audio-meta: Transform function causes critical warnings when partially copying buffers (#779) · Issues · GStreamer / gst-plugins-base

audio-meta: Transform function causes critical warnings when partially copying buffers

Can be reproduced with the following pipeline (before gst-plugins-bad!1363 (merged))

gst-launch-1.0 audiotestsrc ! audio/x-raw,channels=2,layout=non-interleaved ! audiobuffersplit ! audioconvert ! fakesink

This is of course wrong because audiobuffersplit does not support non-interleaved audio yet, but correct adapter usage shouldn't cause critical warnings even if it's corrupting the data.

** (gst-launch-1.0:507356): CRITICAL **: 09:47:33.647: GstAudioMeta properties would cause out-of-bounds memory access on the buffer: max_offset 2048, samples 1024, bps 2, buffer size 3528

Thread 2 "audiotestsrc0:s" received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0x7ffff7354700 (LWP 507361)]
_g_log_abort (breakpoint=1) at ../../../glib/gmessages.c:554
(gdb) bt
#0  _g_log_abort (breakpoint=1) at ../../../glib/gmessages.c:554
#1  0x00007ffff7d1f869 in g_logv (log_domain=0x0, log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, args=args@entry=0x7ffff7353670) at ../../../glib/gmessages.c:1373
#2  0x00007ffff7d1fa2f in g_log
    (log_domain=log_domain@entry=0x0, log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, format=format@entry=0x7ffff7575748 "GstAudioMeta properties would cause out-of-bounds memory access on the buffer: max_offset %lu, samples %lu, bps %u, buffer size %lu") at ../../../glib/gmessages.c:1415
#3  0x00007ffff755e03e in gst_buffer_add_audio_meta (buffer=0x5555557d66c0 [GstBuffer], info=0x7ffff000e0b0, samples=<optimized out>, offsets=0x7ffff000e200) at gstaudiometa.c:449
#4  0x00007ffff755e07b in gst_audio_meta_transform (buffer=<optimized out>, type=<optimized out>, data=<optimized out>, meta=<optimized out>, dest=<optimized out>) at gstaudiometa.c:342
#5  gst_audio_meta_transform (dest=<optimized out>, meta=<optimized out>, buffer=<optimized out>, type=<optimized out>, data=<optimized out>) at gstaudiometa.c:334
#6  0x00007ffff7e8dce2 in gst_buffer_copy_into
    (size=3528, offset=0, flags=(GST_BUFFER_COPY_FLAGS | GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_META | GST_BUFFER_COPY_MEMORY), src=<optimized out>, dest=0x5555557d66c0 [GstBuffer]) at gstbuffer.c:678
#7  gst_buffer_copy_into
    (dest=0x5555557d66c0 [GstBuffer], src=<optimized out>, flags=(GST_BUFFER_COPY_FLAGS | GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_META | GST_BUFFER_COPY_MEMORY), offset=0, size=<optimized out>) at gstbuffer.c:527
