bugGNU Octave - Bugs: bug #54280, audiowrite crash for some long...

 
 

bug #54280: audiowrite crash for some long data for mono OGG

Submitter:  None
Submitted:  Tue 10 Jul 2018 12:20:58 PM UTC
   
 
Category:  Octave Function Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Fixed Assigned to:  None
Originator Name:  Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * 4.4.0
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 10 Jul 2018 08:50:46 PM UTC, comment #8: 

I shortened the URL and checked the patch in.  Marking as fixed and closing report.

Rik <rik5>
Group administrator
Tue 10 Jul 2018 05:53:21 PM UTC, comment #7: 

Looks good, works for me.

I would prefer the short URL https://bugs.debian.org/760898 in the comment, other than that nit, seems like a solid fix.

Mike Miller <mtmiller>
Group Member
Tue 10 Jul 2018 05:28:01 PM UTC, comment #6: 

Attached is a patch that reduces the chunk size in Octave from 2^21 to 2^20.  It allows the examples in this report to work.


(file #44537)

Rik <rik5>
Group administrator
Tue 10 Jul 2018 04:28:44 PM UTC, comment #5: 

updated libvorbis 1.3.6 has a some  ogg changes according to the change log, however still crashes when I used it.

Looking in octave audioread.cc, theres a FIXME:


// FIXME: there seems to be a bug writing ogg files in one shot
// that causes a segfault.  Breaking it up into a series of
// smaller chunks seems to avoid the problem and produce valid
// files.


So it sounds like its a known issue

John Donoghue <lostbard>
Group Member
Tue 10 Jul 2018 03:44:08 PM UTC, comment #4: 

I saw a comment that looks related here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760898



I'm also trying a update of libvorbis on my machine just to see if that fixes the issue.

John Donoghue <lostbard>
Group Member
Tue 10 Jul 2018 03:31:03 PM UTC, comment #3: 

Here is a relevant backtrace.  The segfault is in an external library.


octave:1> audiowrite ("1.ogg", rand(2100000,1), 8000)

Thread 4 "QThread" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffcd227700 (LWP 3575)]
0x00007fffd1617b3d in ?? () from /usr/lib/x86_64-linux-gnu/libvorbis.so.0
(gdb) bt
#0  0x00007fffd1617b3d in ?? () from /usr/lib/x86_64-linux-gnu/libvorbis.so.0
#1  0x00007fffd1618878 in vorbis_analysis_wrote () from /usr/lib/x86_64-linux-gnu/libvorbis.so.0
#2  0x00007fffd218ea89 in ?? () from /usr/lib/x86_64-linux-gnu/libsndfile.so.1
#3  0x00007fffd218ecf5 in ?? () from /usr/lib/x86_64-linux-gnu/libsndfile.so.1
#4  0x00007fffd2171f51 in sf_write_float () from /usr/lib/x86_64-linux-gnu/libsndfile.so.1
#5  0x00007fffc6bbb30d in Faudiowrite (args=...) at libinterp/dldfcn/audioread.cc:457


In the debugger, the only problematic value looks like chunk_size which seems to be the original 2100000 - 2850 header.

#5  0x00007fffc6bbb30d in Faudiowrite (args=...) at libinterp/dldfcn/audioread.cc:457
457           sf_count_t items_written = sf_write_float (file, data+offset, chunk_size);
(gdb) p chunk_size
$1 = 2097150
(gdb) p offset
$2 = 0

Looking at /usr/include/sndfile.h for the definition of sf_count_t, it is a 64-bit integer and is definitely large enough to handle this.


typedef int64_t        sf_count_t ;
#define SF_COUNT_MAX                0x7FFFFFFFFFFFFFFFLL


This sure looks like a problem with the actual libvorbis library or libsndfile library, i.e., an upstream bug.

Maybe use Google to see if someone has reported a bug against one of those libraries.  A definitive test would be to write a small C++ program to call libsndfile directly with this large value and see if that too crashes.

Rik <rik5>
Group administrator
Tue 10 Jul 2018 02:38:59 PM UTC, comment #2: 

Trying other formats other than ogg, it seems to be an .ogg only problem.

John Donoghue <lostbard>
Group Member
Tue 10 Jul 2018 02:32:02 PM UTC, comment #1: 

Does the same thing in windows in octave 4.4.0 and dev

John Donoghue <lostbard>
Group Member
Tue 10 Jul 2018 12:20:58 PM UTC, original submission:  

I accidentally found that when writing to a mono (1 channel) OGG file, if the data is long enough, then Octave will crash with signal 11 (Segfault).  For example,


octave:2>  audiowrite ("1.ogg", rand(2000000,2), 44100)
octave:3>  audiowrite ("1.ogg", rand(2000000,2), 8000)
octave:4>  audiowrite ("1.ogg", rand(2100000,2), 44100)
octave:5>  audiowrite ("1.ogg", rand(2100000,2), 8000)
octave:6>  audiowrite ("1.ogg", rand(2000000,1), 44100)
octave:7>  audiowrite ("1.ogg", rand(2000000,1), 8000)
octave:8>  audiowrite ("1.ogg", rand(2100000,1), 44100)
fatal: caught signal Segmentation fault -- stopping myself...
Segmentation fault

octave:1>  audiowrite ("1.ogg", rand(2100000,1), 8000)
fatal: caught signal Segmentation fault -- stopping myself...
Segmentation fault


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #44537:  audiowrite.cset added by rik5 (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mtmiller (Posted a comment)
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by lostbard (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-07-10 rik5 StatusPatch Submitted Fixed
        Open/ClosedOpen Closed
    2018-07-10 rik5 StatusConfirmed Patch Submitted
    2018-07-10 rik5 Attached File- Added audiowrite.cset, #44537
    2018-07-10 lostbard StatusNone Confirmed
        Operating SystemGNU/Linux Any

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code