ZLMediaKit [BUG]最新版代码不定时崩溃

今天部署了最新版的代码, 到现在8个小时, 已经崩溃了4次. dmesg日志 event poller 16[15269]: segfault at 200000009 ip 0000560be2957da0 sp 00007fe68f3fbb80 error 4 in media_server[560be25a6000+516000]

root@lax:/opt/media# addr2line -e media_server 3b1da0 -f -a -p -C 0x00000000003b1da0: std::_Sp_counted_ptr_inplace<toolkit::BufferSock, std::allocatortoolkit::BufferSock, (__gnu_cxx::_Lock_policy)2>::~_Sp_counted_ptr_inplace() at ??:?

core文件使用gdb调试, 只能看到如下的信息 (gdb) bt #0 0x00005587f62c3260 in ?? () Backtrace stopped: Cannot access memory at address 0x7fe5c87fbb90

是否还是优化导致的问题?

Jan 13 '22 15:01 alexliyu7352

是不是你release编译的？刚创建微信群了，欢迎加入

发自我的iPhone

------------------ 原始邮件 ------------------ 发件人: alexliyu7352 @.> 发送时间: 2022年1月13日 23:55 收件人: ZLMediaKit/ZLMediaKit @.> 抄送: Subscribed @.***> 主题: 回复：[ZLMediaKit/ZLMediaKit] [BUG]最新版代码不定时崩溃 (Issue #1363)

今天部署了最新版的代码, 到现在8个小时, 已经崩溃了4次. dmesg日志 event poller 16[15269]: segfault at 200000009 ip 0000560be2957da0 sp 00007fe68f3fbb80 error 4 in media_server[560be25a6000+516000]

@.***:/opt/media# addr2line -e media_server 3b1da0 -f -a -p -C 0x00000000003b1da0: std::_Sp_counted_ptr_inplace<toolkit::BufferSock, std::allocatortoolkit::BufferSock, (__gnu_cxx::_Lock_policy)2>::~_Sp_counted_ptr_inplace() at ??:?

core文件使用gdb调试, 只能看到如下的信息 (gdb) bt #0 0x00005587f62c3260 in ?? () Backtrace stopped: Cannot access memory at address 0x7fe5c87fbb90

是否还是优化导致的问题?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.Message ID: @.***>

Jan 13 '22 15:01 xia-chu

是的, release编译的. 微信群多少?

Jan 13 '22 16:01 alexliyu7352

================================================================= ==10079==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e0004faf4c at pc 0x7f7b354aa867 bp 0x7f7b276e4f90 sp 0x7f7b276e4738 READ of size 170 at 0x61e0004faf4c thread T20 (event poller 17) #0 0x7f7b354aa866 (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866) #1 0x55c7a96cfc57 in mpeg_ts_write (/opt/media/media_server+0xc92c57) #2 0x55c7a907e6cb in mediakit::MpegMuxer::inputFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x6416cb) #3 0x55c7a8f0da12 in mediakit::TSMediaSourceMuxer::inputFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x4d0a12) #4 0x55c7a8eb20a9 in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x4750a9) #5 0x55c7a9260fb0 in std::_Function_handler<bool (std::shared_ptrmediakit::Frame const&), mediakit::MediaSink::addTrack(std::shared_ptrmediakit::Track const&)::{lambda(std::shared_ptrmediakit::Frame const&)#3}>::_M_invoke(std::_Any_data const&, std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x823fb0) #6 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x83c03c) #7 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x83c871) #8 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x8312c9) #9 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x83c03c) #10 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x83c871) #11 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptrmediakit::Frame const&) (/opt/media/media_server+0x8312c9) #12 0x55c7a957edb1 in mediakit::TsDemuxer::onTick() (/opt/media/media_server+0xb41db1) #13 0x55c7a957f349 in std::_Function_handler<bool (), mediakit::TsDemuxer::start(std::shared_ptrtoolkit::EventPoller const&, mediakit::TrackListener*)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xb42349) #14 0x55c7a964d1e9 in std::_Function_handler<unsigned long (), toolkit::Timer::Timer(float, std::function<bool ()> const&, std::shared_ptrtoolkit::EventPoller const&, bool)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xc101e9) #15 0x55c7a964153c in toolkit::EventPoller::flushDelayTask(unsigned long) (/opt/media/media_server+0xc0453c) #16 0x55c7a9641d0a in toolkit::EventPoller::getMinDelay() (/opt/media/media_server+0xc04d0a) #17 0x55c7a96439e3 in toolkit::EventPoller::runLoop(bool, bool) (/opt/media/media_server+0xc069e3) #18 0x55c7a964525c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::)(bool, bool), toolkit::EventPoller, bool, bool> > >::_M_run() (/opt/media/media_server+0xc0825c) #19 0x7f7b348286de (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de) #20 0x7f7b34afb6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463 #21 0x7f7b33ee571e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x61e0004faf4c is located 0 bytes to the right of 2764-byte region [0x61e0004fa480,0x61e0004faf4c) allocated by thread T20 (event poller 17) here: #0 0x7f7b3555aba0 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xefba0) #1 0x7f7b3488fb8a in std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x124b8a)

Thread T20 (event poller 17) created by T0 here: #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef) #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_deletestd::thread::_State >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994) #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974) #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28) #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284) #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptrtoolkit::EventPoller) (/opt/media/media_server+0xb7050c) #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptrtoolkit::EventPoller const&) (/opt/media/media_server+0xbb9f25) #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocatortoolkit::TcpServer>(std::_Sp_alloc_shared_tag<std::allocatortoolkit::TcpServer >) (/opt/media/media_server+0x3b1f82) #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751) #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866) Shadow bytes around the buggy address: 0x0c3c80097590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3c800975a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3c800975b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3c800975c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3c800975d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c3c800975e0: 00 00 00 00 00 00 00 00 00[04]fa fa fa fa fa fa 0x0c3c800975f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3c80097600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3c80097610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3c80097620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3c80097630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==10079==ABORTING

Jan 13 '22 16:01 alexliyu7352

=================================================================
==10079==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e0004faf4c at pc 0x7f7b354aa867 bp 0x7f7b276e4f90 sp 0x7f7b276e4738
READ of size 170 at 0x61e0004faf4c thread T20 (event poller 17)
    #0 0x7f7b354aa866  (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866)
    #1 0x55c7a96cfc57 in mpeg_ts_write (/opt/media/media_server+0xc92c57)
    #2 0x55c7a907e6cb in mediakit::MpegMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x6416cb)
    #3 0x55c7a8f0da12 in mediakit::TSMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4d0a12)
    #4 0x55c7a8eb20a9 in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4750a9)
    #5 0x55c7a9260fb0 in std::_Function_handler<bool (std::shared_ptr<mediakit::Frame> const&), mediakit::MediaSink::addTrack(std::shared_ptr<mediakit::Track> const&)::{lambda(std::shared_ptr<mediakit::Frame> const&)#3}>::_M_invoke(std::_Any_data const&, std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x823fb0)
    #6 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #7 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #8 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #9 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #10 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #11 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #12 0x55c7a957edb1 in mediakit::TsDemuxer::onTick() (/opt/media/media_server+0xb41db1)
    #13 0x55c7a957f349 in std::_Function_handler<bool (), mediakit::TsDemuxer::start(std::shared_ptr<toolkit::EventPoller> const&, mediakit::TrackListener*)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xb42349)
    #14 0x55c7a964d1e9 in std::_Function_handler<unsigned long (), toolkit::Timer::Timer(float, std::function<bool ()> const&, std::shared_ptr<toolkit::EventPoller> const&, bool)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xc101e9)
    #15 0x55c7a964153c in toolkit::EventPoller::flushDelayTask(unsigned long) (/opt/media/media_server+0xc0453c)
    #16 0x55c7a9641d0a in toolkit::EventPoller::getMinDelay() (/opt/media/media_server+0xc04d0a)
    #17 0x55c7a96439e3 in toolkit::EventPoller::runLoop(bool, bool) (/opt/media/media_server+0xc069e3)
    #18 0x55c7a964525c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() (/opt/media/media_server+0xc0825c)
    #19 0x7f7b348286de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
    #20 0x7f7b34afb6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #21 0x7f7b33ee571e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x61e0004faf4c is located 0 bytes to the right of 2764-byte region [0x61e0004fa480,0x61e0004faf4c)
allocated by thread T20 (event poller 17) here:
    #0 0x7f7b3555aba0 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xefba0)
    #1 0x7f7b3488fb8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x124b8a)

Thread T20 (event poller 17) created by T0 here:
    #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef)
    #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994)
    #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974)
    #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28)
    #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284)
    #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) (/opt/media/media_server+0xb7050c)
    #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) (/opt/media/media_server+0xbb9f25)
    #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/media/media_server+0x3b1f82)
    #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751)
    #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866) 
Shadow bytes around the buggy address:
  0x0c3c80097590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3c800975e0: 00 00 00 00 00 00 00 00 00[04]fa fa fa fa fa fa
  0x0c3c800975f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3c80097600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3c80097610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c80097620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c80097630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==10079==ABORTING

