Dear Maintainer,
ffmpeg segfaults in "buffer_pool_flush" when called from the kvazaar test "test_invalid_input.sh" (see #1127385).
These are information to reproduce and some of my first findings.
Command:
ffmpeg -f lavfi -i mandelbrot=size=1x65 -vframes 1 -pix_fmt yuv420p -f yuv4mpegpipe /tmp/tmp.TfM9llmcRd
Output (tested in virtual machine to reproduce issue from buildd):
----------
ffmpeg version 8.0.1-3+b1 Copyright (c) 2000-2025 the FFmpeg developers
built with gcc 15 (Debian 15.2.0-12)
configuration: --prefix=/usr --extra-version=3+b1 --toolchain=hardened --libdir=/usr/lib/loongarch64-linux-gnu --incdir=/usr/include/loongarch64-linux-gnu --arch=loong64 --enable-gpl --disable-stripping --disable-pocketsphinx --disable-libcaca --disable-libmfx --disable-omx --enable-gnutls --enable-libaom --enable-libass --enable-libbs2b --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libglslang --enable-libgme --enable-libgsm --enable-libharfbuzz --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-openal --enable-opencl --enable-opengl --disable-sndio --disable-libvpl --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-chromaprint --enable-frei0r --enable-ladspa --enable-libbluray --enable-libdvdnav --enable-libdvdread --enable-libjack --enable-libjxl --enable-libpulse --enable-librabbitmq --enable-librist --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libx264 --enable-libzmq --enable-libzvbi --enable-lv2 --enable-sdl2 --enable-libplacebo --enable-librav1e --enable-librsvg --enable-shared
libavutil 60. 8.100 / 60. 8.100
libavcodec 62. 11.100 / 62. 11.100
libavformat 62. 3.100 / 62. 3.100
libavdevice 62. 1.100 / 62. 1.100
libavfilter 11. 4.100 / 11. 4.100
libswscale 9. 1.100 / 9. 1.100
libswresample 6. 1.100 / 6. 1.100
Input #0, lavfi, from 'mandelbrot=size=1x65':
Duration: N/A, start: 0.000000, bitrate: N/A
Stream #0:0: Video: wrapped_avframe, rgb0, 1x65 [SAR 1:1 DAR 1:65], 25 fps, 25 tbr, 25 tbn
Stream mapping:
Stream #0:0 -> #0:0 (wrapped_avframe (native) -> wrapped_avframe (native))
Press [q] to stop, [?] for help
Output #0, yuv4mpegpipe, to '/tmp/tmp.TfM9llmcRd':
Metadata:
encoder : Lavf62.3.100
Stream #0:0: Video: wrapped_avframe, yuv420p(progressive), 1x65 [SAR 1:1 DAR 1:65], q=2-31, 200 kb/s, 25 fps, 25 tbn
Metadata:
encoder : Lavc62.11.100 wrapped_avframe
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault (core dumped)
----------
I attached a remote gdb and got this stack trace:
----------
Thread 2 received signal SIGSEGV, Segmentation fault.
[Switching to Thread 92632.92650]
0x00007fd9d8e509a4 in ?? () from target:/usr/lib/loongarch64-linux-gnu/libc.so.6
(gdb) bt
#0 0x00007fd9d8e509a4 in ?? () from target:/usr/lib/loongarch64-linux-gnu/libc.so.6
#1 0x00007fd9d8e50c7c in ?? () from target:/usr/lib/loongarch64-linux-gnu/libc.so.6
#2 0x00007fd9c90fc9dc in buffer_pool_flush (pool=0x7fd9ac0021e0) at src/libavutil/buffer.c:308
#3 av_buffer_pool_uninit (ppool=<optimized out>) at src/libavutil/buffer.c:338
#4 0x00007fd9d982359c in ff_frame_pool_uninit (pool=<optimized out>) at src/libavfilter/framepool.c:291
#5 ff_frame_pool_uninit (pool=0x7fd9ac002d78) at src/libavfilter/framepool.c:283
#6 0x00007fd9d97f2bf4 in link_free (link=0x7fd9bc8433f8) at src/libavfilter/avfilter.c:207
#7 free_link (link=<optimized out>) at src/libavfilter/avfilter.c:791
#8 0x00007fd9d97f46d0 in avfilter_free (filter=0x7fd9ac002880) at src/libavfilter/avfilter.c:815
#9 0x00007fd9d97f757c in avfilter_graph_free (graphp=0x7fd9bc8434c8) at src/libavfilter/avfiltergraph.c:128
#10 0x00007fd9dad81768 in ?? ()
#11 0x00007fd9dad94488 in ?? ()
#12 0x00007fd9d8e3e504 in ?? () from target:/usr/lib/loongarch64-linux-gnu/libc.so.6
#13 0x00007fd9d8ebb350 in ?? () from target:/usr/lib/loongarch64-linux-gnu/libc.so.6
(gdb) f 2
#2 0x00007fd9c90fc9dc in buffer_pool_flush (pool=0x7fd9ac0021e0) at src/libavutil/buffer.c:308
308 in src/libavutil/buffer.c
(gdb) p *buf
$1 = {data = 0x7fd9ac07e0e0 "\244", opaque = 0x0, free = 0x7fd9c90fbdc0 <av_buffer_default_free>, pool = 0x7fd9ac0021e0, next = 0x7fd9ac011660, buffer = {
data = 0x0, size = 0, refcount = 0, free = 0x0, opaque = 0x0, flags = 0, flags_internal = 0}}
----------
Thanks,
Joachim