Repository navigation
Conversation
In case of re-aligning the segments, use the first PTS as starting point. Use double instead of float
Contributor
Author
|
Need to use different branch -> close this PR |
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Feb 7, 2023
Sometimes I'm encountering a crash when starting a live dash stream with a following backtrace: #0 0x910819d4 in adaptive::AdaptiveStream::start_stream() (this=<optimized out>) at /usr/src/debug/kodi-addon-inputstream-adaptive/inputstream.adaptive-20.3.2-Nexus/src/common/AdaptiveStream.cpp:606 #1 0x91069d0c in CInputStreamAdaptive::OpenStream(int) (this=0xaf51fa68, streamid=1006) at /usr/src/debug/kodi-addon-inputstream-adaptive/inputstream.adaptive-20.3.2-Nexus/src/main.cpp:309 xbmc#2 0x00e2f5d4 in CDVDDemuxClient::OpenStream(int) () xbmc#3 0x00e97ad4 in CVideoPlayer::OpenStream(CCurrentStream&, long long, int, int, bool) () xbmc#4 0x00e9e3c8 in CVideoPlayer::OpenDefaultStreams(bool) () xbmc#5 0x00ea3b18 in CVideoPlayer::Prepare() () xbmc#6 0x00ea5dc0 in CVideoPlayer::Process() () xbmc#7 0x011dcc6c in CThread::Action() () AdaptiveStream.cpp:606 points to a following line: ``` currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) / current_rep_->timescale_int_; ``` After taking a look on the assembly listing: (gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv ... 0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28] 0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144 => 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28 0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c 0x910819dc <+1612>: mov r8, #0 0x910819e4 <+1620>: mov r3, r8 0x910819e8 <+1624>: umull r0, r1, r0, r4 0x910819ec <+1628>: mov r2, r9 0x910819f0 <+1632>: mla r1, r4, r12, r1 0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt> ... it appears that $r3 contains a valid representation: (gdb) p *((AdaptiveTree::Representation*) $r3) $1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028", codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080, fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4, static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512, static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000', nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = { initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395}, startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0, range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{ range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "", startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, { range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "", startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, { range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "", ... $r8 should point to a valid next segment but doesn't: (gdb) p *((adaptive::AdaptiveTree::Segment*) $r8) Cannot access memory at address 0xa1a7dd88 After manually calculating next segment position in gdb it should point to: (gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1 $2 = 4211 (gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211] $3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10 (gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211] $4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0} My conclusion is that we are properly calculating next segment position but for some reason the memory got deallocated. My assumption is that updater thread has managed to parse the dash xml and update the segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Feb 12, 2023
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jan 26, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Apr 14, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Apr 27, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
May 4, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
May 4, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
May 19, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jul 11, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jul 17, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Aug 1, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Sep 22, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Sep 29, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Sep 29, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Oct 22, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Oct 26, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Nov 13, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Nov 13, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Dec 6, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Dec 6, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Dec 29, 2025
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Feb 1, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Feb 16, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Feb 28, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Mar 11, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
May 15, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
May 19, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
May 21, 2026
…deo) streams * First patch is grabbed from upstream Bento4. * Second and third are written by me. Test stream: https://storage.videos.solomon.tech/streaming-playlists/hls/edfcff7a-a8e1-4326-a2e7-424411aa189f/eaaa4f76-eef4-443e-821c-a34c36c15351-master.m3u8 Address sanitizer reports: 1) ``` Direct leak of 2480 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b33313 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:461 xbmc#2 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#3 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#4 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#5 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#6 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#7 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#8 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#9 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#10 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#11 