bugGnash - The GNU Flash player - Bugs: bug #24459, Segfault from GST with -r2

 
 

bug #24459: Segfault from GST with -r2

Submitted by:  Sandro Santilli <strk>
Submitted on:  Mon 06 Oct 2008 07:53:47 AM UTC  
 
Category: sound-gstSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 06 Oct 2008 08:28:45 AM UTC, comment #5:

Fixed as of revision 9928

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Oct 2008 08:23:40 AM UTC, comment #4:

gst_init isn't called at time of gst_caps_new_simple...

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Oct 2008 08:07:05 AM UTC, comment #3:

Tested again w/out jemalloc: same problem (just so nobody else has to deal with dubts about it :)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Oct 2008 07:56:55 AM UTC, comment #2:

==29520== Invalid read of size 4
==29520== at 0x4C339C4: g_value_register_transform_func (in /usr/lib/libgobje
ct-2.0.so.0.1600.5)
==29520== by 0x47478B9: gst_caps_get_type (in /usr/lib/libgstreamer-0.10.so.0
.16.0)
==29520== by 0x47490B9: gst_caps_new_empty (in /usr/lib/libgstreamer-0.10.so.
0.16.0)
==29520== by 0x4749CCB: gst_caps_new_simple (in /usr/lib/libgstreamer-0.10.so
.0.16.0)
==29520== by 0x40C6915: gnash::media::AudioDecoderGst::AudioDecoderGst(gnash:
:media::SoundInfo&) (AudioDecoderGst.cpp:40)
==29520== by 0x40DAAA8: gnash::media::SDL_sound_handler::play_sound(int, int,
int, long, std::vector<gnash::media::sound_handler::sound_envelope, std::allocator<gnash::media::sound_handler::sound_envelope> > const*) (sound_handler_sdl.cpp:302)
==29520== by 0x4240FF9: gnash::SWF::StreamSoundBlockTag::execute(gnash::sprite_instance*, gnash::DisplayList&) const (StreamSoundBlockTag.cpp:42)
==29520== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==29520==
==29520== Process terminating with default action of signal 11 (SIGSEGV)
==29520== Access not within mapped region at address 0x0

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Oct 2008 07:55:11 AM UTC, comment #1:

(gdb) bt
#0 0xb73ab9c4 in g_value_register_transform_func ()
from /usr/lib/libgobject-2.0.so.0
#1 0xb78298ba in gst_caps_get_type () from /usr/lib/libgstreamer-0.10.so.0
#2 0xb782b0ba in gst_caps_new_empty () from /usr/lib/libgstreamer-0.10.so.0
#3 0xb782bccc in gst_caps_new_simple () from /usr/lib/libgstreamer-0.10.so.0
#4 0xb7f00916 in AudioDecoderGst (this=0x9419a00, info=@0x9469ec0)
at /usr/src/gnash/gnash-head/libmedia/gst/AudioDecoderGst.cpp:40
#5 0xb7f14aa9 in gnash::media::SDL_sound_handler::play_sound (this=0x9421240,
sound_handle=0, loop_count=0, offset=0, start_position=0, envelopes=0x0)
at /usr/src/gnash/gnash-head/libmedia/ffmpeg/sound_handler_sdl.cpp:302
#6 0xb7a87ffa in gnash::SWF::StreamSoundBlockTag::execute (this=0x94e9790,
m=0x946f840)
at /usr/src/gnash/gnash-head/libcore/swf/StreamSoundBlockTag.cpp:42
#7 0xb7a56f63 in gnash::sprite_instance::execute_frame_tags (this=0x946f840,
frame=122, dlist=@0x946f934, typeflags=Variable "typeflags" is not available.
)
at /usr/src/gnash/gnash-head/libcore/sprite_instance.cpp:3288

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 06 Oct 2008 07:53:47 AM UTC, original submission:

libai-layer2-20-sound.swf
md5: c0f53d2a7412573c79f648ae00e4bf21
attached in a message on gnash-dev by Richard Tseng
on Sat, 3 May 2008 19:48:33

$ gtk-gnash -r2 libai-layer2-20-sound.swf
(process:29446): GLib-GObject-CRITICAL **: /tmp/buildd/glib2.0-2.16.5/gobject/gtype.c:2248: initialization assertion failed, use IA__g_type_init() prior to this function
Segmentation fault

You need to wait a few seconds for that to happen.
Does NOT happen with ffmpeg backend.

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 06 Oct 2008 08:28:45 AM UTCstrkStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Mon 06 Oct 2008 08:23:40 AM UTCstrkAssigned tobjacques=>strk
    Mon 06 Oct 2008 08:23:39 AM UTCstrkStatusNone=>In Progress

    Back to the top


    Powered by Savane 3.1-cleanup1