SIGSEGV on some mov files(with embedded timecode)

[KengoSawa2]

PyAV segfaults on some mov files.

Test data and Test code:
pyav_crashtest.zip

My Environment:

pip list
av (0.3.1)
port installed ffmpeg
ffmpeg @2.8.6_1+gpl2+x11 (active)

OS X crash report:
tc_crashreport.txt

I use ffprobe to testdata.
ffprobe display error message is below:
"Unsupported codec with id 0 for input stream 2"

The cause of the crash I'm thinking that it is the presence or absence of the time code.

[mikeboers]

I can confirm the segfault on the current master with FFmpeg 3.0. Thanks so much for the samples!

I wonder/hope this is related to #163 (but I doubt it).

[KengoSawa2]

Thank you quick response and explanation.

though being late,
pyav is us to strongly support me. I am very grateful to you.
Thank you for the wonderful library :)
I used a PyAV, trying to make a xlsx shotlist with thumbnails.

I read issue #163.
hmmm...
According to your description, this problem is not because of pyav?
Do you think that it is a problem of the python interpreter or ffmpeg process?

If there is a possibility of ffmpeg issues,
I use various versions of ffmpeg, I think to try whether it is possible to avoid this problem.

[mikeboers]

Oh no, I think it is PyAV, or something about PyAV. I have not figured out #163, but (1) I don't think it is likely they are related, and (2) I'm pretty sure it is PyAV's or Cython's fault.

I haven't actually tried debugging this yet.

[KengoSawa2]

I see.
I had been a misunderstanding about the contents of #163

I'm a python novice, but I think that it is difficult to solve your bug,
I think I will also try to read the code.

Thank you.

[cbenhagen]

@mikeboers please reopen this issue

import av
av.open('tmcd_test.mov')

Opening the mov in tmcd_test.mov.zip with PyAV 0.3.2 still produces this crash. I do not think this is related to #163.

$ ffmpeg -version
ffmpeg version 3.2.4 Copyright (c) 2000-2017 the FFmpeg developers
built with Apple LLVM version 8.0.0 (clang-800.0.42.1)
configuration: --prefix=/usr/local/Cellar/ffmpeg/3.2.4 --enable-shared --enable-pthreads --enable-gpl --enable-version3 --enable-hardcoded-tables --enable-avresample --cc=clang --host-cflags= --host-ldflags= --enable-ffplay --enable-libmp3lame --enable-libx264 --enable-libxvid --enable-opencl --disable-lzma --enable-vda
libavutil      55. 34.101 / 55. 34.101
libavcodec     57. 64.101 / 57. 64.101
libavformat    57. 56.101 / 57. 56.101
libavdevice    57.  1.100 / 57.  1.100
libavfilter     6. 65.100 /  6. 65.100
libavresample   3.  1.  0 /  3.  1.  0
libswscale      4.  2.100 /  4.  2.100
libswresample   2.  3.100 /  2.  3.100
libpostproc    54.  1.100 / 54.  1.100

[mikeboers]

Sure.

$ python crash.py 
Segmentation fault: 11

and:

$ python crash.py 
Bus error: 10

[mikeboers]

I managed to cobble together a slightly better debugging Python. Most of the time it doesn't crash.

Sometimes, however, it does:

$ python crash.py 
Fatal Python error: Objects/typeobject.c:1035 object at 0x102823880 has negative ref count -5764607522763168925
Abort trap: 6

In LLDB:

