MJPEG解码偶现在jpegd_parser() 位置调用mpp_osal_free()发生崩溃

[imxys]

SDK：RK3399 我使用的是旧版本的MPP库，编码器参数是结构体的那种（还没换新的） 但是我看了一下如果用新的MPP库，可能问题也会存在，报错位置附近的操作没有太大变化

我在某些场景下同时打开了两个MJPEG解码器，一个是1080P的图片 62531字节反复送入，另一个是摄像头数据也是1080P 遇到了如下崩溃：

[0m2021-08-29 15:28:08.664   943   943 [DEBUG  ] sys_monitor : #0  0x0000007f9cf62468 in raise () from /lib/libc.so.6
[0m2021-08-29 15:28:08.665   943   943 [DEBUG  ] sys_monitor : [Current thread is 1 (Thread 0x7f49ff71c0 (LWP 22134))]
[0m2021-08-29 15:28:08.666   943   943 [DEBUG  ] sys_monitor : #0  0x0000007f9cf62468 in raise () from /lib/libc.so.6
[0m2021-08-29 15:28:08.667   943   943 [DEBUG  ] sys_monitor : #1  0x0000007f9cf509d4 in abort () from /lib/libc.so.6
[0m2021-08-29 15:28:08.668   943   943 [DEBUG  ] sys_monitor : #2  0x0000007f9cf9acf0 in ?? () from /lib/libc.so.6
[0m2021-08-29 15:28:08.669   943   943 [DEBUG  ] sys_monitor : #3  0x0000007f9cfa12cc in ?? () from /lib/libc.so.6
[0m2021-08-29 15:28:08.669   943   943 [DEBUG  ] sys_monitor : #4  0x0000007f9cfa2e5c in ?? () from /lib/libc.so.6
[0m2021-08-29 15:28:08.725   943   943 [DEBUG  ] sys_monitor : #5  0x0000007f7ffa3d2c in mpp_osal_free (caller=caller@entry=0x7f7ffb1162 <__FUNCTION__.7381> "jpeg
[0m2021-08-29 15:28:08.725   943   943 [DEBUG  ] sys_monitor : d_prepare", ptr=0x7f0c0b3660) at /media/xys/ssdext4/rk3399_linux_release/buildroot/output/rockchip_
[0m2021-08-29 15:28:08.725   943   943 [DEBUG  ] sys_monitor : rk3399/build/mpp-release/osal/mpp_mem.cpp:719
[0m2021-08-29 15:28:08.739   943   943 [DEBUG  ] sys_monitor : #6  0x0000007f7ff45c3c in jpegd_prepare (ctx=0x3f4ab7a0, pkt=0x7f18005ac0, task=0x7f49ff6938) at /m
[0m2021-08-29 15:28:08.739   943   943 [DEBUG  ] sys_monitor : edia/xys/ssdext4/rk3399_linux_release/buildroot/output/rockchip_rk3399/build/mpp-release/mpp/codec/
[0m2021-08-29 15:28:08.739   943   943 [DEBUG  ] sys_monitor : dec/jpeg/jpegd_parser.c:1014
[0m2021-08-29 15:28:08.740   943   943 [DEBUG  ] sys_monitor : #7  0x0000007f7ff1b880 in mpp_dec_advanced_thread (data=0x3f4aa700) at /media/xys/ssdext4/rk3399_li
[0m2021-08-29 15:28:08.740   943   943 [DEBUG  ] sys_monitor : nux_release/buildroot/output/rockchip_rk3399/build/mpp-release/mpp/codec/mpp_dec.cpp:1130
[0m2021-08-29 15:28:08.740   943   943 [DEBUG  ] sys_monitor : #8  0x0000007f9d0a27e4 in start_thread () from /lib/libpthread.so.0
[0m2021-08-29 15:28:08.741   943   943 [DEBUG  ] sys_monitor : #9  0x0000007f9cffb6bc in ?? () from /lib/2021-08-29 15:28:08.741   943   943 [DEBUG  ] sys_monitor : #9  0x0000007f9cffb6bc in ?? () from /lib/libc.so.6

沿着报错栈找崩溃点应该是在 mpp_dec_advanced_thread()

        if (mpp_packet_get_buffer(packet)) {
            /*
             * if there is available buffer in the input packet do decoding
             */
            MppBuffer input_buffer = mpp_packet_get_buffer(packet);
            MppBuffer output_buffer = mpp_frame_get_buffer(frame);

            mpp_parser_prepare(dec->parser, packet, task_dec);

然后 jpegd_parser.c 的 jpegd_prepare()

    if (pkt_length > JpegCtx->bufferSize) {
        jpegd_dbg_parser("Huge Frame(%d Bytes)! bufferSize:%d",
                         pkt_length, JpegCtx->bufferSize);
        mpp_free(JpegCtx->recv_buffer);
        JpegCtx->recv_buffer = NULL;

打开jpegd_debug=0x20时，发现我这边在使用过程中送入的单帧MJPEG会变得偏大，400kB左右，有时候会瞬间送入500kB甚至700kB的一帧画面，此时可以看到如下日志（这个日志和崩溃不是同时获取的）

mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 610471 eos 0
mpp[2638]: jpegd_parser: Huge Frame(610471 Bytes)! bufferSize:524288
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: input_packet:0x23b279e0, recv_buffer:0x7ee801a1e0, pkt_length:610471
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 616564 eos 0
mpp[2638]: jpegd_parser: Huge Frame(616564 Bytes)! bufferSize:611495
mpp[2638]: jpegd_parser: input_packet:0x23b279e0, recv_buffer:0x7ee801a1e0, pkt_length:616564
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 619700 eos 0
mpp[2638]: jpegd_parser: Huge Frame(619700 Bytes)! bufferSize:617588
mpp[2638]: jpegd_parser: input_packet:0x23b279e0, recv_buffer:0x7ee801a1e0, pkt_length:619700
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0
mpp[2638]: jpegd_parser: pkt_length 622302 eos 0
mpp[2638]: jpegd_parser: Huge Frame(622302 Bytes)! bufferSize:620724
mpp[2638]: jpegd_parser: pkt_length 62531 eos 0
mpp[2638]: jpegd_parser: input_packet:0x7ef8000c20, recv_buffer:0x7ef8002720, pkt_length:62531
mpp[2638]: jpegd_parser: frame_slot_index:0

说明这边的增大缓存处理有时候是成功的

请问遇到这种问题是不是应当排查内存耗尽相关的情况？麻烦帮忙定位一下，谢谢