** Description changed:
[ Impact ]
When frame-size enumeration and fallback probes leave the maximum at
32768x32768, 32-bit arithmetic overflows and requests only 256 KiB.
This breaks 4K JPEG encoding on MediaTek Genio. The upstream fix uses
requested dimensions and 64-bit arithmetic in both V4L2 planar paths.
[ Test Plan ]
- On an affected Genio board, run with the archive package, then
- -proposed:
- sudo env GST_DEBUG='v4l2*:5' timeout 120s gst-launch-1.0 -v \
- videotestsrc num-buffers=300 ! queue ! \
- video/x-raw,framerate=30/1,width=3840,height=2160,format=NV12 ! \
- v4l2jpegenc ! queue ! jpegparse ! qtmux ! filesink location=out.mov
+ Repeat with archive and -proposed packages on the same hardware/kernel;
+ record package/plugin versions, V4L2 debug logs and new kernel errors.
- Before: CAPTURE sizeimage=262144; pipeline failure or invalid output.
- After: sizeimage=8294400 on g1200, exit 0/EOS, and successful decoding:
+ 1. Genio: reproduce 4K JPEG encoding, then decode out.mov:
- gst-launch-1.0 -q filesrc location=out.mov ! qtdemux ! \
- jpegparse ! jpegdec ! fakesink sync=false
+ sudo env GST_DEBUG='v4l2*:5' timeout 120s gst-launch-1.0 -v \
+ videotestsrc num-buffers=300 ! queue ! \
+ video/x-raw,framerate=30/1,width=3840,height=2160,format=NV12 ! \
+ v4l2jpegenc ! queue ! jpegparse ! qtmux ! filesink location=out.mov
+ gst-launch-1.0 -q filesrc location=out.mov ! qtdemux ! jpegparse ! jpegdec
! fakesink sync=false
- Save package/plugin versions, debug logs and dmesg before/after; expect
- no new STALL messages, but their absence alone does not prove success.
+ Before: sizeimage=262144 and invalid output/failure. After: 8294400 on
+ g1200, EOS/exit 0 and decodable output; no new STALL errors.
+
+ 2. Raspberry Pi bcm2835-codec JPEG encode: run in Ubuntu 24.04 arm64
+ (the tested environment is the noble Docker container, sharing the Pi's
+ kernel/devices). Test three resolutions with SMPTE and snow at 5 fps.
+
+ export GST_DEBUG='v4l2*:5'
+ for S in 640x480 1280x720 1920x1080; do
+ W=${S%x*}; H=${S#*x}
+ for P in smpte snow; do
+ timeout 120s gst-launch-1.0 -q \
+ videotestsrc num-buffers=60 is-live=true pattern=$P ! \
+ video/x-raw,format=I420,width=$W,height=$H,framerate=5/1 ! \
+ v4l2jpegenc ! jpegparse ! jpegdec ! videoconvert ! \
+ video/x-raw,format=RGB,width=$W,height=$H ! filesink
location=jpeg.rgb && \
+ test "$(wc -c < jpeg.rgb)" -eq "$((W*H*3*60))" || exit 1
+ done
+ done
+
+ Require EOS/exit 0 and 60 decoded frames (the exact RGB byte count).
+
+ 3. Raspberry Pi bcm2835-codec H.264 decode: in the same Ubuntu environment,
+ generate the input once and reuse the identical file for both versions.
+
+ timeout 120s gst-launch-1.0 -q videotestsrc num-buffers=60 pattern=snow ! \
+ video/x-raw,format=I420,width=1920,height=1080,framerate=30/1 ! \
+ x264enc pass=quant quantizer=18 key-int-max=1 bframes=0 byte-stream=true
! \
+ video/x-h264,profile=high ! h264parse ! \
+ video/x-h264,stream-format=byte-stream,alignment=au ! filesink
location=input.h264
+ for D in avdec_h264 v4l2h264dec; do
+ timeout 120s gst-launch-1.0 -q filesrc location=input.h264 ! h264parse !
$D ! \
+ videoconvert ! video/x-raw,format=RGB,width=1920,height=1080 ! \
+ filesink location=$D.rgb && \
+ test "$(wc -c < "$D.rgb")" -eq 373248000 || exit 1
+ done
+ cmp avdec_h264.rgb v4l2h264dec.rgb
+
+ Confirm the loaded V4L2 plugin and bcm2835-codec device for each run.
+ Before (.8): OUTPUT sizeimage=1843200; both decoders reach
+ EOS/exit 0 with 60 frames, but cmp reports a difference (exit 1).
+ After: OUTPUT sizeimage=2073600; require EOS/exit 0, 60 frames and identical
+ RGB output (cmp exit 0).
+
[ Where problems could occur ]
Encoded-buffer sizes change for V4L2 encoders and decoder input. Requested
dimensions can yield smaller buffers than probed maxima; watch for buffer
allocation or codec failures, especially with poorly compressed streams.
[ Other Info ]
Upstream:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12491
1.28 backport: 49a5e5898da1b9922970e8e36ddebed3f621a8b6 (included in 1.28.8).
Debian has updated to 1.28.8, which includes this fix. Importing that
package into Tenacious, the new development release, will provide the fix
without an additional Ubuntu patch.
For other release:
Noble: 1.24.2-1ubuntu1.8 -> 1.24.2-1ubuntu1.9
Resolute: 1.28.2-2ubuntu0.4 -> 1.28.2-2ubuntu0.5
Stonking: 1.28.7-1build1 -> 1.28.7-1ubuntu0.1
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170768
Title:
[SRU] gst-plugins-good1.0: integer overflow in V4L2 buffer sizing
breaks 4K JPEG encoding
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gst-plugins-good1.0/+bug/2170768/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