Jan 13 '22 16:01 alexliyu7352

20分钟崩了好几次

=================================================================
==10079==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e0004faf4c at pc 0x7f7b354aa867 bp 0x7f7b276e4f90 sp 0x7f7b276e4738
READ of size 170 at 0x61e0004faf4c thread T20 (event poller 17)
    #0 0x7f7b354aa866  (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866)
    #1 0x55c7a96cfc57 in mpeg_ts_write (/opt/media/media_server+0xc92c57)
    #2 0x55c7a907e6cb in mediakit::MpegMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x6416cb)
    #3 0x55c7a8f0da12 in mediakit::TSMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4d0a12)
    #4 0x55c7a8eb20a9 in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4750a9)
    #5 0x55c7a9260fb0 in std::_Function_handler<bool (std::shared_ptr<mediakit::Frame> const&), mediakit::MediaSink::addTrack(std::shared_ptr<mediakit::Track> const&)::{lambda(std::shared_ptr<mediakit::Frame> const&)#3}>::_M_invoke(std::_Any_data const&, std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x823fb0)
    #6 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #7 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #8 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #9 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #10 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #11 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #12 0x55c7a957edb1 in mediakit::TsDemuxer::onTick() (/opt/media/media_server+0xb41db1)
    #13 0x55c7a957f349 in std::_Function_handler<bool (), mediakit::TsDemuxer::start(std::shared_ptr<toolkit::EventPoller> const&, mediakit::TrackListener*)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xb42349)
    #14 0x55c7a964d1e9 in std::_Function_handler<unsigned long (), toolkit::Timer::Timer(float, std::function<bool ()> const&, std::shared_ptr<toolkit::EventPoller> const&, bool)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xc101e9)
    #15 0x55c7a964153c in toolkit::EventPoller::flushDelayTask(unsigned long) (/opt/media/media_server+0xc0453c)
    #16 0x55c7a9641d0a in toolkit::EventPoller::getMinDelay() (/opt/media/media_server+0xc04d0a)
    #17 0x55c7a96439e3 in toolkit::EventPoller::runLoop(bool, bool) (/opt/media/media_server+0xc069e3)
    #18 0x55c7a964525c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() (/opt/media/media_server+0xc0825c)
    #19 0x7f7b348286de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
    #20 0x7f7b34afb6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #21 0x7f7b33ee571e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x61e0004faf4c is located 0 bytes to the right of 2764-byte region [0x61e0004fa480,0x61e0004faf4c)
allocated by thread T20 (event poller 17) here:
    #0 0x7f7b3555aba0 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xefba0)
    #1 0x7f7b3488fb8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x124b8a)

Thread T20 (event poller 17) created by T0 here:
    #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef)
    #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994)
    #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974)
    #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28)
    #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284)
    #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) (/opt/media/media_server+0xb7050c)
    #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) (/opt/media/media_server+0xbb9f25)
    #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/media/media_server+0x3b1f82)
    #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751)
    #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866) 
Shadow bytes around the buggy address:
  0x0c3c80097590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c800975d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3c800975e0: 00 00 00 00 00 00 00 00 00[04]fa fa fa fa fa fa
  0x0c3c800975f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3c80097600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3c80097610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c80097620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c80097630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==10079==ABORTING


=================================================================
==11088==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000a2b0c3 at pc 0x7f7b354aa867 bp 0x7f7b2ceeff90 sp 0x7f7b2ceef738
READ of size 170 at 0x61d000a2b0c3 thread T9 (event poller 6)
    #0 0x7f7b354aa866  (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866)
    #1 0x55c7a96cfc57 in mpeg_ts_write (/opt/media/media_server+0xc92c57)
    #2 0x55c7a907e6cb in mediakit::MpegMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x6416cb)
    #3 0x55c7a8f0da12 in mediakit::TSMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4d0a12)
    #4 0x55c7a8eb20a9 in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4750a9)
    #5 0x55c7a9260fb0 in std::_Function_handler<bool (std::shared_ptr<mediakit::Frame> const&), mediakit::MediaSink::addTrack(std::shared_ptr<mediakit::Track> const&)::{lambda(std::shared_ptr<mediakit::Frame> const&)#3}>::_M_invoke(std::_Any_data const&, std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x823fb0)
    #6 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #7 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #8 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #9 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #10 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #11 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #12 0x55c7a957edb1 in mediakit::TsDemuxer::onTick() (/opt/media/media_server+0xb41db1)
    #13 0x55c7a957f349 in std::_Function_handler<bool (), mediakit::TsDemuxer::start(std::shared_ptr<toolkit::EventPoller> const&, mediakit::TrackListener*)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xb42349)
    #14 0x55c7a964d1e9 in std::_Function_handler<unsigned long (), toolkit::Timer::Timer(float, std::function<bool ()> const&, std::shared_ptr<toolkit::EventPoller> const&, bool)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xc101e9)
    #15 0x55c7a964153c in toolkit::EventPoller::flushDelayTask(unsigned long) (/opt/media/media_server+0xc0453c)
    #16 0x55c7a9641d0a in toolkit::EventPoller::getMinDelay() (/opt/media/media_server+0xc04d0a)
    #17 0x55c7a96439e3 in toolkit::EventPoller::runLoop(bool, bool) (/opt/media/media_server+0xc069e3)
    #18 0x55c7a964525c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() (/opt/media/media_server+0xc0825c)
    #19 0x7f7b348286de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
    #20 0x7f7b34afb6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #21 0x7f7b33ee571e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x61d000a2b0c3 is located 0 bytes to the right of 2115-byte region [0x61d000a2a880,0x61d000a2b0c3)
allocated by thread T9 (event poller 6) here:
    #0 0x7f7b3555aba0 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xefba0)
    #1 0x7f7b3488fb8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x124b8a)

Thread T9 (event poller 6) created by T0 here:
    #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef)
    #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994)
    #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974)
    #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28)
    #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284)
    #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) (/opt/media/media_server+0xb7050c)
    #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) (/opt/media/media_server+0xbb9f25)
    #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/media/media_server+0x3b1f82)
    #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751)
    #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866) 
Shadow bytes around the buggy address:
  0x0c3a8013d5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a8013d5d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a8013d5e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a8013d5f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a8013d600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a8013d610: 00 00 00 00 00 00 00 00[03]fa fa fa fa fa fa fa
  0x0c3a8013d620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a8013d630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a8013d640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a8013d650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a8013d660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11088==ABORTING


=================================================================
==16763==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f0000e20d9 at pc 0x7f7b354aa867 bp 0x7f7b2c6eefc0 sp 0x7f7b2c6ee768
READ of size 170 at 0x60f0000e20d9 thread T10 (event poller 7)
    #0 0x7f7b354aa866  (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866)
    #1 0x55c7a96cfc57 in mpeg_ts_write (/opt/media/media_server+0xc92c57)
    #2 0x55c7a907e6cb in mediakit::MpegMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x6416cb)
    #3 0x55c7a8f0da12 in mediakit::TSMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4d0a12)
    #4 0x55c7a8eb20a9 in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x4750a9)
    #5 0x55c7a9260fb0 in std::_Function_handler<bool (std::shared_ptr<mediakit::Frame> const&), mediakit::MediaSink::addTrack(std::shared_ptr<mediakit::Track> const&)::{lambda(std::shared_ptr<mediakit::Frame> const&)#3}>::_M_invoke(std::_Any_data const&, std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x823fb0)
    #6 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #7 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #8 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #9 0x55c7a927903c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c03c)
    #10 0x55c7a9279871 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x83c871)
    #11 0x55c7a926e2c9 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/media/media_server+0x8312c9)
    #12 0x55c7a955f041 in mediakit::HlsDemuxer::onTick() (/opt/media/media_server+0xb22041)
    #13 0x55c7a955f592 in std::_Function_handler<bool (), mediakit::HlsDemuxer::start(std::shared_ptr<toolkit::EventPoller> const&, mediakit::TrackListener*)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xb22592)
    #14 0x55c7a964d1e9 in std::_Function_handler<unsigned long (), toolkit::Timer::Timer(float, std::function<bool ()> const&, std::shared_ptr<toolkit::EventPoller> const&, bool)::{lambda()#1}>::_M_invoke(std::_Any_data const&) (/opt/media/media_server+0xc101e9)
    #15 0x55c7a964153c in toolkit::EventPoller::flushDelayTask(unsigned long) (/opt/media/media_server+0xc0453c)
    #16 0x55c7a9641d0a in toolkit::EventPoller::getMinDelay() (/opt/media/media_server+0xc04d0a)
    #17 0x55c7a96439e3 in toolkit::EventPoller::runLoop(bool, bool) (/opt/media/media_server+0xc069e3)
    #18 0x55c7a964525c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() (/opt/media/media_server+0xc0825c)
    #19 0x7f7b348286de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
    #20 0x7f7b34afb6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #21 0x7f7b33ee571e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x60f0000e20d9 is located 0 bytes to the right of 169-byte region [0x60f0000e2030,0x60f0000e20d9)
allocated by thread T10 (event poller 7) here:
    #0 0x7f7b3555aba0 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xefba0)
    #1 0x7f7b3488fb8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x124b8a)

Thread T10 (event poller 7) created by T0 here:
    #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef)
    #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994)
    #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974)
    #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28)
    #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284)
    #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) (/opt/media/media_server+0xb7050c)
    #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) (/opt/media/media_server+0xbb9f25)
    #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/media/media_server+0x3b1f82)
    #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751)
    #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3f866) 
Shadow bytes around the buggy address:
  0x0c1e800143c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e800143d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e800143e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e800143f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e80014400: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
=>0x0c1e80014410: 00 00 00 00 00 00 00 00 00 00 00[01]fa fa fa fa
  0x0c1e80014420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e80014430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e80014440: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1e80014450: 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa fa
  0x0c1e80014460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==16763==ABORTING



