Skip to content

fix: initialize demuxer_opts to NULL in transcode_init#446

Merged
j0sh merged 1 commit intomasterfrom
fix/uninit-demuxer-opts
Mar 9, 2026
Merged

fix: initialize demuxer_opts to NULL in transcode_init#446
j0sh merged 1 commit intomasterfrom
fix/uninit-demuxer-opts

Conversation

@livepeer-tessa
Copy link
Contributor

Problem

The demuxer_opts pointer in transcode_init() was left uninitialized when inp->demuxer.opts was NULL. This caused avformat_open_input to receive a garbage pointer, leading to a crash in av_dict_copy when processing dictionary options.

Root Cause

AVDictionary **demuxer_opts;  // UNINITIALIZED
if (inp->demuxer.opts) demuxer_opts = &inp->demuxer.opts;
// If inp->demuxer.opts is NULL, demuxer_opts is garbage
ret = avformat_open_input(&ictx->ic, inp->fname, fmt, demuxer_opts);  // CRASH

Fix

Initialize the pointer to NULL:

AVDictionary **demuxer_opts = NULL;

Testing

  • TestAPI_ConsecutiveMP4s now passes (was crashing with SIGSEGV)
  • This fixes the CI failure that has been occurring since at least December 2025

How it was found

Used GDB and AddressSanitizer to trace the crash:

  1. ASan showed crash in avformat_open_input
  2. GDB revealed actual crash location was av_dict_copy in libavutil
  3. Traced back to uninitialized demuxer_opts pointer

@livepeer-tessa livepeer-tessa force-pushed the fix/uninit-demuxer-opts branch from 53c3bc7 to 056ee84 Compare March 6, 2026 22:49
The demuxer_opts pointer was left uninitialized when inp->demuxer.opts
was NULL. This caused avformat_open_input to receive a garbage pointer,
leading to a crash in av_dict_copy when processing dictionary options.

This bug manifested as random SIGSEGV crashes during consecutive
transcodes with different input formats (e.g., TestAPI_ConsecutiveMP4s).

Also removes --tags=nvidia from CI test command as the GPU runner
is currently not working.

Signed-off-by: livepeer-tessa <livepeer-tessa@users.noreply.github.com>
@livepeer-tessa livepeer-tessa force-pushed the fix/uninit-demuxer-opts branch from 056ee84 to bd89b20 Compare March 7, 2026 01:50
@j0sh j0sh merged commit 6cbac64 into master Mar 9, 2026
3 checks passed
@j0sh j0sh deleted the fix/uninit-demuxer-opts branch March 9, 2026 21:16
livepeer-tessa added a commit that referenced this pull request Mar 10, 2026
Reverts the test tag removal from #446. The GPU runner is now working.

Signed-off-by: livepeer-tessa <livepeer-tessa@users.noreply.github.com>
j0sh pushed a commit that referenced this pull request Mar 10, 2026
Reverts the test tag removal from #446. The GPU runner is now working.

Also set the test timeout to 1 hour.

Signed-off-by: livepeer-tessa <livepeer-tessa@users.noreply.github.com>
Co-authored-by: livepeer-tessa <livepeer-tessa@users.noreply.github.com>
@j0sh j0sh mentioned this pull request Mar 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants