[Live-devel] SIGABRT in base64Decode in liveMedia/Base64.cpp

Wed Jun 18 08:54:15 PDT 2014

Hi Ross,

We have been using live 555 reliably for a couple of years to provide 
the RTSP streams from a CCTV camera we have developed. When testing RTSP 
over HTTP streams (using VLC 2.1.3 as a client) we have found we get one 
of the following error messages after ~65-100 minutes:

*** glibc detected *** /program/name: free(): invalid next size (fast):
or:
*** glibc detected *** /program/name: malloc(): memory corruption:

Running a debug build of live 555 and a debug build of our code through 
gdb (using the Eclipse IDE) we find no stack trace (only disassembly 
code - we are building live 555 with -g3 -O0 -DDEBUG), but the same 
error message. Adding some debug prints to liveMedia/RTSPServer.cpp and 
liveMedia/Base64.cpp we've tracked it down to:
delete[] out;
in base64Decode (line 80) when we get a free(): invalid next size 
(fast): error and:
new unsigned char[resultSize];
in base64Decode (line 78) when we get a malloc(): memory corruption: error.

Attached are two difference files showing the debug I have added. Also 
attached is the debug output I get (all from live 555, save a timestamp 
/ frames per second line our code reports every 75 frames).

Can you suggest what else we can try to pinpoint what is going wrong ? I 
can send more of the debug output if that will help (the 3 bytes left 
from the previous decode drew my attention, this is not unique in the 
debug output, it happened after the previous call to 
RTSPServer::RTSPClientConnection::handleRequestBytes() ).

Many Thanks,

Piers Hawksley
-------------- next part --------------
46,48d45
< #ifdef DEBUG
< #include <stdio.h>
< #endif
59,61d55
< #ifdef DEBUG
< fprintf(stderr, "out=%p\n", out);
< #endif
79,81d72
< #ifdef DEBUG
< fprintf(stderr, "k=%d, paddingCount=%d, inSize=%d\n", k, paddingCount, inSize);
< #endif
84,86d74
< #ifdef DEBUG
< fprintf(stderr, "trimTrailingZeros=1\n");
< #endif
90,92d77
< #ifdef DEBUG
< fprintf(stderr, "resultSize=%d\n", resultSize);
< #endif
94,96d78
< #ifdef DEBUG
< fprintf(stderr, "new result=%p\n", result);
< #endif
98,100d79
< #ifdef DEBUG
< fprintf(stderr, "Moved out to result\n");
< #endif
102,104d80
< #ifdef DEBUG
< fprintf(stderr, "deleted out\n");
< #endif
-------------- next part --------------
895,897d894
< #ifdef DEBUG
< fprintf(stderr, "numBytesToDecode=%d, newBase64RemainderCount=%d\n", numBytesToDecode, newBase64RemainderCount);
< #endif
903d899
< fprintf(stderr, "decodedBytes=%p\n", decodedBytes);
918,920d913
< #ifdef DEBUG
< fprintf(stderr, "Deletedd decodedBytes\n");
< #endif
922,924d914
< #ifdef DEBUG
< fprintf(stderr, "fBase64RemainderCount=%d\n", newBase64RemainderCount);
< #endif
-------------- next part --------------
RTSPClientConnection[0x43200588]::handleRequestBytes() read 443 new bytes:R0VUX1BBUkFNRVRFUiBydHNwOi8vMTAuMjYuNy44MC9zdHJlYW0xLyBSVFNQLzEuMA0KQ1NlcTogNzQNCkF1dGhvcml6YXRpb246IERpZ2VzdCB1c2VybmFtZT0iQWRtaW4iLCByZWFsbT0iTElWRTU1NSBTdHJlYW1pbmcgTWVkaWEiLCBub25jZT0iOWM1MzhhYmE0Y2MxZDAwOWY0YWRkMjc3ZDljODYwYzUiLCB1cmk9InJ0c3A6Ly8xMC4yNi43LjgwL3N0cmVhbTEvIiwgcmVzcG9uc2U9IjhiNjljYmEyZDc0N2Q4ODYwMTNiYmEyMjJjZDhlYTYxIg0KVXNlci1BZ2VudDogTGliVkxDLzIuMS4zIChMSVZFNTU1IFN0cmVhbWluZyBNZWRpYSB2MjAxNC4wMS4yMSkNClNlc3Npb246IDMwRTY
numBytesToDecode=440, newBase64RemainderCount=3
out=0x27cd60
k=330, paddingCount=0, inSize=440
trimTrailingZeros=1
resultSize=330
new result=0x27cf20
Moved out to result
deleted out
decodedBytes=0x27cf20
Base64-decoded 440 input bytes into 330 new bytes:GET_PARAMETER rtsp://10.26.7.80/stream1/ RTSP/1.0
CSeq: 74
Authorization: Digest username="Admin", realm="LIVE555 Streaming Media", nonce="9c538aba4cc1d009f4add277d9c860c5", uri="rtsp://10.26.7.80/stream1/", response="8b69cba2d747d886013bba222cd8ea61"
User-Agent: LibVLC/2.1.3 (LIVE555 Streaming Media v2014.01.21)
Session: 30
Deletedd decodedBytes
fBase64RemainderCount=3
RTSPClientConnection[0x43200588]::handleRequestBytes() read 13 new bytes:zM0M2DQoNCg==
numBytesToDecode=16, newBase64RemainderCount=0
out=0x183790
k=12, paddingCount=2, inSize=16
trimTrailingZeros=1
resultSize=10
new result=0x1837f0
Moved out to result
deleted out
decodedBytes=0x1837f0
Base64-decoded 16 input bytes into 10 new bytes:33C6

Deletedd decodedBytes
fBase64RemainderCount=0
parseRTSPRequestString() failed; checking now for HTTP commands (for RTSP-over-HTTP tunneling)...
parseHTTPRequestString() failed!
sending response: RTSP/1.0 400 Bad Request
Date: Wed, Jun 18 2014 14:16:13 GMT
Allow: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE, GET_PARAMETER, SET_PARAMETER

RTSPClientConnection[0x43200588]::handleRequestBytes() processing 3 new bytes:oNC
numBytesToDecode=0, newBase64RemainderCount=3
fBase64RemainderCount=3
[18/06/14-14:16:14][003995.819]:#099854:FPS = 24.79 FPS = 25.21 FPS = 24.92 FPS = 25.08 FPS = 25.00 MaxTimes: Frame=55ms, Loop=41ms, Grab=11ms, Check=1ms
schedule(0.574857->1403100975.316782)
sending REPORT
sending RTCP packet
 80c80006 d8c5f75c d74c1daf 3c925786 7b637937 00097977 2dbffcd3 81ca0005 d8c5f75c 010a414d 47373130 302d5645 00000000
schedule(3.593662->1403100978.845060)
sending REPORT
sending RTCP packet
 80c80006 2c617b15 d74c1daf 517fc760 5b40ea9a 0006d150 1e99ec21 81ca0005 2c617b15 010a414d 47373130 302d5645 00000000
reap: checking SSRC 0x7c51cba0: 764 (threshold 760)
schedule(5.363281->1403100980.684468)
[0x21bd50]saw incoming RTCP packet
 81c90007 334a8ed0 d8c5f75c 00ffffff 000b47ad 000003c7 1daf3c92 000027e7 81ca0005 334a8ed0 010a5041 4e4f3130 312d5043 00000000
RR
RTSP client session (id "70967B5D", stream name "stream0"): Liveness indication
validated RTCP subpacket (type 2): 1, 201, 0, 0x334a8ed0
UNSUPPORTED TYPE(0xca)
validated RTCP subpacket (type 2): 1, 202, 16, 0x334a8ed0
validated entire RTCP packet
[0x43205d70]saw incoming RTCP packet
 81c90007 7c51cba0 2c617b15 00ffffff 0008be55 0000009b 1daf517f 00015410 81ca0005 7c51cba0 010a5041 4e4f3130 312d5043 00000000
RR
RTSP client session (id "30E633C6", stream name "stream1"): Liveness indication
validated RTCP subpacket (type 2): 1, 201, 0, 0x7c51cba0
UNSUPPORTED TYPE(0xca)
validated RTCP subpacket (type 2): 1, 202, 16, 0x7c51cba0
validated entire RTCP packet
[18/06/14-14:16:17][003998.822]:#099929:FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 24.88 MaxTimes: Frame=68ms, Loop=55ms, Grab=29ms, Check=2ms
sending REPORT
sending RTCP packet
 80c80006 d8c5f75c d74c1db2 d91c2a02 7b686ee0 00097bcc 2dcb57db 81ca0005 d8c5f75c 010a414d 47373130 302d5645 00000000
schedule(5.660181->1403100984.512551)
[18/06/14-14:16:20][004001.819]:#100004:FPS = 25.13 FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 25.00 MaxTimes: Frame=58ms, Loop=45ms, Grab=11ms, Check=16ms
[0x21bd50]saw incoming RTCP packet
 81c90007 334a8ed0 d8c5f75c 00ffffff 000b4aa2 000000a1 1db2d91c 0001282e 81ca0005 334a8ed0 010a5041 4e4f3130 312d5043 00000000
RR
RTSP client session (id "70967B5D", stream name "stream0"): Liveness indication
validated RTCP subpacket (type 2): 1, 201, 0, 0x334a8ed0
UNSUPPORTED TYPE(0xca)
validated RTCP subpacket (type 2): 1, 202, 16, 0x334a8ed0
validated entire RTCP packet
sending REPORT
sending RTCP packet
 80c80006 2c617b15 d74c1db4 af6805a3 5b484960 0006d3bd 1ea488b6 81ca0005 2c617b15 010a414d 47373130 302d5645 00000000
schedule(6.056709->1403100986.744148)
[0x43205d70]saw incoming RTCP packet