2022-01-14 00:35:36.940 W media_server[10076-media_server] System.cpp:110 startDaemon | 子进程退出
2022-01-14 00:35:37.942 D media_server[10076-media_server] System.cpp:100 startDaemon | 启动子进程:19705
2022-01-14 00:35:37.942 I media_server[19705-media_server] System.cpp:130 systemSetup | core文件大小设置为:18446744073709551615
2022-01-14 00:35:37.943 I media_server[19705-media_server] System.cpp:139 systemSetup | 文件最大描述符个数设置为:655350
2022-01-14 00:35:37.954 W media_server[19705-media_server] SSLUtil.cpp:98 loadPublicKey | error:02001002:system library:fopen:No such file or directory
2022-01-14 00:35:37.954 W media_server[19705-media_server] SSLUtil.cpp:126 loadPrivateKey | error:2006D080:BIO routines:BIO_new_file:no such file
2022-01-14 00:35:37.955 D media_server[19705-stamp thread] util.cpp:342 operator() | Stamp thread started!
2022-01-14 00:35:38.002 I media_server[19705-media_server] EventPoller.cpp:466 EventPollerPool | 创建EventPoller个数:32
2022-01-14 00:35:38.003 W media_server[19705-media_server] sockutil.cpp:554 bindSock | 绑定套接字失败:address already in use
2022-01-14 00:35:38.003 W media_server[19705-media_server] main.cpp:316 start_main | 端口占用或无权限:listen on 0.0.0.0:1935 failed:address already in use
2022-01-14 00:35:38.004 E media_server[19705-media_server] main.cpp:317 start_main | 程序启动失败，请修改配置文件中端口号后重试!
2022-01-14 00:35:39.004 W media_server[10076-media_server] System.cpp:102 operator() | 收到主动退出信号,关闭父进程与子进程
2022-01-14 00:35:39.004 I media_server[10076-media_server] logger.cpp:72 ~Logger | 
=================================================================
==19705==ERROR: AddressSanitizer: attempting double-free on 0x619000005580 in thread T4 (event poller 1):
    #0 0x7f7b35558bd0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedbd0)
    #1 0x7f7b33e07183  (/lib/x86_64-linux-gnu/libc.so.6+0x43183)
    #2 0x7f7b33e07259 in exit (/lib/x86_64-linux-gnu/libc.so.6+0x43259)
    #3 0x55c7a8d1ac70 in System::startDaemon()::{lambda(int)#1}::_FUN(int) (/opt/media/media_server+0x2ddc70)
    #4 0x7f7b33e0303f  (/lib/x86_64-linux-gnu/libc.so.6+0x3f03f)
    #5 0x7f7b33ee5a46 in epoll_wait (/lib/x86_64-linux-gnu/libc.so.6+0x121a46)
    #6 0x55c7a9643a30 in toolkit::EventPoller::runLoop(bool, bool) (/opt/media/media_server+0xc06a30)
    #7 0x55c7a964525c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() (/opt/media/media_server+0xc0825c)
    #8 0x7f7b348286de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
    #9 0x7f7b34afb6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #10 0x7f7b33ee571e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x619000005580 is located 0 bytes inside of 1040-byte region [0x619000005580,0x619000005990)
freed by thread T5 (event poller 2) here:
    #0 0x7f7b35558bd0 in free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedbd0)
    #1 0x7f7b33e07183  (/lib/x86_64-linux-gnu/libc.so.6+0x43183)

previously allocated by thread T0 here:
    #0 0x7f7b35559198 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee198)
    #1 0x7f7b33e0741e  (/lib/x86_64-linux-gnu/libc.so.6+0x4341e)

Thread T4 (event poller 1) created by T0 here:
    #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef)
    #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994)
    #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974)
    #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28)
    #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284)
    #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) (/opt/media/media_server+0xb7050c)
    #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) (/opt/media/media_server+0xbb9f25)
    #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/media/media_server+0x3b1f82)
    #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751)
    #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

Thread T5 (event poller 2) created by T0 here:
    #0 0x7f7b354bc9ef in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x519ef)
    #1 0x7f7b34828994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd994)
    #2 0x55c7a965c974 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) (/opt/media/media_server+0xc1f974)
    #3 0x55c7a9636f28 in toolkit::EventPollerPool::EventPollerPool() (/opt/media/media_server+0xbf9f28)
    #4 0x55c7a9637284 in toolkit::EventPollerPool::Instance() (/opt/media/media_server+0xbfa284)
    #5 0x55c7a95ad50c in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) (/opt/media/media_server+0xb7050c)
    #6 0x55c7a95f6f25 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) (/opt/media/media_server+0xbb9f25)
    #7 0x55c7a8deef82 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/media/media_server+0x3b1f82)
    #8 0x55c7a8dd2751 in start_main(int, char**) (/opt/media/media_server+0x395751)
    #9 0x7f7b33de5bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: double-free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedbd0) in free
==19705==ABORTING

Jan 13 '22 16:01 alexliyu7352

崩的我受不了了看情况像是数组或者内存越界或者溢出了

我两台机器, 一台300多路, 一台60路. 今天同时更新, 60路那台主要是拉流, 没有崩溃过. 300多路那台崩的我想哭....

Jan 13 '22 17:01 alexliyu7352

启用asan编译后的在我本机也会崩. 只要hls分片拉取超时后,提示"不是ts包:71 358", 就很大可能会崩. 这个的asan信息到是和在服务器上的不一样, 不知道是否不是同一个问题.

2022-01-14 02:27:16.473 W MediaServer[28883-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 358
=================================================================
==28883==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160003c5999 at pc 0x7fc76b73f867 bp 0x7fc765ef7db0 sp 0x7fc765ef7558
READ of size 340 at 0x6160003c5999 thread T3 (event poller 0)
    #0 0x7fc76b73f866 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737
    #1 0x7fc76ab24bd9 in std::char_traits<char>::copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/char_traits.h:352
    #2 0x7fc76ab24bd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:340
    #3 0x7fc76ab24bd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:322
    #4 0x7fc76ab26132 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:370
    #5 0x561dcfb0a4cd in toolkit::BufferLikeString::append(char const*, unsigned long) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Network/Buffer.h:339
    #6 0x561dcff9830a in mediakit::AACRtmpEncoder::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/AACRtmp.cpp:110
    #7 0x561dcfc8c03a in mediakit::RtmpMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Rtmp/RtmpMuxer.cpp:43
    #8 0x561dcfa74710 in mediakit::RtmpMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0xa2e710)
    #9 0x561dcfa642cf in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Common/MultiMediaSourceMuxer.cpp:402
    #10 0x561dcfdeea4b in operator() /home/alex/CLionProjects/media_server/src/Common/MediaSink.cpp:41
    #11 0x561dcfe00882 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #12 0x561dcfe03524 in std::function<bool (std::shared_ptr<mediakit::Frame> const&)>::operator()(std::shared_ptr<mediakit::Frame> const&) const /usr/include/c++/8/bits/std_function.h:687
    #13 0x561dcfe02996 in mediakit::FrameWriterInterfaceHelper::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/Frame.h:311
    #14 0x561dcfe02e86 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/Frame.h:362
    #15 0x561dcfe15d0c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/AAC.cpp:304
    #16 0x561dcfe15774 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/AAC.cpp:283
    #17 0x561dcfdeffe6 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Common/MediaSink.cpp:74
    #18 0x561dcfe02e86 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/Frame.h:362
    #19 0x561dcfe15d0c in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/AAC.cpp:304
    #20 0x561dcfe15774 in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Extension/AAC.cpp:283
    #21 0x561dcfdeffe6 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /home/alex/CLionProjects/media_server/src/Common/MediaSink.cpp:74
    #22 0x561dcffa707b in mediakit::HlsDemuxer::onTick() /home/alex/CLionProjects/media_server/src/Http/HlsPlayer.cpp:528
    #23 0x561dcffa6102 in operator() /home/alex/CLionProjects/media_server/src/Http/HlsPlayer.cpp:466
    #24 0x561dcffaf709 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #25 0x561dd000eb55 in std::function<bool ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #26 0x561dd008140a in operator() /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/Timer.cpp:25
    #27 0x561dd00821a2 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #28 0x561dd006f645 in std::function<unsigned long ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #29 0x561dd006c178 in toolkit::TaskCancelableImp<unsigned long ()>::operator()() const /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Thread/TaskExecutor.h:113
    #30 0x561dd0064875 in toolkit::EventPoller::flushDelayTask(unsigned long) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:395
    #31 0x561dd0065046 in toolkit::EventPoller::getMinDelay() /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:429
    #32 0x561dd0063be9 in toolkit::EventPoller::runLoop(bool, bool) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:292
    #33 0x561dd006ecdb in void std::__invoke_impl<void, void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(std::__invoke_memfun_deref, void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:73
    #34 0x561dd006baec in std::__invoke_result<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>::type std::__invoke<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:95
    #35 0x561dd008081a in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)(), (_S_declval<2ul>)(), (_S_declval<3ul>)())) std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::_M_invoke<0ul, 1ul, 2ul, 3ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) /usr/include/c++/8/thread:244
    #36 0x561dd00805cc in std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::operator()() /usr/include/c++/8/thread:253
    #37 0x561dd0080211 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() /usr/include/c++/8/thread:196
    #38 0x7fc76aabd6de in execute_native_thread_routine ../../../../../src/libstdc++-v3/src/c++11/thread.cc:80
    #39 0x7fc76ad906da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #40 0x7fc76a17a71e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x6160003c5999 is located 0 bytes to the right of 537-byte region [0x6160003c5780,0x6160003c5999)
allocated by thread T3 (event poller 0) here:
    #0 0x7fc76b7efba0 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:90
    #1 0x7fc76ab24b8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:317

