Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 891755 - net-im/telegram-desktop-4.4.1 crashes at startup (in media-video/ffmpeg's avcodec_receive_frame)
Summary: net-im/telegram-desktop-4.4.1 crashes at startup (in media-video/ffmpeg's avc...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Esteve Varela Colominas
URL:
Whiteboard:
Keywords: PullRequest
Depends on:
Blocks:
 
Reported: 2023-01-22 19:22 UTC by Erik
Modified: 2023-02-22 23:03 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge.info,7.64 KB, text/plain)
2023-01-22 19:33 UTC, Erik
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Erik 2023-01-22 19:22:35 UTC
$ valgrind telegram-desktop 
==677000== Memcheck, a memory error detector
==677000== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==677000== Using Valgrind-3.20.0 and LibVEX; rerun with -h for copyright info
==677000== Command: telegram-desktop
==677000== 
==677000== Syscall param ioctl(generic) points to uninitialised byte(s)
==677000==    at 0xA65F5DB: ioctl (in /usr/lib64/libc.so.6)
==677000==    by 0x1EE9B7E7: drmIoctl (in /usr/lib64/libdrm.so.2.4.0)
==677000==    by 0x1EE9E73B: drmCommandWriteRead (in /usr/lib64/libdrm.so.2.4.0)
==677000==    by 0x1EEB987D: nouveau_object_init (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x1EEBA6C2: nouveau_device_new (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x2609F1E6: nouveau_drm_screen_create (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577E3C5: pipe_nouveau_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x26014CA3: pipe_loader_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577FDEF: dri2_init_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x25787DC3: driCreateNewScreen2 (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x1EE2BB29: dri2CreateScreen (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1EE1D738: __glXInitialize (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==  Address 0x10f32382 is 2 bytes inside a block of size 72 alloc'd
==677000==    at 0x56BD7B4: malloc (vg_replace_malloc.c:393)
==677000==    by 0x1EEB97D3: nouveau_object_init (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x1EEBA6C2: nouveau_device_new (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x2609F1E6: nouveau_drm_screen_create (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577E3C5: pipe_nouveau_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x26014CA3: pipe_loader_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577FDEF: dri2_init_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x25787DC3: driCreateNewScreen2 (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x1EE2BB29: dri2CreateScreen (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1EE1D738: __glXInitialize (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1EE1A4E6: glXQueryExtensionsString (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1AEB1AFB: QXcbGlxWindow::createVisual() (in /usr/lib64/qt5/plugins/xcbglintegrations/libqxcb-glx-integration.so)
==677000== 
==677000== Syscall param ioctl(generic) points to uninitialised byte(s)
==677000==    at 0xA65F5DB: ioctl (in /usr/lib64/libc.so.6)
==677000==    by 0x1EE9B7E7: drmIoctl (in /usr/lib64/libdrm.so.2.4.0)
==677000==    by 0x1EE9E73B: drmCommandWriteRead (in /usr/lib64/libdrm.so.2.4.0)
==677000==    by 0x1EEB9A25: nouveau_object_mthd (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x1EEBA6E3: nouveau_device_new (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x2609F1E6: nouveau_drm_screen_create (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577E3C5: pipe_nouveau_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x26014CA3: pipe_loader_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577FDEF: dri2_init_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x25787DC3: driCreateNewScreen2 (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x1EE2BB29: dri2CreateScreen (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1EE1D738: __glXInitialize (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==  Address 0x12f46762 is 2 bytes inside a block of size 136 alloc'd
==677000==    at 0x56BD7B4: malloc (vg_replace_malloc.c:393)
==677000==    by 0x1EEB999A: nouveau_object_mthd (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x1EEBA6E3: nouveau_device_new (in /usr/lib64/libdrm_nouveau.so.2.0.0)
==677000==    by 0x2609F1E6: nouveau_drm_screen_create (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577E3C5: pipe_nouveau_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x26014CA3: pipe_loader_create_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x2577FDEF: dri2_init_screen (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x25787DC3: driCreateNewScreen2 (in /usr/lib64/dri/nouveau_dri.so)
==677000==    by 0x1EE2BB29: dri2CreateScreen (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1EE1D738: __glXInitialize (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1EE1A4E6: glXQueryExtensionsString (in /usr/lib64/libGLX_mesa.so.0.0.0)
==677000==    by 0x1AEB1AFB: QXcbGlxWindow::createVisual() (in /usr/lib64/qt5/plugins/xcbglintegrations/libqxcb-glx-integration.so)
==677000== 
QPainter::begin: Paint device returned engine == 0, type: 2
QWidget::render: Cannot render with an inactive painter
qt.svg: Error while inflating gzip file: SVG format check failed
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DF5E5: ???
==677000==    by 0x12CDC0A7: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x12CDC0A7: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x170EE467: ???
==677000== 
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x336A4217: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DF5E5: ???
==677000==    by 0x3397F597: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x3397F597: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56D758A: ???
==677000==    by 0x3397F597: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56D576A: ???
==677000==    by 0x3397F597: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56D9615: ???
==677000==    by 0x125CF417: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x33568FF7: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x3271D0C7: ???
==677000== 
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56D9615: ???
==677000==    by 0x34937657: ???
==677000== 
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
qt.svg: Error while inflating gzip file: SVG format check failed
