[gstreamer-bugs] [Bug 427082] New: totem crashes when trying to play an .AIF

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=427082

  GStreamer | gst-ffmpeg | Ver: 0.10.2
           Summary: totem crashes when trying to play an .AIF
           Product: GStreamer
           Version: 0.10.2
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: critical
          Priority: Normal
         Component: gst-ffmpeg
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: seb128 at debian.org
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: 2.17/2.18
   GNOME milestone: Unspecified


The bug has been opened on https://bugs.launchpad.net/bugs/103443

"Binary package hint: totem

I tried loading the attached .AIF file (from Dinosaur Comics) and totem crashes
with a floating point exception.
...
http://librarian.launchpad.net/7175227/cheers_cover.aif
Cover of Cheers from Dinosaur Comics

The cover of Cheers from Dinosaur Comics. Run with totem and crashes will
ensue!"

Debug backtrace for the crash:


411         res = av_get_packet(&s->pb, pkt, (MAX_SIZE /
st->codec->block_align) * st->codec->block_align);
(gdb) thread apply all bt full

Thread 7 (Thread -1292457072 (LWP 1340)):
#0  0xb182083b in aiff_read_packet (s=0x880c680, pkt=0x880d590) at aiff.c:411
        st = <value optimized out>
        res = <value optimized out>
#1  0xb17e8b79 in av_read_packet (s=0x880c680, pkt=0x880d590) at utils.c:549
No locals.
#2  0xb17ed80f in av_read_frame_internal (s=0x880c680, pkt=0xb2f6a04c) at
utils.c:805
        st = <value optimized out>
        len = <value optimized out>
        ret = -1315387039
        i = <value optimized out>
#3  0xb17ee312 in av_find_stream_info (ic=0x880c680) at utils.c:1824
        i = 0
        count = 0
        ret = 138140492
        read_size = 0
        st = (AVStream *) 0x880d620
        pkt1 = {pts = 140737488355328, dts = -5551073053431037952, data =
0x8804650 "FORM", size = 0, stream_index = 0, 
  flags = 3952, duration = -72515584, destruct = 0, priv = 0x880c680, pos =
-5655579307071332200}
        ppktl = (AVPacketList **) 0x880d564
        last_dts = {-9223372036854775808 <repeats 20 times>}
        duration_sum = {9223372036854775807 <repeats 20 times>}
        duration_count = {0 <repeats 20 times>}
#4  0xb17e43fd in gst_ffmpegdemux_loop (pad=0x8543f10) at gstffmpegdemux.c:1000
        demux = (GstFFMpegDemux *) 0x87f8000
        ret = <value optimized out>
        res = <value optimized out>
        pkt = {pts = 4294967296, dts = -5247600353741897727, data = 0x53c
<Address 0x53c out of bounds>, 
  size = -1220565952, stream_index = -1292459272, flags = -1222098208, duration
= -1220560900, destruct = 0x858c078, 
  priv = 0xb2f6a2f8, pos = 579065770227531777}
        srcpad = <value optimized out>
        stream = <value optimized out>
        avstream = <value optimized out>
        outbuf = <value optimized out>
        timestamp = <value optimized out>
        duration = <value optimized out>
        __PRETTY_FUNCTION__ = "gst_ffmpegdemux_loop"
#5  0xb74b0d56 in gst_task_func (task=0x83c4d40, tclass=0x815bc20) at
gsttask.c:192
        t = -1219818293
        lock = (GStaticRecMutex *) 0x858c058
        tself = (GThread *) 0x80c0ed0
        __PRETTY_FUNCTION__ = "gst_task_func"
#6  0xb72854d8 in g_thread_pool_thread_proxy (data=0x815bcb0) at
gthreadpool.c:265
        task = (gpointer) 0x83c4d40
        pool = (GRealThreadPool *) 0x815bcb0
---Type <return> to continue, or q <return> to quit---
#7  0xb7283b7f in g_thread_create_proxy (data=0x80c0ed0) at gthread.c:591
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#8  0xb73f831b in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#9  0xb71bb57e in clone () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
...


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=427082.