653256 in handle_interface_menu_screen_click (x=196, y=199, 
    cheatkeys_down=false) at interface.cpp:2705
#11 0x000000000064f17c in portable_process_screen_click (x=196, y=199, 
    cheatkeys_down=false) at interface.cpp:1495
#12 0x000000000041a7e4 in process_screen_click (event=...) at shell.cpp:838
#13 0x000000000041beb0 in process_event (event=...) at shell.cpp:1373
#14 0x000000000041a67a in main_event_loop () at shell.cpp:800
#15 0x000000000041855f in main (argc=0, argv=0x7fffffffe238) at shell.cpp:346

Full GDB log - https://pastebin.com/YZ1qSnCC

This can be worked around by building alephone with --without-ffmpeg.

The Excalibur: Morgana's Revenge website seems down so I uploaded the source I downloaded a while ago.

http://slackless.raccoons.tech/src/emr-3.0-0602.tgz

md5sum - 21afa8e5cca3ca474873f8cd45b8a6c1
sha512sum - 6a1c019abe365c6297b4d09841e8dc818f14f35474adeabfba9e26965ca39a2b23c8b9ac1b1f4eb286d61d9fa5ec72079d748ca8fdf6e246138d9147a2fb4bb8

To start the scenario.

alephone emr-3.0/share-emr/

For more information on this scenario see:
http://traxus.bungie.org/index.php/Excalibur:_Morgana%27s_Revenge
http://excaliburworld.com/emr/ (Dead link?)

[orbea]

I asked about this issue in #ffmpeg-devel and was linked this.

alephone/Source_Files/FFmpeg/SDL_ffmpeg.c

Line 2060 in c29cff6

AVFrame dframe;

The explanation for the crash is that frame on stack is uninitialized and sizeof(AVFrame) should not be used since its not part of the public ABI. Instead a frame should be allocated with av_frame_alloc() and not in the stack.

[orbea]

Additionally there is a comment about this in the ffmpeg code.

 * sizeof(AVFrame) is not a part of the public ABI, so new fields may be added
 * to the end with a minor bump.

https://github.com/FFmpeg/FFmpeg/blob/4e9cff2824769e792c7867b09e1efb67278abe79/libavutil/frame.h#L219

[orbea]

@Hopper262 If possible it would be great if this one could be fixed before the next stable release. :)

[Hopper262]

Your EMR link gives a 403 Forbidden error, so I couldn't replicate this bug, but try master and see if it's fixed.

[orbea]

Sorry, I fixed the permissions on the EMR link, it should be accessible now.

Additionally your fix worked! It now successfully plays a short intro video which was missing when compiled with --without-ffmpeg and then starts the game. Thanks!

[Hopper262]

Great to hear! Eventually I'll rewrite the FFmpeg code to remove the deprecated APIs, but that might take a while so it's good we fixed this. Thanks for doing the legwork to track the problem down.

I grabbed the EMR tarball too, so I'll be ready if you find another bug with it. :)