#8  0x00007ffff7e8f098 in gst_buffer_copy_region
    (buffer=0x5555557d65a0 [GstBuffer], flags=flags@entry=(GST_BUFFER_COPY_FLAGS | GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_META | GST_BUFFER_COPY_MEMORY), offset=0, size=size@entry=3528) at gstbuffer.c:2119
#9  0x00007ffff74a7537 in gst_adapter_get_buffer (adapter=adapter@entry=0x5555557d6000 [GstAdapter], nbytes=nbytes@entry=3528) at gstadapter.c:995
#10 0x00007ffff74a7612 in gst_adapter_take_buffer (adapter=0x5555557d6000 [GstAdapter], nbytes=nbytes@entry=3528) at gstadapter.c:1076
#11 0x00007ffff75c191a in gst_audio_buffer_split_output
    (self=self@entry=0x5555557d4030 [GstAudioBufferSplit|audiobuffersplit0], force=force@entry=0, rate=rate@entry=44100, bpf=bpf@entry=4, samples_per_buffer=samples_per_buffer@entry=882) at gstaudiobuffersplit.c:379
#12 0x00007ffff75c31ad in gst_audio_buffer_split_sink_chain (pad=<optimized out>, parent=0x5555557d4030 [GstAudioBufferSplit|audiobuffersplit0], buffer=0x5555557d65a0 [GstBuffer])
    at gstaudiobuffersplit.c:679
#13 0x00007ffff7ec5b0f in gst_pad_chain_data_unchecked (pad=pad@entry=0x5555557d2400 [GstPad|sink], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4327
#14 0x00007ffff7ec7b71 in gst_pad_push_data (pad=pad@entry=0x5555557d31e0 [GstPad|src], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4583
#15 0x00007ffff7ece823 in gst_pad_push (pad=0x5555557d31e0 [GstPad|src], buffer=0x5555557d65a0 [GstBuffer]) at gstpad.c:4702
#16 0x00007ffff74da750 in gst_base_transform_chain (pad=<optimized out>, parent=0x5555557e6350 [GstCapsFilter|capsfilter0], buffer=<optimized out>) at gstbasetransform.c:2330
#17 0x00007ffff7ec5b0f in gst_pad_chain_data_unchecked (pad=pad@entry=0x5555557d2f90 [GstPad|sink], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4327
#18 0x00007ffff7ec7b71 in gst_pad_push_data (pad=pad@entry=0x5555557d21b0 [GstPad|src], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4583
#19 0x00007ffff7ece823 in gst_pad_push (pad=pad@entry=0x5555557d21b0 [GstPad|src], buffer=0x5555557d65a0 [GstBuffer]) at gstpad.c:4702
#20 0x00007ffff74d6345 in gst_base_src_loop (pad=0x5555557d21b0 [GstPad|src]) at gstbasesrc.c:2974
#21 0x00007ffff7efc2cf in gst_task_func (task=0x5555557d6170 [GstTask|audiotestsrc0:src]) at gsttask.c:328
#22 0x00007ffff7d41d94 in g_thread_pool_thread_proxy (data=<optimized out>) at ../../../glib/gthreadpool.c:354
#23 0x00007ffff7d4152d in g_thread_proxy (data=0x555555560aa0) at ../../../glib/gthread.c:807
#24 0x00007ffff7caff27 in start_thread (arg=<optimized out>) at pthread_create.c:479
#25 0x00007ffff7be131f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