==677000== Conditional jump or move depends on uninitialised value(s)
==677000==    at 0x56DC331: ???
==677000==    by 0x12B14597: ???
==677000== 
qt.svg: Error while inflating gzip file: SVG format check failed
==677000== Thread 30 MTP Download Ses:
==677000== Invalid read of size 16
==677000==    at 0x9DE59C5: qstricmp(char const*, char const*) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9B59B5A: QNetworkHeadersPrivate::parseAndSetHeader(QByteArray const&, QByteArray const&) (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9BBF3D9: QNetworkReplyHttpImplPrivate::replyDownloadMetaData(QList<QPair<QByteArray, QByteArray> > const&, int, QString const&, bool, QSharedPointer<char>, long long, long long, bool) (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9C64412: QNetworkReplyHttpImpl::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9F8E602: QObject::event(QEvent*) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x8F1A55D: QApplicationPrivate::notify_helper(QObject*, QEvent*) (in /usr/lib64/libQt5Widgets.so.5.15.8)
==677000==    by 0x9F641B7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9F66E8D: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9FB9A92: postEventSourceDispatch(_GSource*, int (*)(void*), void*) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x8C32D88: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.7400.4)
==677000==    by 0x8C32FF7: g_main_context_iterate.constprop.0 (in /usr/lib64/libglib-2.0.so.0.7400.4)
==677000==    by 0x8C3307B: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.7400.4)
==677000==  Address 0x1279ab88 is 24 bytes inside a block of size 35 alloc'd
==677000==    at 0x56BD7B4: malloc (vg_replace_malloc.c:393)
==677000==    by 0x9D9A1E1: QArrayData::allocate(unsigned long, unsigned long, unsigned long, QFlags<QArrayData::AllocationOption>) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9DE5F01: QByteArray::QByteArray(char const*, int) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9DE88AB: QByteArray::mid(int, int) const (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9BAF71D: QHttpNetworkReplyPrivate::parseHeader(QByteArray const&) (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9BAFC58: QHttpNetworkReplyPrivate::readHeader(QAbstractSocket*) (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9BB3103: QHttpProtocolHandler::_q_receiveReply() (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9F998AC: void doActivate<false>(QObject*, int, void**) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000==    by 0x9BFF493: non-virtual thunk to QAbstractSocketPrivate::readNotification() (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x9C0D970: QReadNotifier::event(QEvent*) (in /usr/lib64/libQt5Network.so.5.15.8)
==677000==    by 0x8F1A55D: QApplicationPrivate::notify_helper(QObject*, QEvent*) (in /usr/lib64/libQt5Widgets.so.5.15.8)
==677000==    by 0x9F641B7: QCoreApplication::notifyInternal2(QObject*, QEvent*) (in /usr/lib64/libQt5Core.so.5.15.8)
==677000== 
==677000== Thread 19:
==677000== Invalid read of size 8
==677000==    at 0x6C30A3E: avcodec_receive_frame (in /usr/lib64/libavcodec.so.58.134.100)
==677000==    by 0x108941F: FFmpeg::FrameGenerator::Impl::readNextFrame() (in /usr/bin/telegram-desktop)
==677000==    by 0x1089A17: FFmpeg::FrameGenerator::Impl::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==677000==    by 0x1089A8C: FFmpeg::FrameGenerator::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==677000==    by 0x2D5510C: crl::details::on_queue_invoke<crl::details::EmptyWrapper, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}, void>(void*, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}&&)::{lambda(void*)#1}::_FUN(void*) (in /usr/bin/telegram-desktop)
==677000==    by 0x82B3865: _dispatch_worker_thread (in /usr/lib64/libdispatch.so)
==677000==    by 0xA5EB673: start_thread (in /usr/lib64/libc.so.6)
==677000==    by 0xA66A33F: clone (in /usr/lib64/libc.so.6)
==677000==  Address 0x28 is not stack'd, malloc'd or (recently) free'd
==677000== 
==677000== 
==677000== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==677000==  Access not within mapped region at address 0x28
==677000==    at 0x6C30A3E: avcodec_receive_frame (in /usr/lib64/libavcodec.so.58.134.100)
==677000==    by 0x108941F: FFmpeg::FrameGenerator::Impl::readNextFrame() (in /usr/bin/telegram-desktop)
==677000==    by 0x1089A17: FFmpeg::FrameGenerator::Impl::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==677000==    by 0x1089A8C: FFmpeg::FrameGenerator::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==677000==    by 0x2D5510C: crl::details::on_queue_invoke<crl::details::EmptyWrapper, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}, void>(void*, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}&&)::{lambda(void*)#1}::_FUN(void*) (in /usr/bin/telegram-desktop)
==677000==    by 0x82B3865: _dispatch_worker_thread (in /usr/lib64/libdispatch.so)
==677000==    by 0xA5EB673: start_thread (in /usr/lib64/libc.so.6)
==677000==    by 0xA66A33F: clone (in /usr/lib64/libc.so.6)
==677000==  If you believe this happened as a result of a stack
==677000==  overflow in your program's main thread (unlikely but
==677000==  possible), you can try to increase the size of the
==677000==  main thread stack using the --main-stacksize= flag.
==677000==  The main thread stack size used in this run was 8388608.
==677000== 
==677000== HEAP SUMMARY:
==677000==     in use at exit: 179,194,410 bytes in 634,304 blocks
==677000==   total heap usage: 1,369,920 allocs, 735,616 frees, 649,270,046 bytes allocated
==677000== 
==677000== LEAK SUMMARY:
==677000==    definitely lost: 18,656 bytes in 187 blocks
==677000==    indirectly lost: 29,418 bytes in 1,068 blocks
==677000==      possibly lost: 152,906 bytes in 2,190 blocks
==677000==    still reachable: 178,966,678 bytes in 630,552 blocks
==677000==                       of which reachable via heuristic:
==677000==                         newarray           : 1,464 bytes in 3 blocks
==677000==                         multipleinheritance: 103,664 bytes in 110 blocks
==677000==         suppressed: 32 bytes in 1 blocks
==677000== Rerun with --leak-check=full to see details of leaked memory
==677000== 
==677000== Use --track-origins=yes to see where uninitialised values come from
==677000== For lists of detected and suppressed errors, rerun with: -s
==677000== ERROR SUMMARY: 22 errors from 17 contexts (suppressed: 0 from 0)
Segmenteringsfel (minnesutskrift skapad)