Thread T3 (event poller 0) created by T0 here:
    #0 0x7fc76b7519ef in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:202
    #1 0x7fc76aabd994 in __gthread_create /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:662
    #2 0x7fc76aabd994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) ../../../../../src/libstdc++-v3/src/c++11/thread.cc:135
    #3 0x561dd00641d9 in toolkit::EventPoller::runLoop(bool, bool) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:383
    #4 0x561dd0086408 in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Thread/TaskExecutor.cpp:190
    #5 0x561dd0065cc4 in toolkit::EventPollerPool::EventPollerPool() /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:465
    #6 0x561dd0065666 in toolkit::EventPollerPool::Instance() /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:446
    #7 0x561dcffeb8e9 in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Network/Server.cpp:16
    #8 0x561dd0021d59 in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) /home/alex/CLionProjects/media_server/3rdpart/ZLToolKit/src/Network/TcpServer.cpp:18
    #9 0x561dcf9c19fb in void __gnu_cxx::new_allocator<toolkit::TcpServer>::construct<toolkit::TcpServer>(toolkit::TcpServer*) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0x97b9fb)
    #10 0x561dcf9bdcc2 in void std::allocator_traits<std::allocator<toolkit::TcpServer> >::construct<toolkit::TcpServer>(std::allocator<toolkit::TcpServer>&, toolkit::TcpServer*) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0x977cc2)
    #11 0x561dcf9b8e17 in std::_Sp_counted_ptr_inplace<toolkit::TcpServer, std::allocator<toolkit::TcpServer>, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<>(std::allocator<toolkit::TcpServer>) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0x972e17)
    #12 0x561dcf9b4f58 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(toolkit::TcpServer*&, std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0x96ef58)
    #13 0x561dcf9b0470 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0x96a470)
    #14 0x561dcf9ad859 in std::shared_ptr<toolkit::TcpServer>::shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/home/alex/CLionProjects/media_server/release/linux/Debug/MediaServer+0x967859)
    #15 0x561dcf9a8689 in std::shared_ptr<toolkit::TcpServer> std::allocate_shared<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(std::allocator<toolkit::TcpServer> const&) /usr/include/c++/8/bits/shared_ptr.h:706
    #16 0x561dcf9a31a1 in std::shared_ptr<toolkit::TcpServer> std::make_shared<toolkit::TcpServer>() /usr/include/c++/8/bits/shared_ptr.h:722
    #17 0x561dcf9986b8 in start_main(int, char**) /home/alex/CLionProjects/media_server/server/main.cpp:250
    #18 0x561dcf99a1c5 in main /home/alex/CLionProjects/media_server/server/main.cpp:356
    #19 0x7fc76a07abf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c2c80070ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80070af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c80070b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c80070b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c80070b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c80070b30: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80070b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80070b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80070b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80070b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80070b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==28883==ABORTING

Jan 13 '22 18:01 alexliyu7352

貌似这好像是两个问题. 针对最后这种 https://www.geek-share.com/detail/2686054891.html 这篇文章说的是否有用?string.append溢出?

Jan 13 '22 18:01 alexliyu7352

怎么感觉是你版本对不上，子模块版本对不上，没有这个问题呀

Jan 14 '22 01:01 xiongguangjie

我也检查了这个问题, 合并代码的时候仔细合并了, 都是最新的, 而且对应的. 我两台机器, 一台就不会崩, 一台高负载, 又拉又推的频繁崩.

Jan 14 '22 01:01 alexliyu7352

这应该不是我的问题, 我直接clone最新版代码编译, 不做任何修改.一样被查出越界或者溢出了. 以下的日志就是直接clone最新代码后编译的.没做任何改动. 配置文件我有改, addMuteAudio=0 resetWhenRePlay=0 mergeWriteMS=300

=================================================================
==2778==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180000573d7 at pc 0x7fc165fbb867 bp 0x7fc1607f7ce0 sp 0x7fc1607f7488
READ of size 350 at 0x6180000573d7 thread T3 (event poller 0)
    #0 0x7fc165fbb866 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737
    #1 0x7fc1653a0bd9 in std::char_traits<char>::copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/char_traits.h:352
    #2 0x7fc1653a0bd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:340
    #3 0x7fc1653a0bd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:322
    #4 0x7fc1653a2132 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:370
    #5 0x55fd3c5f304d in toolkit::BufferLikeString::append(char const*, unsigned long) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/Buffer.h:339
    #6 0x55fd3caefdc8 in mediakit::AACRtmpEncoder::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AACRtmp.cpp:110
    #7 0x55fd3c7724f0 in mediakit::RtmpMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Rtmp/RtmpMuxer.cpp:43
    #8 0x55fd3c558b27 in mediakit::RtmpMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0xaa4b27)
    #9 0x55fd3c54778d in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MultiMediaSourceMuxer.cpp:402
    #10 0x55fd3c9260ff in operator() /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:41
    #11 0x55fd3c937ebc in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #12 0x55fd3c93ab5e in std::function<bool (std::shared_ptr<mediakit::Frame> const&)>::operator()(std::shared_ptr<mediakit::Frame> const&) const /usr/include/c++/8/bits/std_function.h:687
    #13 0x55fd3c939fd0 in mediakit::FrameWriterInterfaceHelper::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:304
    #14 0x55fd3c93a4c0 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:355
    #15 0x55fd3c94d346 in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:304
    #16 0x55fd3c94cdae in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:283
    #17 0x55fd3c927620 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:74
    #18 0x55fd3c93a4c0 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:355
    #19 0x55fd3c94d346 in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:304
    #20 0x55fd3c94cdae in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:283
    #21 0x55fd3c927620 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:74
    #22 0x55fd3cafbfc5 in mediakit::HlsDemuxer::onTick() /opt/code_test/c++/ZLMediaKit/src/Http/HlsPlayer.cpp:397
    #23 0x55fd3cafafb4 in operator() /opt/code_test/c++/ZLMediaKit/src/Http/HlsPlayer.cpp:336
    #24 0x55fd3cb00cc0 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #25 0x55fd3cb588bd in std::function<bool ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #26 0x55fd3cbc7f8e in operator() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/Timer.cpp:25
    #27 0x55fd3cbc8d26 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #28 0x55fd3cbb6219 in std::function<unsigned long ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #29 0x55fd3cbb2d4c in toolkit::TaskCancelableImp<unsigned long ()>::operator()() const /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Thread/TaskExecutor.h:113
    #30 0x55fd3cbab449 in toolkit::EventPoller::flushDelayTask(unsigned long) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:395
    #31 0x55fd3cbabc1a in toolkit::EventPoller::getMinDelay() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:429
    #32 0x55fd3cbaa7bd in toolkit::EventPoller::runLoop(bool, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:292
    #33 0x55fd3cbb58af in void std::__invoke_impl<void, void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(std::__invoke_memfun_deref, void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:73
    #34 0x55fd3cbb26c0 in std::__invoke_result<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>::type std::__invoke<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:95
    #35 0x55fd3cbc739e in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)(), (_S_declval<2ul>)(), (_S_declval<3ul>)())) std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::_M_invoke<0ul, 1ul, 2ul, 3ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) /usr/include/c++/8/thread:244
    #36 0x55fd3cbc7150 in std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::operator()() /usr/include/c++/8/thread:253
    #37 0x55fd3cbc6d95 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() /usr/include/c++/8/thread:196
    #38 0x7fc1653396de in execute_native_thread_routine ../../../../../src/libstdc++-v3/src/c++11/thread.cc:80
    #39 0x7fc16560c6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #40 0x7fc1649f671e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x6180000573d7 is located 0 bytes to the right of 855-byte region [0x618000057080,0x6180000573d7)
allocated by thread T3 (event poller 0) here:
    #0 0x7fc16606bba0 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:90
    #1 0x7fc1653a0b8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:317

Thread T3 (event poller 0) created by T0 here:
    #0 0x7fc165fcd9ef in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:202
    #1 0x7fc165339994 in __gthread_create /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:662
    #2 0x7fc165339994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) ../../../../../src/libstdc++-v3/src/c++11/thread.cc:135
    #3 0x55fd3cbaadad in toolkit::EventPoller::runLoop(bool, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:383
    #4 0x55fd3cbccf8c in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Thread/TaskExecutor.cpp:190
    #5 0x55fd3cbac898 in toolkit::EventPollerPool::EventPollerPool() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:465
    #6 0x55fd3cbac23a in toolkit::EventPollerPool::Instance() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:446
    #7 0x55fd3cb359f5 in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/Server.cpp:16
    #8 0x55fd3cb6ba8f in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/TcpServer.cpp:18
    #9 0x55fd3c4a417f in void __gnu_cxx::new_allocator<toolkit::TcpServer>::construct<toolkit::TcpServer>(toolkit::TcpServer*) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9f017f)
    #10 0x55fd3c4a0446 in void std::allocator_traits<std::allocator<toolkit::TcpServer> >::construct<toolkit::TcpServer>(std::allocator<toolkit::TcpServer>&, toolkit::TcpServer*) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9ec446)
    #11 0x55fd3c49b59b in std::_Sp_counted_ptr_inplace<toolkit::TcpServer, std::allocator<toolkit::TcpServer>, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<>(std::allocator<toolkit::TcpServer>) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9e759b)
    #12 0x55fd3c4976dc in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(toolkit::TcpServer*&, std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9e36dc)
    #13 0x55fd3c492bf4 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9debf4)
    #14 0x55fd3c48ffdd in std::shared_ptr<toolkit::TcpServer>::shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) /usr/include/c++/8/bits/shared_ptr.h:359
    #15 0x55fd3c48ae0d in std::shared_ptr<toolkit::TcpServer> std::allocate_shared<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(std::allocator<toolkit::TcpServer> const&) /usr/include/c++/8/bits/shared_ptr.h:706
    #16 0x55fd3c485925 in std::shared_ptr<toolkit::TcpServer> std::make_shared<toolkit::TcpServer>() /usr/include/c++/8/bits/shared_ptr.h:722
    #17 0x55fd3c47ac5e in start_main(int, char**) /opt/code_test/c++/ZLMediaKit/server/main.cpp:250
    #18 0x55fd3c47c957 in main /opt/code_test/c++/ZLMediaKit/server/main.cpp:356
    #19 0x7fc1648f6bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c3080002e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3080002e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3080002e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3080002e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3080002e60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3080002e70: 00 00 00 00 00 00 00 00 00 00[07]fa fa fa fa fa
  0x0c3080002e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3080002e90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3080002ea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3080002eb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3080002ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2778==ABORTING