CC @gkiagia

Can be reproduced with the following pipeline (before https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/1363)

```sh
gst-launch-1.0 audiotestsrc ! audio/x-raw,channels=2,layout=non-interleaved ! audiobuffersplit ! audioconvert ! fakesink
```

This is of course wrong because `audiobuffersplit` does not support non-interleaved audio yet, but correct adapter usage shouldn't cause critical warnings even if it's corrupting the data.

```
** (gst-launch-1.0:507356): CRITICAL **: 09:47:33.647: GstAudioMeta properties would cause out-of-bounds memory access on the buffer: max_offset 2048, samples 1024, bps 2, buffer size 3528

Thread 2 "audiotestsrc0:s" received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0x7ffff7354700 (LWP 507361)]
_g_log_abort (breakpoint=1) at ../../../glib/gmessages.c:554
(gdb) bt
#0  _g_log_abort (breakpoint=1) at ../../../glib/gmessages.c:554
#1  0x00007ffff7d1f869 in g_logv (log_domain=0x0, log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, args=args@entry=0x7ffff7353670) at ../../../glib/gmessages.c:1373
#2  0x00007ffff7d1fa2f in g_log
    (log_domain=log_domain@entry=0x0, log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, format=format@entry=0x7ffff7575748 "GstAudioMeta properties would cause out-of-bounds memory access on the buffer: max_offset %lu, samples %lu, bps %u, buffer size %lu") at ../../../glib/gmessages.c:1415
#3  0x00007ffff755e03e in gst_buffer_add_audio_meta (buffer=0x5555557d66c0 [GstBuffer], info=0x7ffff000e0b0, samples=<optimized out>, offsets=0x7ffff000e200) at gstaudiometa.c:449
#4  0x00007ffff755e07b in gst_audio_meta_transform (buffer=<optimized out>, type=<optimized out>, data=<optimized out>, meta=<optimized out>, dest=<optimized out>) at gstaudiometa.c:342
#5  gst_audio_meta_transform (dest=<optimized out>, meta=<optimized out>, buffer=<optimized out>, type=<optimized out>, data=<optimized out>) at gstaudiometa.c:334
#6  0x00007ffff7e8dce2 in gst_buffer_copy_into
    (size=3528, offset=0, flags=(GST_BUFFER_COPY_FLAGS | GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_META | GST_BUFFER_COPY_MEMORY), src=<optimized out>, dest=0x5555557d66c0 [GstBuffer]) at gstbuffer.c:678
#7  gst_buffer_copy_into
    (dest=0x5555557d66c0 [GstBuffer], src=<optimized out>, flags=(GST_BUFFER_COPY_FLAGS | GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_META | GST_BUFFER_COPY_MEMORY), offset=0, size=<optimized out>) at gstbuffer.c:527
#8  0x00007ffff7e8f098 in gst_buffer_copy_region
    (buffer=0x5555557d65a0 [GstBuffer], flags=flags@entry=(GST_BUFFER_COPY_FLAGS | GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_META | GST_BUFFER_COPY_MEMORY), offset=0, size=size@entry=3528) at gstbuffer.c:2119
#9  0x00007ffff74a7537 in gst_adapter_get_buffer (adapter=adapter@entry=0x5555557d6000 [GstAdapter], nbytes=nbytes@entry=3528) at gstadapter.c:995
#10 0x00007ffff74a7612 in gst_adapter_take_buffer (adapter=0x5555557d6000 [GstAdapter], nbytes=nbytes@entry=3528) at gstadapter.c:1076
#11 0x00007ffff75c191a in gst_audio_buffer_split_output
    (self=self@entry=0x5555557d4030 [GstAudioBufferSplit|audiobuffersplit0], force=force@entry=0, rate=rate@entry=44100, bpf=bpf@entry=4, samples_per_buffer=samples_per_buffer@entry=882) at gstaudiobuffersplit.c:379
#12 0x00007ffff75c31ad in gst_audio_buffer_split_sink_chain (pad=<optimized out>, parent=0x5555557d4030 [GstAudioBufferSplit|audiobuffersplit0], buffer=0x5555557d65a0 [GstBuffer])
    at gstaudiobuffersplit.c:679
#13 0x00007ffff7ec5b0f in gst_pad_chain_data_unchecked (pad=pad@entry=0x5555557d2400 [GstPad|sink], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4327
#14 0x00007ffff7ec7b71 in gst_pad_push_data (pad=pad@entry=0x5555557d31e0 [GstPad|src], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4583
#15 0x00007ffff7ece823 in gst_pad_push (pad=0x5555557d31e0 [GstPad|src], buffer=0x5555557d65a0 [GstBuffer]) at gstpad.c:4702
#16 0x00007ffff74da750 in gst_base_transform_chain (pad=<optimized out>, parent=0x5555557e6350 [GstCapsFilter|capsfilter0], buffer=<optimized out>) at gstbasetransform.c:2330
#17 0x00007ffff7ec5b0f in gst_pad_chain_data_unchecked (pad=pad@entry=0x5555557d2f90 [GstPad|sink], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4327
#18 0x00007ffff7ec7b71 in gst_pad_push_data (pad=pad@entry=0x5555557d21b0 [GstPad|src], type=type@entry=4112, data=data@entry=0x5555557d65a0) at gstpad.c:4583
#19 0x00007ffff7ece823 in gst_pad_push (pad=pad@entry=0x5555557d21b0 [GstPad|src], buffer=0x5555557d65a0 [GstBuffer]) at gstpad.c:4702
#20 0x00007ffff74d6345 in gst_base_src_loop (pad=0x5555557d21b0 [GstPad|src]) at gstbasesrc.c:2974
#21 0x00007ffff7efc2cf in gst_task_func (task=0x5555557d6170 [GstTask|audiotestsrc0:src]) at gsttask.c:328
#22 0x00007ffff7d41d94 in g_thread_pool_thread_proxy (data=<optimized out>) at ../../../glib/gthreadpool.c:354
#23 0x00007ffff7d4152d in g_thread_proxy (data=0x555555560aa0) at ../../../glib/gthread.c:807
#24 0x00007ffff7caff27 in start_thread (arg=<optimized out>) at pthread_create.c:479
#25 0x00007ffff7be131f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

CC @gkiagia

Edited Jun 23, 2020 by Sebastian Dröge