Repository: opencv
Issue: ffmpeg decoder crash for raw (uncompressed) avi file
Labels: bug,auto-transferred,priority: normal,category: videoio,affected: 2.4

Transferred from http://code.opencv.org/issues/3199

```
|| Guillaume Dumont on 2013-08-06 14:47
|| Priority: Normal
|| Affected: 2.4.6 (latest release)
|| Category: highgui-video
|| Tracker: Bug
|| Difficulty: 
|| PR: 
|| Platform: x86 / Windows
```
## ffmpeg decoder crash for raw (uncompressed) avi file

```
In CvCapture_FFMPEG::grabFrame :

The call to avcodec_decode_video2  does not seem to allocate memory for the AVFrame that is passed to it when a raw uncompressed video is decoded. It seems like the call to av_free_packet frees the memory that the AVFrame::data[0] is pointing to.

then in CvCapture_FFMPEG::retrieveFrame :

the call to sws_scale crashes because ffmpeg tries to write to invalid memory. 

Any idea how to fix this?
```
## History
##### Victor Kocheganov on 2013-08-08 04:55

```
Hello Guillaume Dumont,

thank you for reporting the issue! 
Could you please provide some more information to reproduce the issue: example code, output logs. 

Thanks.
-   Status changed from New to Incomplete
-   Category set to highgui-video
```
##### Guillaume Dumont on 2013-08-12 16:02

```
Hi,

Thanks for the response. Attached is the source code of two sample applications, one which uses ffmpeg 0.10.7 (which I think is the same one, test, that opencv uses) I compiled myself with MinGW and one, test2, that uses that one provided with opencv as a prebuilt binary. The crash occurs in both applications. 

See comments main2.cpp line 19 and cap_ffmpeg_impl.hpp lines 684-685. If line 685 is commented no crash occurs when sws_scale is called in cap_ffmpeg_impl.hpp at line 728. To me it seems like the memory freed by av_free_packet should not be freed or there should be a copy when
avcodec_decode_video2 is called at line 657 in cap_ffmpeg_impl.hpp. Please note that no crash occurs if we use the VFW backend instead of ffmpeg.

The video I'm a using to test was too large to fit in the attachments and I'd rather not make it publicly available so let me know if I can transfer it to you by some other mean.
-   File opencv_ffmpeg.7z added
```
##### Jaime  Alemany on 2013-08-17 01:40

```
Hi

What about removing the last call to av_free_packet in grabFrame?

I have recently upgraded mi OS from Ubuntu 12 to 13.04. After that if i try to play some uncompressed avi videos sometimes have a crash, sometimes i can see corrupted images on the window.  I have commented this call to the function and now seems to work fine (opencv 2.4.6)

I have not tested for memory leaks but seems that the memory used when playing very long videos is correctly managed.
```
##### Jaime  Alemany on 2013-08-21 16:35

```
I can confirm that: after the call to av_decode_video2 the picture->data is the same pointer than packet.data. So, when calling av_free_packet this memory is freed and after thet it cannot be referenced as it is done in retrieveframe function. This is probably a bug (or a feature) in the ffmpeg decode function. Attached a ddd debuger screen capture.

Removing the last call to av_free_packet allows to call retrievefreme() without accessing the freed memory but, i found a problem when seeking a frame (cvSetCaptureProperty) in a YUYV video file. After seeking grabFrame returns 0 and frames cannot be read. 

EDIT: opencv 2.4.6.1 compiled with ffmpeg support (last version of ffmpeg compiled from source 23-08-2013), works fine. Line 683 in cap_ffmpeg_impl.hpp commented (line 699 in the git version, call to av_free_packet) and no crashes, no access to freed memory (valgrind doesnt report) and no seek issues in video files with YUY2 codec.
-   File picture.png added
```