Jan 14 '22 01:01 alexliyu7352

我现在可以很容易的重现这个问题了, 随便找个hls或者ts链接, 然后拉流这个. 比如http://39.135.138.59:18890/PLTV/88888910/224/3221225633/index.m3u8 中间拉流的时候断开网络一段时间, 造成分片下载不全, 或者超时, 然后就崩了.. 如以下日志:


alex@alex-MS-7C37  /opt/code_test/c++/ZLMediaKit/release/linux/Debug   test ±  ./MediaServer  
2022-01-14 09:59:57.116 I MediaServer[4376-MediaServer] System.cpp:130 systemSetup | core文件大小设置为:0
2022-01-14 09:59:57.116 I MediaServer[4376-MediaServer] System.cpp:139 systemSetup | 文件最大描述符个数设置为:4096
2022-01-14 09:59:57.122 W MediaServer[4376-MediaServer] SSLUtil.cpp:98 loadPublicKey | error:02001002:system library:fopen:No such file or directory
2022-01-14 09:59:57.122 W MediaServer[4376-MediaServer] SSLUtil.cpp:126 loadPrivateKey | error:2006D080:BIO routines:BIO_new_file:no such file
2022-01-14 09:59:57.123 D MediaServer[4376-stamp thread] util.cpp:342 operator() | Stamp thread started!
2022-01-14 09:59:57.125 I MediaServer[4376-MediaServer] EventPoller.cpp:466 EventPollerPool | 创建EventPoller个数:16
2022-01-14 09:59:57.126 I MediaServer[4376-MediaServer] TcpServer.cpp:195 start_l | TCP Server listening on 0.0.0.0:1935
2022-01-14 09:59:57.126 I MediaServer[4376-MediaServer] TcpServer.cpp:195 start_l | TCP Server listening on 0.0.0.0:8081
2022-01-14 09:59:57.127 I MediaServer[4376-MediaServer] TcpServer.cpp:195 start_l | TCP Server listening on 0.0.0.0:7443
2022-01-14 09:59:57.128 I MediaServer[4376-MediaServer] TcpServer.cpp:195 start_l | TCP Server listening on 0.0.0.0:10000
2022-01-14 09:59:57.159 I MediaServer[4376-MediaServer] UdpServer.cpp:78 start_l | UDP Server bind to 0.0.0.0:10000
2022-01-14 09:59:57.161 I MediaServer[4376-MediaServer] main.cpp:328 start_main | 已启动http api 接口
2022-01-14 09:59:57.161 I MediaServer[4376-MediaServer] main.cpp:330 start_main | 已启动http hook 接口
2022-01-14 10:00:00.034 T MediaServer[4376-event poller 0] HttpSession.cpp:25 HttpSession | 57(127.0.0.1:59772) 
2022-01-14 10:00:00.276 I MediaServer[4376-event poller 0] Decoder.cpp:225 onTrack | got track: H264
2022-01-14 10:00:00.276 I MediaServer[4376-event poller 0] Decoder.cpp:225 onTrack | got track: mpeg4-generic
2022-01-14 10:00:00.276 I MediaServer[4376-event poller 0] Decoder.cpp:142 onStream | add track finished
2022-01-14 10:00:00.429 D MediaServer[4376-event poller 0] MediaSink.cpp:135 emitAllTrackReady | all track ready use 153ms
2022-01-14 10:00:00.429 D MediaServer[4376-event poller 0] WebApi.cpp:242 http api debug | 
# request:
GET /index/api/addStreamProxy?stream=aoshi&url=http://39.135.138.59:18890/PLTV/88888910/224/3221225633/index.m3u8&app=proxy&enable_mp4=0&rtp_type=0&vhost=__defaultVhost__&secret=035c73f7-bb6b-4889-a715-d9eb2d1925cc&enable_hls=1
# header:
Accept : text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding : gzip, deflate
Accept-Language : en-US,en;q=0.5
Connection : keep-alive
Cookie : csrftoken=ST7cMUfW3wHaUH0rDIlCVV9a0LaEhCOd; sessionid=h8ojor14fi5edczidf6fuc75czt4h3db
DNT : 1
Host : 127.0.0.1:8081
Sec-Fetch-Dest : document
Sec-Fetch-Mode : navigate
Sec-Fetch-Site : none
Sec-Fetch-User : ?1
Sec-GPC : 1
Upgrade-Insecure-Requests : 1
User-Agent : Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
# content:

# response:
{
   "code" : 0,
   "data" : {
      "key" : "__defaultVhost__/proxy/aoshi"
   }
}


2022-01-14 10:00:00.431 I MediaServer[4376-event poller 0] MediaSource.cpp:428 emitEvent | 媒体注册:hls __defaultVhost__ proxy aoshi
2022-01-14 10:00:00.432 D MediaServer[4376-event poller 0] MediaSink.cpp:135 emitAllTrackReady | all track ready use 0ms
2022-01-14 10:00:00.432 I MediaServer[4376-event poller 0] MediaSource.cpp:428 emitEvent | 媒体注册:fmp4 __defaultVhost__ proxy aoshi
2022-01-14 10:00:00.432 I MediaServer[4376-event poller 0] MultiMediaSourceMuxer.cpp:300 onAllTrackReady | stream: http://39.135.138.59:18890/PLTV/88888910/224/3221225633/index.m3u8 , codec info: mpeg4-generic[48000/6/16] H264[1920/1080/25] 
2022-01-14 10:00:00.433 I MediaServer[4376-event poller 0] MediaSource.cpp:428 emitEvent | 媒体注册:rtmp __defaultVhost__ proxy aoshi
2022-01-14 10:00:00.433 I MediaServer[4376-event poller 0] MediaSource.cpp:428 emitEvent | 媒体注册:rtsp __defaultVhost__ proxy aoshi
2022-01-14 10:00:00.433 I MediaServer[4376-event poller 0] MediaSource.cpp:428 emitEvent | 媒体注册:ts __defaultVhost__ proxy aoshi
2022-01-14 10:00:30.435 T MediaServer[4376-event poller 0] HttpSession.cpp:119 onError | 57(127.0.0.1:59772) end of file
2022-01-14 10:00:30.436 T MediaServer[4376-event poller 0] HttpSession.cpp:31 ~HttpSession | 57(127.0.0.1:59772) 

2022-01-14 10:03:50.284 W MediaServer[4376-event poller 0] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642125727-1-1642115130.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:http request timeout
2022-01-14 10:03:50.372 W MediaServer[4376-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 235
=================================================================
==4376==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000166958 at pc 0x7efeea9f0867 bp 0x7efee51f7ce0 sp 0x7efee51f7488
READ of size 350 at 0x615000166958 thread T3 (event poller 0)
    #0 0x7efeea9f0866 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737
    #1 0x7efee9dd5bd9 in std::char_traits<char>::copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/char_traits.h:352
    #2 0x7efee9dd5bd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:340
    #3 0x7efee9dd5bd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:322
    #4 0x7efee9dd7132 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:370
    #5 0x561e5daa904d in toolkit::BufferLikeString::append(char const*, unsigned long) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/Buffer.h:339
    #6 0x561e5dfa5dc8 in mediakit::AACRtmpEncoder::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AACRtmp.cpp:110
    #7 0x561e5dc284f0 in mediakit::RtmpMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Rtmp/RtmpMuxer.cpp:43
    #8 0x561e5da0eb27 in mediakit::RtmpMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0xaa4b27)
    #9 0x561e5d9fd78d in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MultiMediaSourceMuxer.cpp:402
    #10 0x561e5dddc0ff in operator() /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:41
    #11 0x561e5ddedebc in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #12 0x561e5ddf0b5e in std::function<bool (std::shared_ptr<mediakit::Frame> const&)>::operator()(std::shared_ptr<mediakit::Frame> const&) const /usr/include/c++/8/bits/std_function.h:687
    #13 0x561e5ddeffd0 in mediakit::FrameWriterInterfaceHelper::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:304
    #14 0x561e5ddf04c0 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:355
    #15 0x561e5de03346 in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:304
    #16 0x561e5de02dae in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:283
    #17 0x561e5dddd620 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:74
    #18 0x561e5ddf04c0 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:355
    #19 0x561e5de03346 in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:304
    #20 0x561e5de02dae in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:283
    #21 0x561e5dddd620 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:74
    #22 0x561e5dfb1fc5 in mediakit::HlsDemuxer::onTick() /opt/code_test/c++/ZLMediaKit/src/Http/HlsPlayer.cpp:397
    #23 0x561e5dfb0fb4 in operator() /opt/code_test/c++/ZLMediaKit/src/Http/HlsPlayer.cpp:336
    #24 0x561e5dfb6cc0 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #25 0x561e5e00e8bd in std::function<bool ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #26 0x561e5e07df8e in operator() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/Timer.cpp:25
    #27 0x561e5e07ed26 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #28 0x561e5e06c219 in std::function<unsigned long ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #29 0x561e5e068d4c in toolkit::TaskCancelableImp<unsigned long ()>::operator()() const /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Thread/TaskExecutor.h:113
    #30 0x561e5e061449 in toolkit::EventPoller::flushDelayTask(unsigned long) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:395
    #31 0x561e5e061c1a in toolkit::EventPoller::getMinDelay() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:429
    #32 0x561e5e0607bd in toolkit::EventPoller::runLoop(bool, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:292
    #33 0x561e5e06b8af in void std::__invoke_impl<void, void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(std::__invoke_memfun_deref, void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:73
    #34 0x561e5e0686c0 in std::__invoke_result<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>::type std::__invoke<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:95
    #35 0x561e5e07d39e in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)(), (_S_declval<2ul>)(), (_S_declval<3ul>)())) std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::_M_invoke<0ul, 1ul, 2ul, 3ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) /usr/include/c++/8/thread:244
    #36 0x561e5e07d150 in std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::operator()() /usr/include/c++/8/thread:253
    #37 0x561e5e07cd95 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() /usr/include/c++/8/thread:196
    #38 0x7efee9d6e6de in execute_native_thread_routine ../../../../../src/libstdc++-v3/src/c++11/thread.cc:80
    #39 0x7efeea0416da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #40 0x7efee942b71e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x615000166958 is located 0 bytes to the right of 472-byte region [0x615000166780,0x615000166958)
allocated by thread T3 (event poller 0) here:
    #0 0x7efeeaaa0ba0 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:90
    #1 0x7efee9dd5b8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:317

