malloc(): corrupted top size while opening an image fullscreen

[ar1ja]

Important Information

Provide following Information:

• mpv version:

mpv 0.34.1 Copyright © 2000-2021 mpv/MPlayer/mplayer2 projects
 built on UNKNOWN
FFmpeg library versions:
   libavutil       56.70.100
   libavcodec      58.134.100
   libavformat     58.76.100
   libswscale      5.9.100
   libavfilter     7.110.100
   libswresample   3.9.100
FFmpeg version: 4.4.2

• Linux Distribution and Version: Gentoo Base System release 2.8 x86_64
• Source of the mpv binary: None, my own overlay: https://ari-web.xyz/overlay
• If known which version of mpv introduced the problem: Nope, I just noticed it
• Window Manager and version: DWM 6.2 (modified @ https://ari-web.xyz/dotfiles)
• GPU driver and version: No idea, I use xorg-drivers with VIDEO_CARDS="intel i915 iris"
• Possible screenshot or video of visual glitches: If you open this image https://files.ari-web.xyz/files/6018227790450634283_119.jpg and full-screen it you'll this this output:

 (+) Video --vid=1 (mjpeg 2560x562 1.000fps)
VO: [gpu] 2560x562 yuv420p
(Paused) V: 00:00:00 / 00:00:00 (0%) Cache: 0.0s
Warning: property 'video-aspect' is deprecated, refer to 'video-params/aspect' and 'video-aspect-override'.
Track switched:
     Video --vid=1 (mjpeg 2560x562 1.000fps)
Track switched:
 (+) Video --vid=1 (mjpeg 2560x562 1.000fps)
(...) V: 00:00:00 / 00:00:00 Cache: 0.0s
[ffmpeg] swscaler: Warning: data is not aligned! This can lead to a speed loss
malloc(): corrupted top size
Aborted

If you're not using git master or the latest release, update. Releases are listed here: https://github.com/mpv-player/mpv/releases

pretty sure I am

Reproduction steps

Try to reproduce your issue with --no-config first. If it isn't reproducible with --no-config try to first find out which option or script causes your issue.

With a config I get this output:

 (+) Video --vid=1 (mjpeg 2560x562 1.000fps)
VO: [gpu] 2560x562 yuv420p
(Paused) V: 00:00:00 / 00:00:00 (0%) Cache: 0.0s
Warning: property 'video-aspect' is deprecated, refer to 'video-params/aspect' and 'video-aspect-override'.
Track switched:
     Video --vid=1 (mjpeg 2560x562 1.000fps)
Track switched:
 (+) Video --vid=1 (mjpeg 2560x562 1.000fps)
(...) V: 00:00:00 / 00:00:00 Cache: 0.0s
[ffmpeg] swscaler: Warning: data is not aligned! This can lead to a speed loss
malloc(): corrupted top size
Aborted

Without a config it's fine

Describe the reproduction steps as precise as possible. It's very likely that the bug you experience wasn't reproduced by the developer because the workflow differs from your own.

Found the script causing the issue: blur-edges.lua Not sure where I took it from but here it is:

https://files.ari-web.xyz/files/blur-edges.lua

Expected behavior

For it not to cause a malloc error

Actual behavior

It does

Log file

Make a log file made with -v -v or --log-file=output.txt, paste it to https://0x0.st/ or attach it to the github issue, and replace this text with a link to it.

The issue will be closed for ignoring the issue template.

output.txt

Sample files

Sample files needed to reproduce this issue can be uploaded to https://0x0.st/ or similar sites. (Only needed if the issue cannot be reproduced without it.) Do not use garbage like "cloud storage", especially not Google Drive.

Script: https://files.ari-web.xyz/files/blur-edges.lua Image: https://files.ari-web.xyz/files/6018227790450634283_119.jpg

[Traneptora]

Don't waste our time by linking pointless memes.

Also try using FFmpeg 5.1 or git master, since 4.4.2 is out of date.

In either case, if upgrading to git master doesn't resolve the issue, try using a debug build and posting the output from valgrind.

[ar1ja]

Don't waste our time by linking pointless memes.

Also try using FFmpeg 5.1 or git master, since 4.4.2 is out of date.

In either case, if upgrading to git master doesn't resolve the issue, try using a debug build and posting the output from valgrind.