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#12 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#13 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#16 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#17 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#18 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#19 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#20 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#21 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#22 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#23 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#24 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#25 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#26 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#27 0x7b61a2811bae in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bae) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#28 0x7b61a2a8d1c1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581 xbmc#29 0x7b61a2a8c4bb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70 xbmc#30 0x7b61a2a8f5ca in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76 ``` 2) ``` Indirect leak of 1631788 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d4d1 in operator new[](unsigned long) (/usr/lib/libasan.so+0x12d4d1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b28288 in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:210 xbmc#2 0x7b61a2b2813d in AP4_DataBuffer::SetDataSize(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:151 xbmc#3 0x7b61a2b4f537 in AP4_Sample::ReadData(AP4_DataBuffer&, unsigned int, unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:156 xbmc#4 0x7b61a2b4f469 in AP4_Sample::ReadData(AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:127 xbmc#5 0x7b61a2b333b1 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:467 xbmc#6 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#7 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#8 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#9 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#10 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#11 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#12 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#13 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#16 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#17 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#18 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#19 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#20 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#21 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#22 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#23 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#24 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#25 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#26 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#27 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#28 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#29 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#30 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) ```
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 8, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 8, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 8, 2026
…deo) streams * First patch reverts faulty commit from Kodi fork which introduces leaks. * Second patch is grabbed from upstream Bento4 (and correctly fixes issue that faulty commit was trying to fix). * Third comes from axiomatic-systems/Bento4#1069. Test stream: https://storage.videos.solomon.tech/streaming-playlists/hls/edfcff7a-a8e1-4326-a2e7-424411aa189f/eaaa4f76-eef4-443e-821c-a34c36c15351-master.m3u8 Address sanitizer reports: 1) ``` Direct leak of 2480 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b33313 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:461 xbmc#2 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#3 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#4 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#5 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#6 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#7 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#8 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#9 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#10 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#11 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#12 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#13 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#16 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#17 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#18 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#19 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#20 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#21 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#22 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#23 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#24 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#25 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#26 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#27 0x7b61a2811bae in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bae) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#28 0x7b61a2a8d1c1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581 xbmc#29 0x7b61a2a8c4bb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70 xbmc#30 0x7b61a2a8f5ca in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76 ``` 2) ``` Indirect leak of 1631788 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d4d1 in operator new[](unsigned long) (/usr/lib/libasan.so+0x12d4d1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b28288 in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:210 xbmc#2 0x7b61a2b2813d in AP4_DataBuffer::SetDataSize(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:151 xbmc#3 0x7b61a2b4f537 in AP4_Sample::ReadData(AP4_DataBuffer&, unsigned int, unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:156 xbmc#4 0x7b61a2b4f469 in AP4_Sample::ReadData(AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:127 xbmc#5 0x7b61a2b333b1 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:467 xbmc#6 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#7 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#8 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#9 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#10 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#11 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#12 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#13 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#16 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#17 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#18 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#19 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#20 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#21 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#22 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#23 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#24 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#25 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#26 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#27 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#28 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#29 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#30 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) ```
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 8, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 8, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 8, 2026
…deo) streams * First patch reverts faulty commit from Kodi fork which introduces leaks. * Second patch is grabbed from upstream Bento4 (and correctly fixes issue that faulty commit was trying to fix). * Third comes from axiomatic-systems/Bento4#1069. Test stream: https://storage.videos.solomon.tech/streaming-playlists/hls/edfcff7a-a8e1-4326-a2e7-424411aa189f/eaaa4f76-eef4-443e-821c-a34c36c15351-master.m3u8 Address sanitizer reports: 1) ``` Direct leak of 2480 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b33313 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:461 xbmc#2 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#3 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#4 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#5 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#6 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#7 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#8 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#9 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#10 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#11 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#12 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#13 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#16 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#17 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#18 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#19 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#20 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#21 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#22 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#23 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#24 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#25 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#26 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#27 0x7b61a2811bae in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bae) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#28 0x7b61a2a8d1c1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581 xbmc#29 0x7b61a2a8c4bb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70 xbmc#30 0x7b61a2a8f5ca in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76 ``` 2) ``` Indirect leak of 1631788 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d4d1 in operator new[](unsigned long) (/usr/lib/libasan.so+0x12d4d1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b28288 in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:210 xbmc#2 0x7b61a2b2813d in AP4_DataBuffer::SetDataSize(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:151 xbmc#3 0x7b61a2b4f537 in AP4_Sample::ReadData(AP4_DataBuffer&, unsigned int, unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:156 xbmc#4 0x7b61a2b4f469 in AP4_Sample::ReadData(AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:127 xbmc#5 0x7b61a2b333b1 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:467 xbmc#6 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#7 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#8 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#9 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#10 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#11 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#12 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#13 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#16 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#17 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#18 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#19 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#20 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#21 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#22 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#23 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#24 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#25 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#26 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#27 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#28 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#29 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#30 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) ```
