search

ossrs / srs

SRS is a simple, high-efficiency, real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181.
https://ossrs.io
MIT License
24.86k stars 5.29k forks source link

SRS crash when we publish invalid streaming with dash stream setting #3770

Closed 5centscdn closed 10 months ago

5centscdn commented 11 months ago

Note: Please read FAQ before file an issue, see #2716

Description

Please description your issue here

  1. SRS Version: 6.0.65

  2. SRS Log:

[2023-08-16 20:59:07.220][INFO][2567][8h833a55] connected stream, tcUrl=rtmp://207.188.7.80:1935/arena1, pageUrl=, swfUrl=, schema=rtmp, vhost=__defaultVhost__, port=1935, app=arena1, stream=main, param=, args=null
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] new live source, stream_url=/arena1/main
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] source url=/arena1/main, ip=207.188.7.80, cache=1/2500, is_edge=0, source_id=/
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] DASH: Config fragment=10000ms, period=10000ms, window=3, timeshit=300000ms, home=./objs/nginx/html, mpd=[app]/[stream].mpd
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] ignore disabled exec for vhost=__defaultVhost__
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] start publish mr=0/350, p1stpt=20000, pnt=5000, tcp_nodelay=0
ASAN:DEADLYSIGNAL
=================================================================
==2567==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x559b81754d17 bp 0x7fba38d4b0d0 sp 0x7fba38d4b0b0 T1)
==2567==The signal is caused by a READ memory access.
==2567==Hint: address points to the zero page.
ASAN:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.
  1. SRS Config:
listen              1935;
max_connections     1000;
daemon              off;
srs_log_tank        console;
http_server {
    enabled         on;
    listen          8080;
    dir             ./objs/nginx/html;
}
vhost __defaultVhost__ {
    dash {
        enabled         on;
        dash_fragment       10;
        dash_update_period  10;
        dash_window_size    3;
        dash_path           ./objs/nginx/html;
        dash_mpd_file       [app]/[stream].mpd;
    }
}

Replay

Please describe how to replay the bug?

Step 1: Below is ffprobe out for my source stream codec and information.

Input #0, flv, from 'rtmp://51.210.214.151/arena1/main':
  Duration: N/A, start: 3406.980000, bitrate: 384 kb/s
    Stream #0:0: Audio: mp2, 48000 Hz, stereo, s16p, 192 kb/s
    Stream #0:1: Audio: mp2, 48000 Hz, stereo, s16p, 192 kb/s

there is no video only audio stream is there

Step 2: when we publish this stream with ffmpeg to srs, then srs will crash

FFMPEG:
Input #0, flv, from 'rtmp://51.210.214.151/arena1/main':
  Duration: N/A, start: 3325.524000, bitrate: 384 kb/s
    Stream #0:0: Audio: mp2, 48000 Hz, stereo, s16p, 192 kb/s
    Stream #0:1: Audio: mp2, 48000 Hz, stereo, s16p, 192 kb/s
[tcp @ 0x56402facd3e0] Connection to tcp://207.188.7.80:1935 failed: Connection refused
[rtmp @ 0x56402faccd80] Cannot open connection tcp://207.188.7.80:1935
rtmp://207.188.7.80/arena1/main: Connection refused

SRS:
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] new live source, stream_url=/arena1/main
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] source url=/arena1/main, ip=207.188.7.80, cache=1/2500, is_edge=0, source_id=/
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] DASH: Config fragment=10000ms, period=10000ms, window=3, timeshit=300000ms, home=./objs/nginx/html, mpd=[app]/[stream].mpd
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] ignore disabled exec for vhost=__defaultVhost__
[2023-08-16 20:59:07.220][INFO][2567][8h833a55] start publish mr=0/350, p1stpt=20000, pnt=5000, tcp_nodelay=0
ASAN:DEADLYSIGNAL
=================================================================
==2567==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x559b81754d17 bp 0x7fba38d4b0d0 sp 0x7fba38d4b0b0 T1)
==2567==The signal is caused by a READ memory access.
==2567==Hint: address points to the zero page.
ASAN:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.

Expect

How can we prevent SRS from crashing? Is there a way to validate the source codec of a stream and disable stream publishing? We are currently publishing multiple streams and lack information about the source stream codec, which is causing crashes in SRS.

5centscdn commented 11 months ago

We have tested with SRS 5.0.170 too. SRS is crashing when we encode to srs media server with invalid codec. Only issue is with Dash. When we disable Dash and enable HLS only then it's working without any issue.

FFMPEG command to SRS:

ffmpeg -i rtmp://51.210.214.151/arena1/main -c copy -f flv rtmp://206.75.162.204/live/test Input #0, flv, from 'rtmp://51.210.214.151/arena1/main': Duration: N/A, start: 6088.300000, bitrate: 384 kb/s Stream #0:0: Audio: mp2, 48000 Hz, stereo, s16p, 192 kb/s Stream #0:1: Audio: mp2, 48000 Hz, stereo, s16p, 192 kb/s [flv @ 0x55ca70db66c0] FLV does not support sample rate 48000, choose from (44100, 22050, 11025) [flv @ 0x55ca70db66c0] Audio codec mp2 not compatible with flv Could not write header for output file #0 (incorrect codec parameters ?): Function not implemented Stream mapping: Stream #0:0 -> #0:0 (copy) Last message repeated 1 times

SRS Log

[2023-08-21 17:27:26.241][INFO][30625][r77h4997] connect app, tcUrl=rtmp://206.75.162.204:1935/live, pageUrl=, swfUrl=, schema=rtmp, vhost=206.75.162.204, port=1935, app=live, args=null [2023-08-21 17:27:26.241][INFO][30625][r77h4997] protocol in.buffer=0, in.ack=0, out.ack=0, in.chunk=128, out.chunk=128 [2023-08-21 17:27:26.491][INFO][30625][r77h4997] client identified, type=fmle-publish, vhost=206.75.162.204, app=live, stream=test, param=, duration=0ms [2023-08-21 17:27:26.491][INFO][30625][r77h4997] connected stream, tcUrl=rtmp://206.75.162.204:1935/live, pageUrl=, swfUrl=, schema=rtmp, vhost=defaultVhost, port=1935, app=live, stream=test, param=, args=null [2023-08-21 17:27:26.491][INFO][30625][r77h4997] new live source, stream_url=/live/test [2023-08-21 17:27:26.500][INFO][30625][r77h4997] source url=/live/test, ip=207.188.7.80, cache=1/2500, is_edge=0, source_id=/ [2023-08-21 17:27:26.739][INFO][30625][r77h4997] DASH: Config fragment=10000ms, period=10000ms, window=3, timeshit=300000ms, home=./objs/nginx/html, mpd=[app]/[stream].mpd [2023-08-21 17:27:26.740][INFO][30625][r77h4997] ignore disabled exec for vhost=defaultVhost [2023-08-21 17:27:26.740][INFO][30625][r77h4997] start publish mr=0/350, p1stpt=20000, pnt=5000, tcp_nodelay=0 [2023-08-21 17:27:26.903][INFO][30625][fj4q51u6] Hybrid cpu=1.00%,40MB, cid=1,0, timer=61,0,0, clock=0,46,1,0,0,0,0,0,0 ASAN:DEADLYSIGNAL

==30625==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x563eed1d3745 bp 0x7f12a936f0d0 sp 0x7f12a936f0b0 T1) ==30625==The signal is caused by a READ memory access. ==30625==Hint: address points to the zero page. ASAN:DEADLYSIGNAL AddressSanitizer: nested bug in the same thread, aborting.

My operating system is Ubuntu 20.04. Any help will be greatly appreciated.