nginx_mod_h264_streaming-2.2.7模块遇到不完整MP4文件导致nginx进程死掉（ truncated mp4 make nginx crash）

nginx_mod_h264_streaming-2.2.7 bug 导致nginx进程crash，When new version release to fix the problem about truncated mp4 make nginx crash? errorlog like *** glibc detected *** nginx: worker process: double free or corruption (!prev): 0x000000000b8dfe00 ***



2.3.2版本虽然解决这个问题，但会产生新问题：当文件不存在的时候返回415（不支持的文件类型，应该返回404）。另外一个没有经过验证的解决方案见下文。



一、错误产生过程

在t前台播放时，播放器显示video not found，用MP4Box查看该mp4文件信息是不完整的:

# MP4Box -info /data/video/b9463.mp4
Error opening file /data/video/b9463.mp4: IsoMedia File is truncated



二、nginx 错误日志示例：

2010/12/30 17:42:08 [alert] 31354#0: worker process 31357 exited on signal 6
*** glibc detected *** nginx: worker process: double free or corruption (!prev): 0x0000000001fc64e0 ***
======= Backtrace: =========
/lib/libc.so.6(+0x71ad6)[0x7f2344918ad6]
/lib/libc.so.6(cfree+0x6c)[0x7f234491d84c]
/lib/libc.so.6(fclose+0x14d)[0x7f2344909a1d]
nginx: worker process[0x46305a]
nginx: worker process[0x463b13]
nginx: worker process[0x460500]
nginx: worker process[0x404e43]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7f23448c5c4d]
nginx: worker process[0x403579]
======= Memory map: ========
00400000-00485000 r-xp 00000000 08:07 96680 /usr/sbin/nginx
00685000-00692000 rw-p 00085000 08:07 96680 /usr/sbin/nginx
00692000-006a0000 rw-p 00692000 00:00 0
01faf000-0213d000 rw-p 01faf000 00:00 0 [heap]
7f233c000000-7f233c021000 rw-p 7f233c000000 00:00 0
7f233c021000-7f2340000000 ---p 7f233c021000 00:00 0
7f2343255000-7f234326b000 r-xp 00000000 08:09 16099 /lib/libgcc_s.so.1

三、原因

nginx_mod_h264_streaming-2.2.7 MP4拖拽模块遇到错误或者不完整的mp4文件时会导致进程crash,错误日志如:

*** glibc detected *** nginx: worker process: double free or corruption (!prev): 0x000000000b8dfe00 ***



影响该 work process 负责的所有链接。



四、解决

2.2.7的mp4模块问题出现在mp4_io.c: read_box(), 出错时会 fclose(infile)

509 if(fread(box_data, (off_t)atom->size_, 1, infile) != 1)

510 {

511 MP4_ERROR("Error reading %c%c%c%c atom/n",

512 atom->type_ >> 24, atom->type_ >> 16,

513 atom->type_ >> 8, atom->type_);

514 free(box_data);

515 fclose(infile);

而mp4_context_exit 尝试再次关闭它,产生了double free or corruption

543 static void mp4_context_exit(struct mp4_context_t* mp4_context)

544 {

545 free(mp4_context->filename_);

546

547 if(mp4_context->infile)

548 {

549 fclose(mp4_context->infile);

550 }

可以通过在 read_box fclose(infile)之后把infile置为空避免double free的问题

+ mp4_context->infile = NULL;



当然,作者未公布的版本2.3.2也fix了这个问题,但是有个新问题,同样需要patch(文件不存在会返回415...),估计还在bug fix阶段,未release

五、官方参考

http://h264.code-shop.com/trac/discussion/1/156?discussion_action=quote;

http://favortel.blog.sohu.com/158346223.html

Bug Reports V2 (#1) - When new version release to fix the truncated mp4 make nginx crash? (#156) - Message List