 81c90007 7c51cba0 2c617b15 00ffffff 0008c115 00000242 1db4af68 000217b8 81ca0005 7c51cba0 010a5041 4e4f3130 312d5043 00000000
RR
RTSP client session (id "30E633C6", stream name "stream1"): Liveness indication
validated RTCP subpacket (type 2): 1, 201, 0, 0x7c51cba0
UNSUPPORTED TYPE(0xca)
validated RTCP subpacket (type 2): 1, 202, 16, 0x7c51cba0
validated entire RTCP packet
[18/06/14-14:16:23][004004.819]:#100079:FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 25.00 MaxTimes: Frame=70ms, Loop=43ms, Grab=16ms, Check=2ms
sending REPORT
sending RTCP packet
 80c80006 d8c5f75c d74c1db8 835ff60a 7b703682 00097f84 2ddda4d1 81ca0005 d8c5f75c 010a414d 47373130 302d5645 00000000
schedule(4.551251->1403100989.066624)
[0x21bd50]saw incoming RTCP packet
 81c90007 334a8ed0 d8c5f75c 00ffffff 000b4d99 00000144 1db8835f 0000087c 81ca0005 334a8ed0 010a5041 4e4f3130 312d5043 00000000
RR
RTSP client session (id "70967B5D", stream name "stream0"): Liveness indication
validated RTCP subpacket (type 2): 1, 201, 0, 0x334a8ed0
UNSUPPORTED TYPE(0xca)
validated RTCP subpacket (type 2): 1, 202, 16, 0x334a8ed0
validated entire RTCP packet
[18/06/14-14:16:26][004007.819]:#100154:FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 25.00 FPS = 25.00 MaxTimes: Frame=67ms, Loop=55ms, Grab=11ms, Check=3ms
sending REPORT
sending RTCP packet
 80c80006 2c617b15 d74c1dba bedd377e 5b509bfb 0006d675 1eb07c21 81ca0005 2c617b15 010a414d 47373130 302d5645 00000000
schedule(6.012983->1403100992.764981)
[0x43205d70]saw incoming RTCP packet
 81c90007 7c51cba0 2c617b15 00ffffff 0008c30d 0000009c 1dbabedd 00006eb2 81ca0005 7c51cba0 010a5041 4e4f3130 312d5043 00000000
RR
RTSP client session (id "30E633C6", stream name "stream1"): Liveness indication
validated RTCP subpacket (type 2): 1, 201, 0, 0x7c51cba0
UNSUPPORTED TYPE(0xca)
validated RTCP subpacket (type 2): 1, 202, 16, 0x7c51cba0
validated entire RTCP packet
[18/06/14-14:16:29][004010.818]:#100229:FPS = 25.00 FPS = 24.19 FPS = 25.86 FPS = 25.00 FPS = 25.00 MaxTimes: Frame=60ms, Loop=45ms, Grab=10ms, Check=2ms
schedule(0.131993->1403100989.199001)
schedule(0.002769->1403100989.203301)
sending REPORT
sending RTCP packet
 80c80006 d8c5f75c d74c1dbd 34a86d72 7b76a839 0009829e 2dece3e3 81ca0005 d8c5f75c 010a414d 47373130 302d5645 00000000
schedule(3.590446->1403100992.812293)
RTSPClientConnection[0x1b64b8]::handleRequestBytes() read 456 new bytes:R0VUX1BBUkFNRVRFUiBydHNwOi8vMTAuMjYuNy44MC9zdHJlYW0wLyBSVFNQLzEuMA0KQ1NlcTogNzUNCkF1dGhvcml6YXRpb246IERpZ2VzdCB1c2VybmFtZT0iQWRtaW4iLCByZWFsbT0iTElWRTU1NSBTdHJlYW1pbmcgTWVkaWEiLCBub25jZT0iYTlmMDA1ODBlYTA2ZDMxYmIxNWI1ZTU4OTk1ZGFmNmIiLCB1cmk9InJ0c3A6Ly8xMC4yNi43LjgwL3N0cmVhbTAvIiwgcmVzcG9uc2U9ImMwZDgzNGQyNGY4NjE5ZjdiOTU3NmNmZjE4YjRjN2UyIg0KVXNlci1BZ2VudDogTGliVkxDLzIuMS4zIChMSVZFNTU1IFN0cmVhbWluZyBNZWRpYSB2MjAxNC4wMS4yMSkNClNlc3Npb246IDcwOTY3QjVEDQoNCg==
numBytesToDecode=456, newBase64RemainderCount=3
out=0x183830
k=342, paddingCount=0, inSize=456
trimTrailingZeros=1
resultSize=342
new result=0x27cd48
Moved out to result
*** glibc detected *** /program/name: free(): invalid next size (fast): 0x00183830 ***