Reproducible: Always
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-01-22 19:27:33 UTC
Please include emerge --info too.
Comment 2 Erik 2023-01-22 19:33:48 UTC
Created attachment 849047 [details]
emerge --info

Since it crashed in /usr/lib64/libavcodec.so.58.134.100, I will try to upgrade ffmpeg to 5.1.2-r1.
Comment 3 Erik 2023-01-23 11:01:23 UTC
After upgrading ffmpeg to 5.1.2-r1, telegram-desktop did not crash at startup and has not crashed yet.
Comment 4 Erik 2023-01-23 11:25:40 UTC
Unfortunately it crashed again:
==880112== Thread 11:
==880112== Invalid read of size 8
==880112==    at 0x6C30A3E: avcodec_receive_frame (in /usr/lib64/libavcodec.so.58.134.100)
==880112==    by 0x108941F: FFmpeg::FrameGenerator::Impl::readNextFrame() (in /usr/bin/telegram-desktop)
==880112==    by 0x1089A17: FFmpeg::FrameGenerator::Impl::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==880112==    by 0x1089A8C: FFmpeg::FrameGenerator::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==880112==    by 0x2D5510C: crl::details::on_queue_invoke<crl::details::EmptyWrapper, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}, void>(void*, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}&&)::{lambda(void*)#1}::_FUN(void*) (in /usr/bin/telegram-desktop)
==880112==    by 0x82B3865: _dispatch_worker_thread (in /usr/lib64/libdispatch.so)
==880112==    by 0xA5EB673: start_thread (in /usr/lib64/libc.so.6)
==880112==    by 0xA66A33F: clone (in /usr/lib64/libc.so.6)
==880112==  Address 0x28 is not stack'd, malloc'd or (recently) free'd

It seems to happen when playing some videos. I will see if I can turn off auto-playing of videos when scrolling a channel so that I can scroll to such a video and save it without a crash.
Comment 5 Erik 2023-01-23 11:38:07 UTC
After turning off all auto-play, it still crashes when scrolling to such a video, so I can not save it to test it outside telegram-desktop. It seems like it crashes when trying to get a still image from the video to show instead of the playing video. I will probably try emerging telegram-desktop with qt6.
Comment 6 Joe Kappus 2023-01-24 02:29:13 UTC
I build ffmpeg-4.4.3 with clang-15.0.7, but telegram-desktop currently with gcc-12.2.1 and I'm not seeing this crash on intel iris system (wayland on qt5). 

