Skip to content

ffmpeg sigbus top crash android ref base inc strong void const #9

Open
rlavarec-gpsw wants to merge 1 commit intogopro-7.1-patchedfrom
rlavarec/MAGMA-6468-FFmpeg-SIGBUS-top-crash-android-RefBase-incStrong-void-const-
Open

ffmpeg sigbus top crash android ref base inc strong void const #9
rlavarec-gpsw wants to merge 1 commit intogopro-7.1-patchedfrom
rlavarec/MAGMA-6468-FFmpeg-SIGBUS-top-crash-android-RefBase-incStrong-void-const-

Conversation

@rlavarec-gpsw
Copy link
Copy Markdown
Collaborator

@rlavarec-gpsw rlavarec-gpsw commented Apr 17, 2026

Root Cause

The crash occurs when MediaCodec.configure() receives a Java Surface object whose native peer has been released (Surface.release() or SurfaceTexture.release() was called). The Java object is still a valid JNI reference, but its internal mNativeObject field is 0/NULL. When the Android framework calls getSurface() -> RefBase::incStrong() on this null native pointer, it crashes with a null dereference in the atomic operation.
The call path: control_thread -> op_start -> init_mediacodec -> avcodec_open2 -> FFmpeg mediacodec init -> MediaCodec.configure(format, surface, null, flags) -> CRASH.
Fixes Applied (defense in depth, 3 layers)

1. mediacodec_surface.c:30: Added is_surface_valid() helper that calls Surface.isValid() via JNI, and integrated it into ff_mediacodec_surface_ref(). When the Surface is invalid, it returns NULL instead of creating a reference to a dead surface. This causes s->surface to be NULL in the decoder, preventing the crash.
2. mediacodec_wrapper.c: Added Surface.isValid() checks in both:

mediacodec_jni_configure() -> before calling MediaCodec.configure() via JNI (the exact crash path from the stack trace)
mediacodec_ndk_configure() -> before calling ANativeWindow_fromSurface() (which would also crash with the same issue)
Both return AVERROR_EXTERNAL if the Surface is invalid, which is handled gracefully by the callers (configure failure -> decoder fallback or retry).
@rlavarec-gpsw rlavarec-gpsw changed the base branch from master to rlavarec/gopro-7.1-patched April 17, 2026 14:31
@rlavarec-gpsw rlavarec-gpsw changed the base branch from rlavarec/gopro-7.1-patched to gopro-7.1-patched April 17, 2026 14:32
@rlavarec-gpsw
Copy link
Copy Markdown
Collaborator Author

@rlavarec-gpsw rlavarec-gpsw deleted the rlavarec/MAGMA-6468-FFmpeg-SIGBUS-top-crash-android-RefBase-incStrong-void-const- branch April 17, 2026 14:48
@rlavarec-gpsw rlavarec-gpsw restored the rlavarec/MAGMA-6468-FFmpeg-SIGBUS-top-crash-android-RefBase-incStrong-void-const- branch April 17, 2026 14:48
@rlavarec-gpsw rlavarec-gpsw reopened this Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants