[gstreamer-bugs] [Bug 327350] New: crash (double free) on mpg playback

[GStreamer (bugzilla.gnome.org)]

Do not reply to this via email (we are currently unable to handle email
responses and they get discarded).  You can add comments to this bug at
http://bugzilla.gnome.org/show_bug.cgi?id=327350
 GStreamer | gst-plugins-ugly | Ver: 0.10.2

           Summary: crash (double free) on mpg playback
           Product: GStreamer
           Version: 0.10.2
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-ugly
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: martin.pitt at canonical.com
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: Unspecified
   GNOME milestone: Unspecified


Hi!

When trying to play an mpg video, gstreamer crashes with a double free memory
corruption. A reasonably small (4MB) test file is at
http://people.ubuntu.com/~pitti/shots/test.mpg (in case it doesn't happen with
any mpg file).

$ totem test.mpg

(totem:22843): Gtk-CRITICAL **: gtk_accel_label_set_accel_closure: assertion
`gtk_accel_group_from_accel_closure (accel_closure) != NULL' failed

(totem:22843): Gtk-CRITICAL **: gtk_accel_label_set_accel_closure: assertion
`gtk_accel_group_from_accel_closure (accel_closure) != NULL' failed

(totem:22843): GdkPixbuf-CRITICAL **: gdk_pixbuf_new_from_data: assertion
`width > 0' failed

(totem:22843): GdkPixbuf-CRITICAL **: gdk_pixbuf_scale: assertion `src != NULL'
failed

(totem:22843): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT
(object)' failed

(totem:22843): GdkPixbuf-CRITICAL **: gdk_pixbuf_new_from_data: assertion
`width > 0' failed

(totem:22843): GdkPixbuf-CRITICAL **: gdk_pixbuf_scale: assertion `src != NULL'
failed

(totem:22843): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT
(object)' failed
*** glibc detected *** free(): invalid next size (normal): 0x106d9b10 ***


I extracted a stack trace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 852767984 (LWP 22451)]
0x0e47d7a4 in _int_free () from /lib/libc.so.6
(gdb) bt
#0  0x0e47d7a4 in _int_free () from /lib/libc.so.6
#1  0x0e55b5fc in ?? () from /lib/libc.so.6
#2  0x0e5a705c in IA__g_free (mem=0xe55c2b0) at gmem.c:172
#3  0x0f93f0b0 in gst_buffer_finalize (buffer=Cannot access memory at address
0x8
) at gstbuffer.c:181
#4  0x0f966a50 in gst_mini_object_free (mini_object=0x104fa9b8) at
gstminiobject.c:264
#5  0x0f966c28 in gst_mini_object_unref (mini_object=0x104fa9b8) at
gstminiobject.c:297
#6  0x0f93f838 in gst_subbuffer_finalize (buffer=0x104a3400) at gstbuffer.c:401
#7  0x0f966a50 in gst_mini_object_free (mini_object=0x104a3400) at
gstminiobject.c:264
#8  0x0f966c28 in gst_mini_object_unref (mini_object=0x104a3400) at
gstminiobject.c:297
#9  0x0ce22558 in gst_mpeg2dec_get_type () from
/usr/lib/gstreamer-0.10/libgstmpeg2dec.so
#10 0x0f973740 in gst_pad_chain (pad=0x1040b308, buffer=0x104a3400) at
gstpad.c:3155
#11 0x0f973f9c in gst_pad_push (pad=0x1040b248, buffer=0x104a3400) at
gstpad.c:3254
#12 0x0e1167e0 in gst_queue_loop (pad=0x1040b248) at gstqueue.c:808
#13 0x0f9903f8 in gst_task_func (task=0x1040c060, tclass=0x103ed798) at
gsttask.c:186
#14 0x0e5c5e7c in g_thread_pool_thread_proxy (data=<value optimized out>) at
gthreadpool.c:172
#15 0x0e5c2dd0 in g_thread_create_proxy (data=<value optimized out>) at
gthread.c:582
#16 0x0e6c9a30 in start_thread () from /lib/libpthread.so.0
#17 0x0e4e1024 in clone () from /lib/libc.so.6
Previous frame inner to this frame (corrupt stack?)

This happens on powerpc, but not on amd64 (but I guess that's just a
coincidence).

Please tell me if you need any further information.

Thanks!


-- 
Configure bugmail: http://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.