[gstreamer-bugs] [Bug 581279] New: MP3 file causes crash in Banshee/Rhythmbox is GStreamer library

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=581279

  GStreamer | gstreamer (core) | Ver: 0.10.22
           Summary: MP3 file causes crash in Banshee/Rhythmbox is GStreamer
                    library
           Product: GStreamer
           Version: 0.10.22
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gstreamer (core)
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: bugzilla at bennee.com
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: 2.23/2.24
   GNOME milestone: Unspecified


Whenever I try and access this file in Banshee or Rhythmbox I get a crash with
the following backtrace:

(gdb) info frame
Stack level 2, frame at 0x424d8040:
 rip = 0x2aaab5990934 in gst_structure_set_field (gststructure.c:622); saved
rip 0x2aaab59918d1
 called by frame at 0x424d8100, caller of frame at 0x424d8020
 source language c.
 Arglist at 0x424d8020, args: structure=<value optimized out>, field=0x424d80a0
 Locals at 0x424d8020, Previous frame's sp is 0x424d8040
 Saved registers:
  rbx at 0x424d8028, rbp at 0x424d8030, rip at 0x424d8038
(gdb) l
617       guint i;
618
619       for (i = 0; i < structure->fields->len; i++) {
620         f = GST_STRUCTURE_FIELD (structure, i);
621
622         if (f->name == field->name) {
623           g_value_unset (&f->value);
624           memcpy (f, field, sizeof (GstStructureField));
625           return;
626         }
(gdb) p structure
$1 = <value optimized out>
(gdb) p f
$2 = (GstStructureField *) 0x1
(gdb) p i
$3 = 70127120
(gdb) bt
#0  0x00002aaaaedf33b4 in g_type_value_table_peek () from
/usr/lib/libgobject-2.0.so.0
#1  0x00002aaaaedfc1f5 in g_value_unset () from /usr/lib/libgobject-2.0.so.0
#2  0x00002aaab5990934 in gst_structure_set_field (structure=<value optimized
out>, field=0x424d80a0) at gststructure.c:622
#3  0x00002aaab59918d1 in gst_structure_id_set_valist (structure=0x58e8300,
fieldname=<value optimized out>, varargs=0x424d8100) at gststructure.c:602
#4  0x00002aaab5991a3d in gst_structure_id_set (structure=0x42e0e10, field=2)
at gststructure.c:560
#5  0x00002aaab598c60c in gst_query_set_duration (query=<value optimized out>,
format=GST_FORMAT_BYTES, duration=4392960) at gstquery.c:508
#6  0x00002aaab52e78f5 in gst_base_src_default_query (src=0x58640a0,
query=0x58e7f60) at gstbasesrc.c:787
#7  0x00002aaab52e4f4e in gst_base_src_query (pad=0x3d785c0, query=0x58e7f60)
at gstbasesrc.c:926
#8  0x00002aaab596ee81 in gst_proxy_pad_do_query (pad=<value optimized out>,
query=0x58e7f60) at gstghostpad.c:154
#9  0x00002aaabb60eb24 in gst_type_find_handle_src_query (pad=<value optimized
out>, query=0x58e7f60) at gsttypefindelement.c:353
#10 0x00002aaab6764492 in ?? () from /usr/lib/libgsttag-0.10.so.0
#11 0x00002aaab599ed48 in gst_pad_query_duration (pad=0x44b2450,
format=0x424d83f4, duration=0x424d8458) at gstutils.c:2724
#12 0x00002aaab599ee47 in gst_pad_query_peer_duration (pad=<value optimized
out>, format=0x424d83f4, duration=0x424d8458) at gstutils.c:2759
#13 0x00002aaab945fd80 in ?? () from
/usr/lib64/gstreamer-0.10/libgstmpegaudioparse.so
#14 0x00002aaab945ff8a in ?? () from
/usr/lib64/gstreamer-0.10/libgstmpegaudioparse.so
#15 0x00002aaab9460248 in ?? () from
/usr/lib64/gstreamer-0.10/libgstmpegaudioparse.so
#16 0x00002aaab945ff9f in ?? () from
/usr/lib64/gstreamer-0.10/libgstmpegaudioparse.so
#17 0x00002aaab9460248 in ?? () from
/usr/lib64/gstreamer-0.10/libgstmpegaudioparse.so
#18 0x00002aaab945ff9f in ?? () from
/usr/lib64/gstreamer-0.10/libgstmpegaudioparse.so

The back trace continues in libgstmpegaudioparse for ever so I suspect
the library has gone into a loop of death while parsing.

Are there any command lines I can run to test the tag parser on this
file and perhaps supply more useful debug output?


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=581279.