I'm not linking pointless memes, that specific image crashed my mpv with that exact error, I got that meme from linuxmemes telegram channel, tried to open it in full screen and boom -- dead

but okay, will do

[ar1ja]

On an arch Linux VM I'm getting:

invalid fastbin entry (free) Cache: 0.0s
Aborted (core dumped)

Using a debug build:

malloc(): corrupted top size (0%) Cache: 0.0s
Aborted (core dumped)

Debug valgrind output can be found here, but I cannot reproduce that using valgrind somehow (like I am from what I can see in the logs but the program doesn't crash)

I ran valgrind with such options:

valgrind --log-file=a.txt --trace-children=yes -s ...

• log-file just specifies the log file
• trace-children will trace the child processes
• s will show the error list (like a traceback from what I get?)

Those options do not affect the program, they both end up with the same results, just different logs, this one will just give slightly more info in a nicer format

Sorry that I didn't use it on my own system, the same issue is reproducable on arch so I just used that, it's kinda painful to compile ffmpeg, valgrind and setup glibc with debug symbols enabled, it's just gonna take much longer :)

[ar1ja]

By the way, the exact command I'm running:

mpv https://files.ari-web.xyz/files/6018227790450634283_119.jpg

And then pressing f to full-screen it

Also, keep in mind, it's this image specifically, I have not looked nor found any other image that crashed mpv like this, though there is huge potential to discover what's wrong with that image and craft one that does probably :shrug:

[Traneptora]

If you can't reproduce it with --no-config see if you can determine which options are triggering the crash, since I also cannot reproduce this with mpv --no-config --pause --vo=x11.

[ar1ja]

If you can't reproduce it with --no-config see if you can determine which options are triggering the crash, since I also cannot reproduce this with mpv --no-config --pause --vo=x11.

Yes, I cannot reproduce it without a config, i got down to blur-edges.lua script, not sure which option though and idek how to test options so sorry, not sure what to do from here

[ZaquL]

I have not looked nor found any other image that crashed mpv like

Maybe it is ICC profile on the jpg file with "GIMP built-in sRGB".

[ar1ja]

I have not looked nor found any other image that crashed mpv like

Maybe, it is ICC profile on the jpg file with "GIMP built-in sRGB".

Also, it might be some bytes to do with the header, like the header looks off when I compare it to other jpegs

[faridcher]

In my case, it culprit was blur-edges.lua. I removed it and this error fade away. mpv --no-config was very helpful.

[ar1ja]

In my case, it culprit was blur-edges.lua. I removed it and this error fade away. mpv --no-config was very helpful.

Yeah but shouldn't mpv still fix this ? I mean it shouldn't just outright throw an unhandled err imo

[Traneptora]

Yea, it's still a bug, adding a lua script shouldn't cause a crash in the C code.

[ar1ja]

I keep getting more and more segfaults and malloc errors, I'm so confused

[ar1ja]

new url to the source image: https://0x0.st/o5D1.jpg

[ar1ja]

found another image, idk if gh compresses it or anything, but yeah, original image : https://redd.it/12vyzkv

it was posted on telegram on @programmer_humour channel, compressed

 (+) Video --vid=1 (mjpeg 512x122 1.000fps)
VO: [gpu] 512x122 yuv420p
V: 00:00:00 / 00:00:00 (0%)
Warning: property 'video-aspect' is deprecated, refer to 'video-params/aspect' and 'video-aspect-override'.
Track switched:
     Video --vid=1 (mjpeg 512x122 1.000fps)
Track switched:
 (+) Video --vid=1 (mjpeg 512x122 1.000fps)
V: 00:00:00 / 00:00:00 (0%)
[ffmpeg] swscaler: Warning: data is not aligned! This can lead to a speed loss
VO: [gpu] 512x288 yuv420p
malloc(): corrupted top size

[Dudemanguy]

Can't reproduce it here when trying it with blur-edges.lua.

[ar1ja]

Can't reproduce it here when trying it with blur-edges.lua.

github probably compresses it, so here : https://files.ari-web.xyz/files/5921115968547958857_120.jpg

mpv 'https://files.ari-web.xyz/files/5921115968547958857_120.jpg'

edit : dont forget to fullscreen

[ar1ja]

maybe the issue is telegram compression ? maybe it does something odd and the images just make mpv :sparkle: crash :sparkle:

[Dudemanguy]

Oh okay that worked (i.e. crashed) now. Seems to happen when mpv allocates a new mp_image.

[ar1ja]

github probably compresses it

Nope. Bitperfect.

/shrug

[Dudemanguy]

Well now I can't reproduce it anymore. I think the uploaded file might have changed? Do you know if this is still a problem?

[ar1ja]

it in fact does not crash anymore :), thank u for fixing it

[Dudemanguy]

No idea what might have fixed this but glad that it works now.