Thread T3 (event poller 0) created by T0 here:
    #0 0x7efeeaa029ef in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:202
    #1 0x7efee9d6e994 in __gthread_create /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:662
    #2 0x7efee9d6e994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) ../../../../../src/libstdc++-v3/src/c++11/thread.cc:135
    #3 0x561e5e060dad in toolkit::EventPoller::runLoop(bool, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:383
    #4 0x561e5e082f8c in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Thread/TaskExecutor.cpp:190
    #5 0x561e5e062898 in toolkit::EventPollerPool::EventPollerPool() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:465
    #6 0x561e5e06223a in toolkit::EventPollerPool::Instance() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:446
    #7 0x561e5dfeb9f5 in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/Server.cpp:16
    #8 0x561e5e021a8f in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/TcpServer.cpp:18
    #9 0x561e5d95a17f in void __gnu_cxx::new_allocator<toolkit::TcpServer>::construct<toolkit::TcpServer>(toolkit::TcpServer*) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9f017f)
    #10 0x561e5d956446 in void std::allocator_traits<std::allocator<toolkit::TcpServer> >::construct<toolkit::TcpServer>(std::allocator<toolkit::TcpServer>&, toolkit::TcpServer*) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9ec446)
    #11 0x561e5d95159b in std::_Sp_counted_ptr_inplace<toolkit::TcpServer, std::allocator<toolkit::TcpServer>, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<>(std::allocator<toolkit::TcpServer>) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9e759b)
    #12 0x561e5d94d6dc in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(toolkit::TcpServer*&, std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9e36dc)
    #13 0x561e5d948bf4 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9debf4)
    #14 0x561e5d945fdd in std::shared_ptr<toolkit::TcpServer>::shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) /usr/include/c++/8/bits/shared_ptr.h:359
    #15 0x561e5d940e0d in std::shared_ptr<toolkit::TcpServer> std::allocate_shared<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(std::allocator<toolkit::TcpServer> const&) /usr/include/c++/8/bits/shared_ptr.h:706
    #16 0x561e5d93b925 in std::shared_ptr<toolkit::TcpServer> std::make_shared<toolkit::TcpServer>() /usr/include/c++/8/bits/shared_ptr.h:722
    #17 0x561e5d930c5e in start_main(int, char**) /opt/code_test/c++/ZLMediaKit/server/main.cpp:250
    #18 0x561e5d932957 in main /opt/code_test/c++/ZLMediaKit/server/main.cpp:356
    #19 0x7efee932bbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c2a80024cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x0c2a80024ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a80024cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a80024d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a80024d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2a80024d20: 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa
  0x0c2a80024d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a80024d40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80024d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80024d60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80024d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4376==ABORTING

Jan 14 '22 02:01 alexliyu7352

当我关闭了合并写的时候, 同样的方式模拟(先断开网络一段时间, 在恢复网络) , 这次不会崩了.但是出现了新的问题


2022-01-14 10:09:43.695 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126057-1-1642115164.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:http request timeout
2022-01-14 10:09:43.795 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 295
2022-01-14 10:09:43.796 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126067-1-1642115165.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:43.796 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:09:43.796 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 289
2022-01-14 10:09:43.882 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 339
2022-01-14 10:09:43.882 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126077-1-1642115166.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:43.883 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 245
2022-01-14 10:09:43.970 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 215
2022-01-14 10:09:43.970 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126087-1-1642115167.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:43.970 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:09:43.970 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 289
2022-01-14 10:09:44.053 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 339
2022-01-14 10:09:44.053 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126097-1-1642115168.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.053 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:09:44.053 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 289
2022-01-14 10:09:44.140 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 339
2022-01-14 10:09:44.140 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126107-1-1642115169.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.222 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126117-1-1642115170.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.222 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:09:44.222 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 289
2022-01-14 10:09:44.303 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 319
2022-01-14 10:09:44.303 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126127-1-1642115171.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.463 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126137-1-1642115172.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.463 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:09:44.463 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 289
2022-01-14 10:09:44.549 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 359
2022-01-14 10:09:44.549 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126147-1-1642115173.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.630 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126157-1-1642115174.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:44.630 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:09:44.630 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 288
2022-01-14 10:09:44.984 T MediaServer[6870-event poller 4] HttpSession.cpp:119 onError | 57(127.0.0.1:59970) end of file
2022-01-14 10:09:44.984 T MediaServer[6870-event poller 4] HttpSession.cpp:31 ~HttpSession | 57(127.0.0.1:59970) 
2022-01-14 10:09:59.793 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 256
2022-01-14 10:09:59.793 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126167-1-1642115175.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:09:59.793 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 328
2022-01-14 10:10:14.970 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 300
2022-01-14 10:10:14.970 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126177-1-1642115176.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:10:14.970 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:10:14.970 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 289
2022-01-14 10:10:15.105 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 299
2022-01-14 10:10:15.105 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126187-1-1642115177.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:10:15.105 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 224
2022-01-14 10:10:30.269 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 216
2022-01-14 10:10:30.269 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126199-1-1642115178.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:10:30.270 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 308
2022-01-14 10:10:45.440 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 216
2022-01-14 10:10:45.440 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126209-1-1642115179.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:10:45.441 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:10:45.441 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 204
2022-01-14 10:10:45.552 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 320
2022-01-14 10:10:45.552 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126219-1-1642115180.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:11:00.721 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126229-1-1642115181.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:11:00.722 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 224
2022-01-14 10:11:15.886 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 320
2022-01-14 10:11:15.887 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126239-1-1642115182.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:11:15.887 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:11:15.887 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 204
2022-01-14 10:11:15.994 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 340
2022-01-14 10:11:15.994 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126249-1-1642115183.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:11:31.170 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126259-1-1642115184.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:11:31.170 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:11:31.170 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 204
2022-01-14 10:11:46.335 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 300
2022-01-14 10:11:46.335 W MediaServer[6870-event poller 4] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642126269-1-1642115185.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /opt/code_test/c++/ZLMediaKit/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161.
2022-01-14 10:11:46.335 W MediaServer[6870-event poller 4] HttpTSPlayer.cpp:47 onResponseBody | 可能不是http-ts流
2022-01-14 10:11:46.335 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-1 204
2022-01-14 10:11:46.449 W MediaServer[6870-event poller 4] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 320

之后的分片下载全部报错失败, 这应该又是一个新的bug. 这里应该重置状态才对, 不应该之后的其他分片下载全部因为上次的数据包提交错误, 而直接报错, 不下载了.

Jan 14 '22 02:01 alexliyu7352

怎么感觉是你版本对不上，子模块版本对不上，没有这个问题呀

而且我放在服务器上流多阿, 有推有拉, 一下子问题就出来了, 光是本机测试, 我也是找了好久才找到问题的.

你试试看...我尝试多次了, 100%重现. 配置如下 addMuteAudio=0 resetWhenRePlay=0 mergeWriteMS=300

其实我觉得主要是一个合并写和resetWhenRePlay哪个部分出现了问题. 上次优化代码和合并mpegts之前的版本, 我一直在用. 没有因为这个崩溃过. 目前抓到的就是两个问题:

数组越界或者内存越界溢出导致的崩, 主要是在toolkit::BufferLikeString::append与mpeg_ts_write
关闭合并写后, 当分片下载不全导致写入的packet不完整后, 没有重置状态, 会导致后续一直触发断言失败.