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 22, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 22, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 22, 2026
…deo) streams * First patch reverts faulty commit from Kodi fork which introduces leaks. * Second patch is grabbed from upstream Bento4 (and correctly fixes issue that faulty commit was trying to fix). * Third comes from axiomatic-systems/Bento4#1069. Test stream: https://storage.videos.solomon.tech/streaming-playlists/hls/edfcff7a-a8e1-4326-a2e7-424411aa189f/eaaa4f76-eef4-443e-821c-a34c36c15351-master.m3u8 Address sanitizer reports: 1) ``` Direct leak of 2480 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b33313 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:461 xbmc#2 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#3 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#4 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#5 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#6 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#7 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#8 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#9 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#10 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#11 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#12 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#13 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#16 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#17 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#18 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#19 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#20 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#21 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#22 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#23 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#24 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#25 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#26 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#27 0x7b61a2811bae in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bae) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#28 0x7b61a2a8d1c1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581 xbmc#29 0x7b61a2a8c4bb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70 xbmc#30 0x7b61a2a8f5ca in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76 ``` 2) ``` Indirect leak of 1631788 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d4d1 in operator new[](unsigned long) (/usr/lib/libasan.so+0x12d4d1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b28288 in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:210 xbmc#2 0x7b61a2b2813d in AP4_DataBuffer::SetDataSize(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:151 xbmc#3 0x7b61a2b4f537 in AP4_Sample::ReadData(AP4_DataBuffer&, unsigned int, unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:156 xbmc#4 0x7b61a2b4f469 in AP4_Sample::ReadData(AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:127 xbmc#5 0x7b61a2b333b1 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:467 xbmc#6 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#7 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#8 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#9 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#10 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#11 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#12 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#13 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#16 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#17 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#18 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#19 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#20 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#21 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#22 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#23 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#24 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#25 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#26 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#27 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#28 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#29 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#30 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) ```
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 28, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 28, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jun 28, 2026
…deo) streams * First patch reverts faulty commit from Kodi fork which introduces leaks. * Second patch is grabbed from upstream Bento4 (and correctly fixes issue that faulty commit was trying to fix). * Third comes from axiomatic-systems/Bento4#1069. Test stream: https://storage.videos.solomon.tech/streaming-playlists/hls/edfcff7a-a8e1-4326-a2e7-424411aa189f/eaaa4f76-eef4-443e-821c-a34c36c15351-master.m3u8 Address sanitizer reports: 1) ``` Direct leak of 2480 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b33313 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:461 xbmc#2 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#3 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#4 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#5 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#6 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#7 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#8 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#9 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#10 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#11 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#12 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#13 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#16 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#17 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#18 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#19 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#20 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#21 