crash when mapping empty GstBuffer

[i-n-g-o]

testcode:

        final Element elem = ElementFactory.make("identity", "src");
        final Pad     src  = elem.getStaticPad("src");

        final DATA_PROBE data_probe = new DATA_PROBE() {

            @Override
            public PadProbeReturn dataReceived(final Pad pad, final Buffer buffer) {

                final ByteBuffer data = buffer.map(false);

                // do something with data
                if (data != null) {
                    System.out.println("probeCB: buf with size: " + data.capacity());
                }

                buffer.unmap();
                return PadProbeReturn.OK;
            }
        };

        // add a dataprobe
        src.addDataProbe(data_probe);

        // start element
        elem.play();

        // push buffers to pad
        // crash with 0-size buffers
        // no crash when using a size > 0
        for (int i = 0; i < 2; i++) {
            final Buffer b = new Buffer(0);
            src.push(b);
        }

        elem.stop();

similar code in c does not show this behaviour:

#include <gst/gst.h>

GstPadProbeReturn probeCB (GstPad *pad,
                           GstPadProbeInfo *info,
                           gpointer user_data) {

  GstMapInfo mapinfo;
  // we know what we do, no need to check info for type!
  // directly get buffer from GstPadProbeInfo
  GstBuffer *buf = gst_pad_probe_info_get_buffer(info);
  if (buf != NULL) {
    if (gst_buffer_map (buf, &mapinfo, GST_MAP_READ)) {
      g_print("probeCB: buf with size: %lu\n", mapinfo.size);
    }
    gst_buffer_unmap(buf, &mapinfo);
  }
  return GST_PAD_PROBE_OK;
}

int main (int   argc, char *argv[]) {

  gst_init (&argc, &argv);
  GstElement *src;
  GstPad* pad;
  gulong probeid;
  int i;

  src = gst_element_factory_make ("identity", "src");
  pad = gst_element_get_static_pad(src, "src");
  probeid = gst_pad_add_probe (pad,
                               GST_PAD_PROBE_TYPE_BUFFER,
                               probeCB,
                               NULL,
                               NULL);
  g_print("probe id: %lu\n", probeid);

  // play
  gst_element_set_state (src, GST_STATE_PLAYING);

  for (i=0; i<2; i++) {
    GstBuffer* buf = gst_buffer_new_allocate(NULL, 0, NULL);
    gst_pad_push(pad, buf);
  }

  // stop
  gst_element_set_state (src, GST_STATE_NULL);

  // cleanup
  gst_pad_remove_probe (pad, probeid);
  gst_object_unref (GST_OBJECT (pad));
  gst_object_unref (GST_OBJECT (src));

  return 0;
}

[neilcsmith-net]

Hi! Thanks - I think! 😄 This is a weird one. Not sure if I know what the issue is here yet. Possibly a bug in JNA.

I can replicate with this - can you?

for (int i = 0; i < 200; i++) {
  Buffer b = new Buffer(0);
  ByteBuffer data = b.map(true);
  if (data != null) {
    System.out.println("Got data of size : " + data.capacity());
  }
  b.unmap();
}
System.out.println("Done!");

However, this works - does it for you?

GstBufferAPI.MapInfoStruct mapInfo = new GstBufferAPI.MapInfoStruct();
for (int i = 0; i < 200; i++) {
  Buffer b = GstBufferAPI.GSTBUFFER_API.gst_buffer_new_allocate(null, 0, null);
  // mapInfo = new GstBufferAPI.MapInfoStruct();
  System.out.println("Mapping buffer : " + b.hashCode());
  boolean ok = GstBufferAPI.GSTBUFFER_API.gst_buffer_map(b, mapInfo, GstBufferAPI.GST_MAP_READ);
  if (ok) {
    System.out.println("OK");
    System.out.println(mapInfo);
   } else {
    System.out.println("Not OK");
    System.out.println(mapInfo);
  }
  if (ok) {
    GstBufferAPI.GSTBUFFER_API.gst_buffer_unmap(b, mapInfo);
  }
}
System.out.println("Done!");

But uncommenting the line to create a new mapInfo every time around makes it crash. It's like it's something to do with the structure?

Thoughts?

[neilcsmith-net]

I think the MapInfoStruct we inherited is too small. See -

https://github.com/gstreamer-java/gst1-java-core/blob/master/src/org/freedesktop/gstreamer/lowlevel/GstBufferAPI.java#L44
vs
https://github.com/GStreamer/gstreamer/blob/master/gst/gstmemory.h#L204

In the for loop above if you replace

mapInfo = new GstBufferAPI.MapInfoStruct();

with

mapInfo = new GstBufferAPI.MapInfoStruct(new Memory(200));

it doesn't crash, at least for me. You? That's not the actual size needed obviously! Just big enough. 😄

[i-n-g-o]

hey. yes, your snippets behave the same way here.
it does not crash when creating a MapInfoStruct with a Memory directly.

you are right, the structure we inherit is not correct, we are missing:

        public volatile Pointer[] user_data = new Pointer[4];
        
        public volatile Pointer[] _gst_reserved = new Pointer[GST_PADDING];

i added them, no crash anymore :)

[i-n-g-o]

PR coming up in minute.

guess we should look into all the structures and align them to gst-1.8...

[neilcsmith-net]

Thanks! Didn't have time to work on a fix after finding the issue. An unexpected reason - weird that it's gone unnoticed for this long and not caused other issues. I assume with an empty buffer GStreamer might be doing something with those areas of the structure?

Checking all structures is on my list of jobs that need doing before 1.0 - it's just a matter of finding some free time for all the boring stuff! 😄