Jan 14 '22 02:01 alexliyu7352

应该是合并写的问题我其他全部恢复原样, 只开启合并写, 断开网络在恢复, 直接崩

2022-01-14 10:27:43.190 I MediaServer[10054-event poller 1] MediaSource.cpp:428 emitEvent | 媒体注册:hls __defaultVhost__ proxy aoshi
2022-01-14 10:27:43.191 D MediaServer[10054-event poller 1] MediaSink.cpp:135 emitAllTrackReady | all track ready use 1ms
2022-01-14 10:27:43.191 I MediaServer[10054-event poller 1] MediaSource.cpp:428 emitEvent | 媒体注册:fmp4 __defaultVhost__ proxy aoshi
2022-01-14 10:27:43.191 I MediaServer[10054-event poller 1] MultiMediaSourceMuxer.cpp:300 onAllTrackReady | stream: http://39.135.138.59:18890/PLTV/88888910/224/3221225633/index.m3u8 , codec info: mpeg4-generic[48000/6/16] H264[1920/1080/25] 
2022-01-14 10:27:43.192 I MediaServer[10054-event poller 1] MediaSource.cpp:428 emitEvent | 媒体注册:rtmp __defaultVhost__ proxy aoshi
2022-01-14 10:27:43.192 I MediaServer[10054-event poller 1] MediaSource.cpp:428 emitEvent | 媒体注册:rtsp __defaultVhost__ proxy aoshi
2022-01-14 10:27:43.192 I MediaServer[10054-event poller 1] MediaSource.cpp:428 emitEvent | 媒体注册:ts __defaultVhost__ proxy aoshi
2022-01-14 10:28:02.864 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127147-1-1642115272.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:http request timeout
2022-01-14 10:28:02.875 W MediaServer[10054-work poller 0] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.875 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127157-1-1642115273.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.885 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.885 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127167-1-1642115274.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.895 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.896 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127177-1-1642115275.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.905 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.905 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127187-1-1642115276.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.915 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.915 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127197-1-1642115277.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.925 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.925 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127207-1-1642115278.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.934 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.934 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127217-1-1642115279.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:02.943 W MediaServer[10054-work poller 1] sockutil.cpp:295 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:28:02.944 W MediaServer[10054-event poller 1] HlsPlayer.cpp:101 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642127227-1-1642115280.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:resource temporarily unavailable
2022-01-14 10:28:05.765 W MediaServer[10054-event poller 1] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 331
=================================================================
==10054==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x618000009fae at pc 0x7f4611cb7867 bp 0x7f460bcf6ce0 sp 0x7f460bcf6488
READ of size 346 at 0x618000009fae thread T4 (event poller 1)
    #0 0x7f4611cb7866 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737
    #1 0x7f461109cbd9 in std::char_traits<char>::copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/char_traits.h:352
    #2 0x7f461109cbd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy(char*, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:340
    #3 0x7f461109cbd9 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:322
    #4 0x7f461109e132 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:370
    #5 0x5620c6c9d04d in toolkit::BufferLikeString::append(char const*, unsigned long) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/Buffer.h:339
    #6 0x5620c7199dc8 in mediakit::AACRtmpEncoder::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AACRtmp.cpp:110
    #7 0x5620c6e1c4f0 in mediakit::RtmpMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Rtmp/RtmpMuxer.cpp:43
    #8 0x5620c6c02b27 in mediakit::RtmpMediaSourceMuxer::inputFrame(std::shared_ptr<mediakit::Frame> const&) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0xaa4b27)
    #9 0x5620c6bf178d in mediakit::MultiMediaSourceMuxer::onTrackFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MultiMediaSourceMuxer.cpp:402
    #10 0x5620c6fd00ff in operator() /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:41
    #11 0x5620c6fe1ebc in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #12 0x5620c6fe4b5e in std::function<bool (std::shared_ptr<mediakit::Frame> const&)>::operator()(std::shared_ptr<mediakit::Frame> const&) const /usr/include/c++/8/bits/std_function.h:687
    #13 0x5620c6fe3fd0 in mediakit::FrameWriterInterfaceHelper::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:304
    #14 0x5620c6fe44c0 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:355
    #15 0x5620c6ff7346 in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:304
    #16 0x5620c6ff6dae in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:283
    #17 0x5620c6fd1620 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:74
    #18 0x5620c6fe44c0 in mediakit::FrameDispatcher::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/Frame.h:355
    #19 0x5620c6ff7346 in mediakit::AACTrack::inputFrame_l(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:304
    #20 0x5620c6ff6dae in mediakit::AACTrack::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Extension/AAC.cpp:283
    #21 0x5620c6fd1620 in mediakit::MediaSink::inputFrame(std::shared_ptr<mediakit::Frame> const&) /opt/code_test/c++/ZLMediaKit/src/Common/MediaSink.cpp:74
    #22 0x5620c71a5fc5 in mediakit::HlsDemuxer::onTick() /opt/code_test/c++/ZLMediaKit/src/Http/HlsPlayer.cpp:397
    #23 0x5620c71a4fb4 in operator() /opt/code_test/c++/ZLMediaKit/src/Http/HlsPlayer.cpp:336
    #24 0x5620c71aacc0 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #25 0x5620c72028bd in std::function<bool ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #26 0x5620c7271f8e in operator() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/Timer.cpp:25
    #27 0x5620c7272d26 in _M_invoke /usr/include/c++/8/bits/std_function.h:282
    #28 0x5620c7260219 in std::function<unsigned long ()>::operator()() const /usr/include/c++/8/bits/std_function.h:687
    #29 0x5620c725cd4c in toolkit::TaskCancelableImp<unsigned long ()>::operator()() const /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Thread/TaskExecutor.h:113
    #30 0x5620c7255449 in toolkit::EventPoller::flushDelayTask(unsigned long) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:395
    #31 0x5620c7255c1a in toolkit::EventPoller::getMinDelay() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:429
    #32 0x5620c72547bd in toolkit::EventPoller::runLoop(bool, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:292
    #33 0x5620c725f8af in void std::__invoke_impl<void, void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(std::__invoke_memfun_deref, void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:73
    #34 0x5620c725c6c0 in std::__invoke_result<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>::type std::__invoke<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool>(void (toolkit::EventPoller::*&&)(bool, bool), toolkit::EventPoller*&&, bool&&, bool&&) /usr/include/c++/8/bits/invoke.h:95
    #35 0x5620c727139e in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)(), (_S_declval<2ul>)(), (_S_declval<3ul>)())) std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::_M_invoke<0ul, 1ul, 2ul, 3ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) /usr/include/c++/8/thread:244
    #36 0x5620c7271150 in std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> >::operator()() /usr/include/c++/8/thread:253
    #37 0x5620c7270d95 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (toolkit::EventPoller::*)(bool, bool), toolkit::EventPoller*, bool, bool> > >::_M_run() /usr/include/c++/8/thread:196
    #38 0x7f46110356de in execute_native_thread_routine ../../../../../src/libstdc++-v3/src/c++11/thread.cc:80
    #39 0x7f46113086da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #40 0x7f46106f271e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12171e)

0x618000009fae is located 0 bytes to the right of 814-byte region [0x618000009c80,0x618000009fae)
allocated by thread T4 (event poller 1) here:
    #0 0x7f4611d67ba0 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:90
    #1 0x7f461109cb8a in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:317

Thread T4 (event poller 1) created by T0 here:
    #0 0x7f4611cc99ef in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:202
    #1 0x7f4611035994 in __gthread_create /build/gcc-8-quTRg6/gcc-8-8.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:662
    #2 0x7f4611035994 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) ../../../../../src/libstdc++-v3/src/c++11/thread.cc:135
    #3 0x5620c7254dad in toolkit::EventPoller::runLoop(bool, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:383
    #4 0x5620c7276f8c in toolkit::TaskExecutorGetterImp::addPoller(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, int, bool) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Thread/TaskExecutor.cpp:190
    #5 0x5620c7256898 in toolkit::EventPollerPool::EventPollerPool() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:465
    #6 0x5620c725623a in toolkit::EventPollerPool::Instance() /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Poller/EventPoller.cpp:446
    #7 0x5620c71df9f5 in toolkit::Server::Server(std::shared_ptr<toolkit::EventPoller>) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/Server.cpp:16
    #8 0x5620c7215a8f in toolkit::TcpServer::TcpServer(std::shared_ptr<toolkit::EventPoller> const&) /opt/code_test/c++/ZLMediaKit/3rdpart/ZLToolKit/src/Network/TcpServer.cpp:18
    #9 0x5620c6b4e17f in void __gnu_cxx::new_allocator<toolkit::TcpServer>::construct<toolkit::TcpServer>(toolkit::TcpServer*) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9f017f)
    #10 0x5620c6b4a446 in void std::allocator_traits<std::allocator<toolkit::TcpServer> >::construct<toolkit::TcpServer>(std::allocator<toolkit::TcpServer>&, toolkit::TcpServer*) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9ec446)
    #11 0x5620c6b4559b in std::_Sp_counted_ptr_inplace<toolkit::TcpServer, std::allocator<toolkit::TcpServer>, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<>(std::allocator<toolkit::TcpServer>) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9e759b)
    #12 0x5620c6b416dc in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(toolkit::TcpServer*&, std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9e36dc)
    #13 0x5620c6b3cbf4 in std::__shared_ptr<toolkit::TcpServer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) (/opt/code_test/c++/ZLMediaKit/release/linux/Debug/MediaServer+0x9debf4)
    #14 0x5620c6b39fdd in std::shared_ptr<toolkit::TcpServer>::shared_ptr<std::allocator<toolkit::TcpServer>>(std::_Sp_alloc_shared_tag<std::allocator<toolkit::TcpServer> >) /usr/include/c++/8/bits/shared_ptr.h:359
    #15 0x5620c6b34e0d in std::shared_ptr<toolkit::TcpServer> std::allocate_shared<toolkit::TcpServer, std::allocator<toolkit::TcpServer>>(std::allocator<toolkit::TcpServer> const&) /usr/include/c++/8/bits/shared_ptr.h:706
    #16 0x5620c6b2f925 in std::shared_ptr<toolkit::TcpServer> std::make_shared<toolkit::TcpServer>() /usr/include/c++/8/bits/shared_ptr.h:722
    #17 0x5620c6b24c5e in start_main(int, char**) /opt/code_test/c++/ZLMediaKit/server/main.cpp:250
    #18 0x5620c6b26957 in main /opt/code_test/c++/ZLMediaKit/server/main.cpp:356
    #19 0x7f46105f2bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c307fff93a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff93b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff93c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff93d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff93e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c307fff93f0: 00 00 00 00 00[06]fa fa fa fa fa fa fa fa fa fa
  0x0c307fff9400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff9410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff9420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff9430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff9440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==10054==ABORTING