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#22 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#23 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#24 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#25 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#26 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#27 0x7b61a2811bae in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bae) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#28 0x7b61a2a8d1c1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581 xbmc#29 0x7b61a2a8c4bb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70 xbmc#30 0x7b61a2a8f5ca in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76 ``` 2) ``` Indirect leak of 1631788 byte(s) in 62 object(s) allocated from: #0 0x7f61f712d4d1 in operator new[](unsigned long) (/usr/lib/libasan.so+0x12d4d1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) #1 0x7b61a2b28288 in AP4_DataBuffer::ReallocateBuffer(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:210 xbmc#2 0x7b61a2b2813d in AP4_DataBuffer::SetDataSize(unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4DataBuffer.cpp:151 xbmc#3 0x7b61a2b4f537 in AP4_Sample::ReadData(AP4_DataBuffer&, unsigned int, unsigned int) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:156 xbmc#4 0x7b61a2b4f469 in AP4_Sample::ReadData(AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4Sample.cpp:127 xbmc#5 0x7b61a2b333b1 in AP4_LinearReader::Advance(bool) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:467 xbmc#6 0x7b61a2b33709 in AP4_LinearReader::ReadNextSample(unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/bento4/src/bento4/Source/C++/Core/Ap4LinearReader.cpp:540 xbmc#7 0x7b61a2a41871 in CLinearReader::ExecReadNextSample(CLinearReaderCB*, unsigned int, AP4_Sample&, AP4_DataBuffer&) /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:680 xbmc#8 0x7b61a2a3beb2 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:158 xbmc#9 0x7b61a2819586 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76 xbmc#10 0x7b61a2818c4c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98 xbmc#11 0x7b61a2818872 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541 xbmc#12 0x7b61a2818011 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645 xbmc#13 0x7b61a2817c50 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#14 0x7b61a2817889 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#15 0x7b61a28169c9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517 xbmc#16 0x7b61a2818d6b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419 xbmc#17 0x7b61a281891f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#18 0x7b61a28181f4 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116 xbmc#19 0x7b61a2817ccc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296 xbmc#20 0x55873e2f7655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1) xbmc#21 0x7f61f409d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#22 0x7f61f409d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) xbmc#23 0x7b61a27ff278 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746 xbmc#24 0x7b61a27ff278 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923 xbmc#25 0x7b61a27f5d0f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438 xbmc#26 0x7b61a2816b22 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520 xbmc#27 0x7b61a2802d63 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643 xbmc#28 0x7b61a27fba73 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba73) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) xbmc#29 0x7b61a2813811 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63 xbmc#30 0x7b61a2812f53 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f53) (BuildId: 10f583c374d6f7aa219a9f7ab1bbc26a66df313c) ```
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jul 13, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jul 13, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jul 13, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Jul 13, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Sep 29, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Sep 29, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Nov 3, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Nov 3, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Nov 3, 2026
Sometimes Kodi crashes when starting a live dash stream. This is a
core dump analysis from armv7. Gdb shows a following backtrace:
AdaptiveStream.cpp:606 points to a following line:
```
currentPTSOffset_ = (next_segment->startPTS_ * current_rep_->timescale_ext_) /
current_rep_->timescale_int_;
```
After taking a look on the assembly listing
(gdb) disas /m _ZN8adaptive14AdaptiveStream12start_streamEv
...
0x910819c8 <+1592>: ldrne r3, [sp, xbmc#28]
0x910819d0 <+1600>: ldr r4, [r3, xbmc#324] ; 0x144
=> 0x910819d4 <+1604>: ldr r0, [r8, xbmc#40] ; 0x28
0x910819d8 <+1608>: ldr r12, [r8, xbmc#44] ; 0x2c
0x910819dc <+1612>: mov r8, #0
0x910819e4 <+1620>: mov r3, r8
0x910819e8 <+1624>: umull r0, r1, r0, r4
0x910819ec <+1628>: mov r2, r9
0x910819f0 <+1632>: mla r1, r4, r12, r1
0x910819f4 <+1636>: bl 0x9105a6b4 <__aeabi_uldivmod@plt>
...
we can spot that $r3 contains a valid representation:
(gdb) p *((AdaptiveTree::Representation*) $r3)
$1 = {url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4", id = "1080p", codecs_ = "avc1.640028",
codec_private_data_ = "", source_url_ = "", base_url_ = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/", bandwidth_ = 5000000, samplingRate_ = 0, width_ = 1920, height_ = 1080,
fpsRate_ = 25, fpsScale_ = 1, aspect_ = 0, assured_buffer_duration_ = 20, max_buffer_duration_ = 40, static BYTERANGE = 0, static INDEXRANGEEXACT = 1, static TEMPLATE = 2, static TIMELINE = 4,
static INITIALIZATION = 8, static SEGMENTBASE = 16, static SUBTITLESTREAM = 32, static INCLUDEDSTREAM = 64, static URLSEGMENTS = 128, static ENABLED = 256, static WAITFORSEGMENT = 512,
static INITIALIZATION_PREFIXED = 1024, static DOWNLOADED = 2048, static INITIALIZED = 4096, flags_ = 14, hdcpVersion_ = 0, indexRangeMin_ = 0, indexRangeMax_ = 0, channelCount_ = 0 '\000',