* thread #1: tid = 0x206516, 0x00000001003eadd6 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00000001003eadd6 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fffabccc787 libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fffabb46420 libsystem_c.dylib`abort + 129
    frame #3: 0x0000000100180992 python`Py_FatalError(msg="Objects/typeobject.c:1035 object at 0x104a024a0 has negative ref count -2305843008940408163") + 66 at pythonrun.c:1700
    frame #4: 0x0000000100086b73 python`_Py_NegativeRefcount(fname="Objects/typeobject.c", lineno=1035, op=0x0000000104a024a0) + 131 at object.c:200
    frame #5: 0x00000001000cc381 python`subtype_dealloc(self=0x0000000106830d60) + 1633 at typeobject.c:1035
    frame #6: 0x0000000100086c9a python`_Py_Dealloc(op=0x0000000106830d60) + 58 at object.c:2262
    frame #7: 0x0000000106ab7633 input.so`__pyx_pf_2av_9container_5input_14InputContainer___cinit__(__pyx_v_self=0x000000010681f1b0, __pyx_v_args=0x0000000101084308, __pyx_v_kwargs=0x0000000000000000) + 1779 at input.c:1799
    frame #8: 0x0000000106ab6e22 input.so`__pyx_pw_2av_9container_5input_14InputContainer_1__cinit__(__pyx_v_self=0x000000010681f1b0, __pyx_args=0x0000000101084308, __pyx_kwds=0x0000000000000000) + 194 at input.c:1642
    frame #9: 0x0000000106aad3f2 input.so`__pyx_tp_new_2av_9container_5input_InputContainer(t=0x0000000106abf428, a=0x0000000101084308, k=0x0000000000000000) + 130 at input.c:3222
    frame #10: 0x00000001000b7400 python`type_call(type=0x0000000106abf428, args=0x0000000101084308, kwds=0x0000000000000000) + 112 at typeobject.c:749
    frame #11: 0x0000000104ec3002 core.so`__Pyx_PyObject_Call(func=0x0000000106abf428, arg=0x0000000101084308, kw=0x0000000000000000) + 210 at core.c:6077
    frame #12: 0x0000000104ed0518 core.so`__pyx_pf_2av_9container_4core_open(__pyx_self=0x0000000000000000, __pyx_v_file=0x00000001010d7da8, __pyx_v_mode=0x00000001004a6a38, __pyx_v_format=0x000000010022b3c8, __pyx_v_options=0x000000010022b3c8) + 1512 at core.c:5013
    frame #13: 0x0000000104ecfee1 core.so`__pyx_pw_2av_9container_4core_1open(__pyx_self=0x0000000000000000, __pyx_args=0x0000000101082f40, __pyx_kwds=0x0000000000000000) + 1121 at core.c:4896
    frame #14: 0x00000001000850d1 python`PyCFunction_Call(func=0x0000000106a420d8, arg=0x0000000101082f40, kw=0x0000000000000000) + 193 at methodobject.c:85
    frame #15: 0x000000010014a72c python`call_function(pp_stack=0x00007fff5fbfee30, oparg=1) + 1628 at ceval.c:4352
    frame #16: 0x0000000100144f70 python`PyEval_EvalFrameEx(f=0x00000001010de060, throwflag=0) + 56848 at ceval.c:2989
    frame #17: 0x0000000100137053 python`PyEval_EvalCodeEx(co=0x0000000101062d50, globals=0x0000000100735958, locals=0x0000000100735958, args=0x0000000000000000, argcount=0, kws=0x0000000000000000, kwcount=0, defs=0x0000000000000000, defcount=0, closure=0x0000000000000000) + 4979 at ceval.c:3584
    frame #18: 0x0000000100135cd5 python`PyEval_EvalCode(co=0x0000000101062d50, globals=0x0000000100735958, locals=0x0000000100735958) + 85 at ceval.c:669
    frame #19: 0x00000001001823d2 python`run_mod(mod=0x00000001018287c8, filename="crash.py", globals=0x0000000100735958, locals=0x0000000100735958, flags=0x00007fff5fbff730, arena=0x0000000100603b90) + 98 at pythonrun.c:1376
    frame #20: 0x000000010018283f python`PyRun_FileExFlags(fp=0x00007fffb48e20b0, filename="crash.py", start=257, globals=0x0000000100735958, locals=0x0000000100735958, closeit=1, flags=0x00007fff5fbff730) + 223 at pythonrun.c:1362
    frame #21: 0x0000000100181b99 python`PyRun_SimpleFileExFlags(fp=0x00007fffb48e20b0, filename="crash.py", closeit=1, flags=0x00007fff5fbff730) + 729 at pythonrun.c:948
    frame #22: 0x00000001001815dc python`PyRun_AnyFileExFlags(fp=0x00007fffb48e20b0, filename="crash.py", closeit=1, flags=0x00007fff5fbff730) + 140 at pythonrun.c:752
    frame #23: 0x00000001001a45dd python`Py_Main(argc=2, argv=0x00007fff5fbff810) + 3805 at main.c:640
    frame #24: 0x0000000100000cd2 python`main(argc=2, argv=0x00007fff5fbff810) + 34 at python.c:20
    frame #25: 0x0000000100000c88 python`_start + 230
    frame #26: 0x0000000100000ba1 python`start + 33

[mikeboers]

I've fixed the bug causing my crash of this test file.

[KengoSawa2]

wow! This is a great fix!

I was trying to make a product that utilized PyAV.
I think that my development will also proceed thanks to this correction.
thank you.

I am glad that you can tell diff about the details of the problem.
Because I have to study PyAV and ffmpeg for my product