Jan 14 '22 02:01 alexliyu7352

你这个是拉很多个hls流吗

Jan 14 '22 02:01 xia-chu

测试就一个, 一样崩

Jan 14 '22 02:01 alexliyu7352

你看我上面写的, 配置如下 addMuteAudio=0 resetWhenRePlay=0 mergeWriteMS=300 随便找个hls或者ts链接, 然后拉流这个. 比如http://39.135.138.59:18890/PLTV/88888910/224/3221225633/index.m3u8 中间拉流的时候断开网络一段时间, 造成分片下载不全, 或者超时, 然后就崩了..

100%崩, 如果允许 rtmp 那么崩了地方就是toolkit::BufferLikeString::append 如果不允许rtmp, 崩了的地方就是mpeg_ts_write

100%崩

Jan 14 '22 02:01 alexliyu7352

好我测试下大概多久会崩溃？

Jan 14 '22 02:01 xia-chu

2022-01-14 10:42:31.169 I MediaServer[15042-event poller 1] MediaSource.cpp:432 emitEvent | 媒体注册:hls __defaultVhost__ proxy aoshi
2022-01-14 10:42:31.169 D MediaServer[15042-event poller 1] MediaSink.cpp:135 emitAllTrackReady | all track ready use 0ms
2022-01-14 10:42:31.169 I MediaServer[15042-event poller 1] MediaSource.cpp:432 emitEvent | 媒体注册:fmp4 __defaultVhost__ proxy aoshi
2022-01-14 10:42:31.169 I MediaServer[15042-event poller 1] MultiMediaSourceMuxer.cpp:300 onAllTrackReady | stream: http://39.135.138.59:18890/PLTV/88888910/224/3221225633/index.m3u8 , codec info: mpeg4-generic[48000/6/16] H264[1920/1080/25] 
2022-01-14 10:42:31.170 I MediaServer[15042-event poller 1] MediaSource.cpp:432 emitEvent | 媒体注册:ts __defaultVhost__ proxy aoshi
2022-01-14 10:43:02.142 T MediaServer[15042-event poller 1] HttpSession.cpp:119 onError | 58(127.0.0.1:60436) end of file
2022-01-14 10:43:02.142 T MediaServer[15042-event poller 1] HttpSession.cpp:31 ~HttpSession | 58(127.0.0.1:60436) 
2022-01-14 10:43:09.718 W MediaServer[15042-event poller 1] Stamp.cpp:84 revise_l | 强制同步:256 < 221
2022-01-14 10:45:05.824 W MediaServer[15042-work poller 0] sockutil.cpp:297 connect | 连接主机失败:39.135.138.59 18890 network is unreachable
2022-01-14 10:45:16.844 W MediaServer[15042-event poller 1] HlsPlayer.cpp:120 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642128142-1-1642115372.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed: http request timeout
2022-01-14 10:45:16.925 W MediaServer[15042-event poller 1] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 246
=================================================================
==15042==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190002d228d at pc 0x7f03fec72867 bp 0x7f03f8cf6b50 sp 0x7f03f8cf62f8
READ of size 184 at 0x6190002d228d thread T4 (event poller 1)
    #0 0x7f03fec72866 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:737
    #1 0x564c85dcec3e in ts_write_pes /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-ts-enc.c:235
    #2 0x564c85dcf906 in mpeg_ts_write /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-ts-enc.c:324

几分钟吧, 看你的手速了

Jan 14 '22 02:01 alexliyu7352

其实如果想测试2-3分钟就足够了. 先拉一个hls或者ts流, 不想找就直接用我测试的那个. 等待注册好track后, 断开你本机的网络, 差不多20秒, 或者看到提示 connect | 连接主机失败:39.135.138.59 18890, 然后立马恢复网络.就可以看到崩了.

Jan 14 '22 02:01 alexliyu7352

我测试了一晚上到现在, 原先以为是服务器拉流还有接收推流很多, 所以哪里出现了空指针.排查了好久. 后来我觉得是不是我自己的代码和合并了你的项目最新的代码冲突了, 又检查了好久. 最后在本机换成各种方式调试.换成没有修改的你的全部代码, 尝试各种复现这个崩溃的方法. 最后才在1小时前确认了, 是这个100%崩.

Jan 14 '22 03:01 alexliyu7352

但是我不知道为何会崩, 这块合并写的代码, 我检查了没发现从12月16日的代码到现在有什么大的改动. 这段时间大的改动就是一个是合并了mpegts的解复用, 一个就是优化了.其他的改动应该不涉及到.

所以, 我虽然重现了这个崩溃, 但是这里我找不到问题所在.

Jan 14 '22 03:01 alexliyu7352

另外还有一个问题默认我编译的是不开启ASAN的release版本. 当没有开启ASAN的时候, 上述的测试并不会导致崩掉.程序还是会运行. 昨天在服务器上部署的就是没有开启ASAN的release版本. 差不多8小时崩了4次左右. 我不确定是否是同样的问题, 因为根据core文件, 只能得到一个这样的堆栈错误信息. Backtrace stopped: Cannot access memory at address 0x7fe5c87fbb90

但是如果开启asan部署在服务器上, 直接几分钟崩一次. 我哭都哭不出来... 所以大佬, 我怎么在服务器上部署呢?不开启asan, 部署一个debug版本?还是增加-g的编译选项的release版本? 服务器上不敢乱搞阿.

Jan 14 '22 03:01 alexliyu7352

你不开启asan 应该不会崩溃。这个原因有可能是asan不能hook libc库中malloc调用，比如说strdup/asprintf; 但是却hook了zlm调用的free，导致用asan的free去释放非asan分配的内存

Jan 14 '22 03:01 xia-chu

我这开启asan也会很快崩溃，之前开启asan也有上面说的问题，webrtc的mediasoup源码打印的日志是asprintf申请的内存，但是后面free就崩溃了

Jan 14 '22 03:01 xia-chu

不开启也会崩掉, 我昨天之前没有开启asan, 8小时崩了4次.

Jan 14 '22 03:01 alexliyu7352

而且不开启asan找不到错误阿.

core文件使用gdb bt只能获取到 Backtrace stopped: Cannot access memory at address 0x7fe5c87fbb90

怎么办?

Jan 14 '22 03:01 alexliyu7352

2022-01-14 11:26:09.269 W MediaServer[27699-event poller 0] Stamp.cpp:84 revise_l | 强制同步:192 < 189 2022-01-14 11:28:41.546 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 219 2022-01-14 11:28:41.571 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:-98 302 2022-01-14 11:28:41.571 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 231 2022-01-14 11:28:41.572 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:28:41.572 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:28:41.574 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:28:41.574 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:28:41.618 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:28:41.618 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:28:41.640 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:28:41.640 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:10.891 W MediaServer[27699-event poller 0] HlsPlayer.cpp:243 operator() | download ts segment http://39.135.138.59:18890/PLTV/88888910/224/3221225633/1642130850-1-1642115643.hls.ts?ssr_hostlv1=39.134.116.1:18890&ssr_host=117.169.120.150:8080 failed:http request timeout 2022-01-14 11:30:10.929 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 270 2022-01-14 11:30:10.951 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 217 2022-01-14 11:30:36.923 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 282 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:22 216 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 254 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:30:36.948 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:36.961 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:30:36.961 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:36.967 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:30:36.967 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:57.056 W MediaServer[27699-event poller 0] TSDecoder.cpp:31 onRecvHeader | Assertion failed: (pes->pkt.size == pes->len), function pes_packet, file /home/alex/CLionProjects/media_server/3rdpart/media-server/libmpeg/source/mpeg-packet.c, line 161. 2022-01-14 11:30:57.056 W MediaServer[27699-event poller 0] TSDecoder.cpp:32 onRecvHeader | 解析ts包错误:71 188 2022-01-14 11:30:57.228 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:71 195 2022-01-14 11:30:57.256 W MediaServer[27699-event poller 0] TSDecoder.cpp:24 onRecvHeader | 不是ts包:72 369

另外还有一个问题, 比如上面的日志. 当下载的包不完整时, 应该重置一次mpeg-packet里的状态吧?或者丢弃掉这个packet吧, 否则会一直 Assertion failed, 哪怕后续的packet是完整的.

Jan 14 '22 03:01 alexliyu7352

这个问题很早就存在就是一直没触发。因为hls拉流超时了所以导致aac不完整，而这个流又比较特殊，一个aac frame中有多个adts包，在split时未做内存越界判断所以崩溃

Jan 14 '22 05:01 xia-chu