nalLengthSize_ = 0 '\000', pssh_set_ = 2, expired_segments_ = 0, containerType_ = adaptive::AdaptiveTree::CONTAINERTYPE_MP4, segtpl_ = {
initialization = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/init.mp4",
media = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/$RepresentationID$/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4",
media_url = "http://lb2-e2-18.pluscdn.pl/ch/1456330/123/dash/294f032c/1080p/p_3f26ad64-5258-452e-9bdc-209c361003e9_1667995241000/t$Time$.mp4", timescale = 90000, duration = 230395},
startNumber_ = 4, nextPts_ = 20170141682400, ptsOffset_ = 0, duration_ = 972288000, timescale_ = 90000, timescale_ext_ = 100, timescale_int_ = 9, initialization_ = {range_begin_ = 0,
range_end_ = 18446744073709551615, url = "", startPTS_ = 0, m_duration = 0, pssh_set_ = 0}, segments_ = {basePos = 0, data = std::vector of length 4220, capacity 4220 = {{
range_begin_ = 20169170085600, range_end_ = 1, url = "", startPTS_ = 20169170085600, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170316000, range_end_ = 2, url = "",
startPTS_ = 20169170316000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169170546400, range_end_ = 3, url = "", startPTS_ = 20169170546400, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169170776800, range_end_ = 4, url = "", startPTS_ = 20169170776800, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171007200, range_end_ = 5, url = "",
startPTS_ = 20169171007200, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171237600, range_end_ = 6, url = "", startPTS_ = 20169171237600, m_duration = 0, pssh_set_ = 0}, {
range_begin_ = 20169171468000, range_end_ = 7, url = "", startPTS_ = 20169171468000, m_duration = 0, pssh_set_ = 0}, {range_begin_ = 20169171698400, range_end_ = 8, url = "",
...
Conversly $r8 should point to a valid next segment but doesn't:
(gdb) p *((adaptive::AdaptiveTree::Segment*) $r8)
Cannot access memory at address 0xa1a7dd88
After manually calculating next segment position in gdb, it should point to:
(gdb) p ((AdaptiveTree::Representation*) $r3)->current_segment_ - &((AdaptiveTree::Representation*) $r3)->segments_.data[0] + 1
$2 = 4211
(gdb) p &((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$3 = (adaptive::AdaptiveTree::Segment *) 0x97ae9f10
(gdb) p ((AdaptiveTree::Representation*) $r3)->segments_.data[4211]
$4 = {range_begin_ = 20170140300000, range_end_ = 4212, url = "", startPTS_ = 20170140300000, m_duration = 0, pssh_set_ = 0}
So, the code which calculates next segment is correct.
It has been confirmed that there is a race codition and updater thread can
update the representation during invocation of start_stream(). It can be
reproduced by following commit:
3243687
In order to fix the crash, it's enough to lock tree mutex to stop
updater thread from updating the representation/segments.
dobo90
added a commit
to dobo90/inputstream.adaptive
that referenced
this pull request
Nov 3, 2026
Fixes following sanitizer report:
=================================================================
==219283==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0453ac2330 at pc 0x7be408843f2d bp 0x7be40277dbf0 sp 0x7be40277dbe0
READ of size 8 at 0x7d0453ac2330 thread T64
#0 0x7be408843f2c in std::__shared_ptr<AP4_CencSampleDecrypter, (__gnu_cxx::_Lock_policy)2>::operator bool() const /usr/include/c++/16.1.1/bits/shared_ptr_base.h:1756
#1 0x7be40883c045 in CFragmentedSampleReader::ReadSample() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182
xbmc#2 0x7be408619596 in int std::__invoke_impl<int, int (ISampleReader::*&)(), ISampleReader*&>(std::__invoke_memfun_deref, int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#3 0x7be408618c5c in std::__invoke_result<int (ISampleReader::*&)(), ISampleReader*&>::type std::__invoke<int (ISampleReader::*&)(), ISampleReader*&>(int (ISampleReader::*&)(), ISampleReader*&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#4 0x7be408618882 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::__call<int, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/16.1.1/functional:541
xbmc#5 0x7be408618021 in int std::_Bind<int (ISampleReader::*(ISampleReader*))()>::operator()<, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&, std::_Bind<int (ISampleReader::*(ISampleReader*))()>, 0, int>(this std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/functional:645
xbmc#6 0x7be408617c60 in int std::__invoke_impl<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::__invoke_other, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#7 0x7be408617899 in std::enable_if<is_invocable_r_v<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>, int>::type std::__invoke_r<int, std::_Bind<int (ISampleReader::*(ISampleReader*))()>&>(std::_Bind<int (ISampleReader::*(ISampleReader*))()>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#8 0x7be4086169d9 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}::operator()() const /usr/include/c++/16.1.1/future:1517
xbmc#9 0x7be408618d7b in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>::operator()() const /usr/include/c++/16.1.1/future:1419
xbmc#10 0x7be40861892f in std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#11 0x7be408618204 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int>&) /usr/include/c++/16.1.1/bits/invoke.h:116
xbmc#12 0x7be408617cdc in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<int>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run()::{lambda()#1}, int> >::_M_invoke(std::_Any_data const&) /usr/include/c++/16.1.1/bits/std_function.h:296
xbmc#13 0x55fb298d6655 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (/usr/lib/kodi/kodi.bin+0x1105655) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe45929d8fb (/usr/lib/libc.so.6+0x9d8fb) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe45929d978 in pthread_once (/usr/lib/libc.so.6+0x9d978) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x7be4085ff288 in __gthread_once(int*, void (*)()) /usr/include/c++/16.1.1/x86_64-pc-linux-gnu/bits/gthr-default.h:746