It looks closely related to nouveau. Can you disable vaapi/vdpau stuff if its being used and see if you hit crash?
Comment 7 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-01-24 03:07:15 UTC
(In reply to Joe Kappus from comment #6)
> I build ffmpeg-4.4.3 with clang-15.0.7, but telegram-desktop currently with
> gcc-12.2.1 and I'm not seeing this crash on intel iris system (wayland on
> qt5). 
> 
> It looks closely related to nouveau. Can you disable vaapi/vdpau stuff if
> its being used and see if you hit crash?

The crashing thread is dying in avcodec_receive_frame.
Comment 8 Egor 2023-01-28 20:32:36 UTC
Most likely I am hitting the same issue on my system with AMD Rembrandt GPU. Though crash happens when I enter specific chants. In the dmesg I see following related messages:
[69129.017699] telegram-deskto[2971]: segfault at 28 ip 00007f2b9a7eb9fb sp 00007f2b6bb7cb90 error 4 in libavcodec.so.58.134.100[7f2b9a667000+798000] likely on CPU 14 (core 7, socket 0)
Comment 9 Erik 2023-01-30 09:14:23 UTC
It still happens with the newest ffmpeg (5.1.2-r1):
==1995037== Thread 17:
==1995037== Invalid read of size 8
==1995037==    at 0x6C32260: avcodec_receive_frame (in /usr/lib64/libavcodec.so.59.37.100)
==1995037==    by 0x10899CF: FFmpeg::FrameGenerator::Impl::readNextFrame() (in /usr/bin/telegram-desktop)
==1995037==    by 0x1089FC7: FFmpeg::FrameGenerator::Impl::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==1995037==    by 0x108A03C: FFmpeg::FrameGenerator::renderNext(QImage, QSize, Qt::AspectRatioMode) (in /usr/bin/telegram-desktop)
==1995037==    by 0x2D5454C: crl::details::on_queue_invoke<crl::details::EmptyWrapper, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}, void>(void*, void (*)(void*, void (*)(void*), void*), Ui::CustomEmoji::Renderer::Renderer(Ui::CustomEmoji::RendererDescriptor&&)::{lambda()#1}&&)::{lambda(void*)#1}::_FUN(void*) (in /usr/bin/telegram-desktop)
==1995037==    by 0x81E9865: _dispatch_worker_thread (in /usr/lib64/libdispatch.so)
==1995037==    by 0xA521673: start_thread (in /usr/lib64/libc.so.6)
==1995037==    by 0xA5A033F: clone (in /usr/lib64/libc.so.6)
==1995037==  Address 0x28 is not stack'd, malloc'd or (recently) free'd

Some videos trigger this. Scrolling a channel will cause a crash when such a video is encountered. Just entering a channel will cause a crash if the channel was previously scrolled to such a video. Just starting telegram-desktop will cause a crash if telegram-desktop wants to show a channel that is scrolled to such a video when telegram-desktop starts.
Comment 10 Esteve Varela Colominas 2023-02-16 15:16:32 UTC
Sorry for the late reply, but this is probably related to: https://bugs.gentoo.org/888637

Will be requiring this USE flag with the next bump, and close this issue along with it. Feel free to re-open if this is still a problem. And as always, thanks for reporting the bug.
Comment 11 Erik 2023-02-22 01:46:04 UTC

*** This bug has been marked as a duplicate of bug 888637 ***
Comment 12 Larry the Git Cow gentoo-dev 2023-02-22 23:03:47 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=19bd77e8f59cc673936cbf52bd1eb749ddc1269f

commit 19bd77e8f59cc673936cbf52bd1eb749ddc1269f
Author:     Esteve Varela Colominas <esteve.varela@gmail.com>
AuthorDate: 2023-02-16 15:42:57 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2023-02-22 22:57:00 +0000

    net-im/telegram-desktop: Bump to 4.6.3
    
    Closes: https://bugs.gentoo.org/888637
    Closes: https://bugs.gentoo.org/891755
    Thanks-to: xiaoming <xiangluoming2015@outlook.com>
    Thanks-to: Alexander Turenko <totktonada.ru@gmail.com>
    Thanks-to: Erik <esigra@gmail.com>
    Thanks-to: Egor <egorr.berd@gmail.com>
    Signed-off-by: Esteve Varela Colominas <esteve.varela@gmail.com>
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 net-im/telegram-desktop/Manifest                   |   1 +
 net-im/telegram-desktop/metadata.xml               |   4 +-
 .../telegram-desktop/telegram-desktop-4.6.3.ebuild | 206 +++++++++++++++++++++
 3 files changed, 209 insertions(+), 2 deletions(-)