xbmc#17 0x7be4085ff288 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/include/c++/16.1.1/mutex:923
xbmc#18 0x7be4085f5d1f in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/include/c++/16.1.1/future:438
xbmc#19 0x7be408616b32 in std::__future_base::_Task_state<std::_Bind<int (ISampleReader::*(ISampleReader*))()>, std::allocator<int>, int ()>::_M_run() /usr/include/c++/16.1.1/future:1520
xbmc#20 0x7be408602d73 in std::packaged_task<int ()>::operator()() /usr/include/c++/16.1.1/future:1643
xbmc#21 0x7be4085fba83 in UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}::operator()() const (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fba83) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#22 0x7be408613821 in void std::__invoke_impl<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(std::__invoke_other, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) /usr/include/c++/16.1.1/bits/invoke.h:63
xbmc#23 0x7be408612f63 in std::enable_if<is_invocable_r_v<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>, void>::type std::__invoke_r<void, UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&>(UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa12f63) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#24 0x7be408611bbe in std::_Function_handler<void (), UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0xa11bbe) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#25 0x7be40888d1d1 in std::function<void ()>::operator()() const /usr/include/c++/16.1.1/bits/std_function.h:581
xbmc#26 0x7be40888c4cb in UTILS::THREAD::ThreadPool::Executor::Run() /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:70
xbmc#27 0x7be40888f5da in void std::__invoke_impl<void, void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(std::__invoke_memfun_deref, void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:76
xbmc#28 0x7be40888f4c8 in std::__invoke_result<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>::type std::__invoke<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/invoke.h:98
xbmc#29 0x7be40888f44a in void std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/16.1.1/bits/std_thread.h:303
xbmc#30 0x7be40888f403 in std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> >::operator()() /usr/include/c++/16.1.1/bits/std_thread.h:310
xbmc#31 0x7be40888f3e7 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*> > >::_M_run() /usr/include/c++/16.1.1/bits/std_thread.h:255
xbmc#32 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#33 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#34 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#35 0x7fe45931d21b (/usr/lib/libc.so.6+0x11d21b) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
0x7d0453ac2330 is located 240 bytes inside of 288-byte region [0x7d0453ac2240,0x7d0453ac2360)
freed by thread T57 here:
#0 0x7fe45c12e4c1 in operator delete(void*, unsigned long) (/usr/lib/libasan.so+0x12e4c1) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be40883b3be in CFragmentedSampleReader::~CFragmentedSampleReader() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:62
xbmc#2 0x7be40863ad02 in std::default_delete<ISampleReader>::operator()(ISampleReader*) const /usr/include/c++/16.1.1/bits/unique_ptr.h:92
xbmc#3 0x7be4086be093 in std::__uniq_ptr_impl<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:204
xbmc#4 0x7be4086bd915 in std::unique_ptr<ISampleReader, std::default_delete<ISampleReader> >::reset(ISampleReader*) /usr/include/c++/16.1.1/bits/unique_ptr.h:511
xbmc#5 0x7be4086bd1ec in SESSION::CStream::UnlinkStream() /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:114
xbmc#6 0x7be4085ed98b in CInputStreamAdaptive::EnableStream(int, bool) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:157
xbmc#7 0x7be4085f9f3f in kodi::addon::CInstanceInputStream::ADDON_EnableStream(AddonInstance_InputStream const*, int, bool) /usr/include/kodi/addon-instance/Inputstream.h:2006
xbmc#8 0x55fb2953d0bd (/usr/lib/kodi/kodi.bin+0xd6c0bd) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294ecf1f in CVideoPlayer::OnExit() (/usr/lib/kodi/kodi.bin+0xd1bf1f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb298da2f7 in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092f7) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#13 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#14 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
previously allocated by thread T57 here:
#0 0x7fe45c12d341 in operator new(unsigned long) (/usr/lib/libasan.so+0x12d341) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7be4088442da in std::__detail::_MakeUniq<CFragmentedSampleReader>::__single_object std::make_unique<CFragmentedSampleReader, std::shared_ptr<CLinearReader>&, AP4_Track*&>(std::shared_ptr<CLinearReader>&, AP4_Track*&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#2 0x7be40883d940 in CFragmentedSampleReader::CreateReaderByTrack() /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:319
xbmc#3 0x7be4086bcc85 in SESSION::CStream::LinkStream(std::shared_ptr<SESSION::CStream>, int) /home/dobo/kodi/inputstream.adaptive/src/Stream.cpp:78
xbmc#4 0x7be4085edebf in CInputStreamAdaptive::OpenStream(int) /home/dobo/kodi/inputstream.adaptive/src/main.cpp:285
xbmc#5 0x7be4085fa046 in kodi::addon::CInstanceInputStream::ADDON_OpenStream(AddonInstance_InputStream const*, int) /usr/include/kodi/addon-instance/Inputstream.h:2012
xbmc#6 0x55fb29468dac in CDVDDemuxClient::OpenStream(int) (/usr/lib/kodi/kodi.bin+0xc97dac) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb294f5589 in CVideoPlayer::OpenStream(CCurrentStream&, long, int, int, bool) (/usr/lib/kodi/kodi.bin+0xd24589) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb294e7b0a in CVideoPlayer::OpenDefaultStreams(bool) (/usr/lib/kodi/kodi.bin+0xd16b0a) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb294e91f4 in CVideoPlayer::Prepare() (/usr/lib/kodi/kodi.bin+0xd181f4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294eab6c in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19b6c) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#14 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#15 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T64 created by T57 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x7be40888d038 in std::thread::thread<void (UTILS::THREAD::ThreadPool::Executor::*)(), UTILS::THREAD::ThreadPool::Executor*, void>(void (UTILS::THREAD::ThreadPool::Executor::*&&)(), UTILS::THREAD::ThreadPool::Executor*&&) /usr/include/c++/16.1.1/bits/std_thread.h:175
xbmc#3 0x7be40888c27e in UTILS::THREAD::ThreadPool::Executor::Executor(UTILS::THREAD::ThreadPool&) /home/dobo/kodi/inputstream.adaptive/src/utils/ThreadPool.cpp:55
xbmc#4 0x7be408602f94 in std::__detail::_MakeUniq<UTILS::THREAD::ThreadPool::Executor>::__single_object std::make_unique<UTILS::THREAD::ThreadPool::Executor, UTILS::THREAD::ThreadPool&>(UTILS::THREAD::ThreadPool&) /usr/include/c++/16.1.1/bits/unique_ptr.h:1086
xbmc#5 0x7be4085fbf72 in auto UTILS::THREAD::ThreadPool::Execute<int (ISampleReader::*)(), ISampleReader*>(int (ISampleReader::*&&)(), ISampleReader*&&) (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fbf72) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#6 0x7be4085fc3dc in ISampleReader::ReadSampleAsync() (/usr/lib/kodi/addons/inputstream.adaptive/inputstream.adaptive.so.22.3.10+0x9fc3dc) (BuildId: ce7c73d104d6d4f3d02b9148a58dfce1b1399311)
xbmc#7 0x7be4085ef0b8 in CInputStreamAdaptive::DemuxRead() /home/dobo/kodi/inputstream.adaptive/src/main.cpp:381
xbmc#8 0x7be4085fa449 in kodi::addon::CInstanceInputStream::ADDON_DemuxRead(AddonInstance_InputStream const*) /usr/include/kodi/addon-instance/Inputstream.h:2032
xbmc#9 0x55fb294688a4 in CDVDDemuxClient::Read() (/usr/lib/kodi/kodi.bin+0xc978a4) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb294e869d in CVideoPlayer::ReadPacket(DemuxPacket*&, CDemuxStream*&) (/usr/lib/kodi/kodi.bin+0xd1769d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb294eae22 in CVideoPlayer::Process() (/usr/lib/kodi/kodi.bin+0xd19e22) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb298da2ee in CThread::Action() (/usr/lib/kodi/kodi.bin+0x11092ee) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb298df618 (/usr/lib/kodi/kodi.bin+0x110e618) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe4596eb918 (/usr/lib/libstdc++.so.6+0xeb918) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#15 0x7fe45c0618d8 (/usr/lib/libasan.so+0x618d8) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
xbmc#16 0x7fe4592981b8 (/usr/lib/libc.so.6+0x981b8) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
Thread T57 created by T0 here:
#0 0x7fe45c122774 in pthread_create (/usr/lib/libasan.so+0x122774) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
#1 0x7fe4596eba21 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/libstdc++.so.6+0xeba21) (BuildId: 4749d5ce79ac21b5e837c001c58e342b35197e4b)
xbmc#2 0x55fb298da1a2 (/usr/lib/kodi/kodi.bin+0x11091a2) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#3 0x55fb294e3181 in CVideoPlayer::OpenFile(CFileItem const&, CPlayerOptions const&) (/usr/lib/kodi/kodi.bin+0xd12181) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#4 0x55fb29b5310d in CApplicationPlayer::OpenFile(CFileItem const&, CPlayerOptions const&, CPlayerCoreFactory const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, IPlayerCallback&) (/usr/lib/kodi/kodi.bin+0x138210d) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#5 0x55fb29b347ca in CApplication::PlayFile(CFileItem, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/usr/lib/kodi/kodi.bin+0x13637ca) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#6 0x55fb29d7ecd8 in KODI::PLAYLIST::CPlayListPlayer::Play(int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) (/usr/lib/kodi/kodi.bin+0x15adcd8) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#7 0x55fb29d7f9ef in KODI::PLAYLIST::CPlayListPlayer::Play() (/usr/lib/kodi/kodi.bin+0x15ae9ef) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#8 0x55fb29d8ae07 in KODI::PLAYLIST::CPlayListPlayer::OnApplicationMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x15b9e07) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#9 0x55fb2994f9b5 in KODI::MESSAGING::CApplicationMessenger::ProcessMessage(KODI::MESSAGING::ThreadMessage*) (/usr/lib/kodi/kodi.bin+0x117e9b5) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#10 0x55fb2994fb85 in KODI::MESSAGING::CApplicationMessenger::ProcessMessages() (/usr/lib/kodi/kodi.bin+0x117eb85) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#11 0x55fb29b387dc in CApplication::Process() (/usr/lib/kodi/kodi.bin+0x13677dc) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#12 0x55fb29b340cb in CApplication::Run() (/usr/lib/kodi/kodi.bin+0x13630cb) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#13 0x55fb291ef38f in main (/usr/lib/kodi/kodi.bin+0xa1e38f) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
xbmc#14 0x7fe459227740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#15 0x7fe459227878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
xbmc#16 0x55fb29250154 in _start (/usr/lib/kodi/kodi.bin+0xa7f154) (BuildId: 71f55ec6f5d4c4b2e18830e9d6568f84c558efc1)
SUMMARY: AddressSanitizer: heap-use-after-free /home/dobo/kodi/inputstream.adaptive/src/samplereader/FragmentedSampleReader.cpp:182 in CFragmentedSampleReader::ReadSample()
Shadow bytes around the buggy address:
0x7d0453ac2080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x7d0453ac2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7d0453ac2180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x7d0453ac2200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0453ac2300: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x7d0453ac2380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7d0453ac2480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x7d0453ac2500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x7d0453ac2580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==219283==ABORTING
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In case of re-aligning the segments, use the first PTS as starting
point.
Use double instead of float