[Bug 680558] rtpmparobustdepay: invalid memory access with mp3 rtsp stream

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=680558
  GStreamer | gst-plugins-good | 0.11.x

--- Comment #3 from Tim-Philipp Müller <t.i.m at zen.co.uk> 2012-08-03 13:04:36 UTC ---
I can still reproduce it unfortunately (in 1.0).

Simple rtspsrc ! fakesink works fine, but rtspsrc ! rtpmparobustdepay does not.

These valgrind warnings look promising imho:

tpm at zingle:~/gst/0.11/gst-plugins-base/tests/examples/playback$
G_SLICE=always-malloc valgrind
../../../../gstreamer/tools/.libs/lt-gst-launch-1.0 rtspsrc
location=rtsp://dl.lib.brown.edu:554/areserves/1093545294660883.mp3 !
rtpmparobustdepay ! fakesink
Setting pipeline to PLAYING ...
New clock: GstSystemClock
==19743== Thread 8:
==19743== Invalid write of size 1
==19743==    at 0x4C2A88A: memcpy (mc_replace_strmem.c:838)
==19743==    by 0xB0E33EC: gst_rtp_mpa_robust_depay_push_mp3_frames
(gstbytewriter.h:255)
==19743==    by 0xB0E4033: gst_rtp_mpa_robust_depay_process
(gstrtpmparobustdepay.c:636)
==19743==    by 0x8F60A36: gst_rtp_base_depayload_chain
(gstrtpbasedepayload.c:332)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0xDDE26BA: gst_rtp_pt_demux_chain (gstrtpptdemux.c:436)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0xDDDD801: gst_rtp_jitter_buffer_loop
(gstrtpjitterbuffer.c:1902)
==19743==    by 0x4EBD620: gst_task_func (gsttask.c:316)
==19743==    by 0x57E75F1: g_thread_pool_thread_proxy (gthreadpool.c:309)
==19743==  Address 0x7a23e8d is 3 bytes before a block of size 112 free'd
==19743==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==19743==    by 0xDDDDEE0: gst_rtp_jitter_buffer_loop
(gstrtpjitterbuffer.c:1780)
==19743==    by 0x4EBD620: gst_task_func (gsttask.c:316)
==19743==    by 0x57E75F1: g_thread_pool_thread_proxy (gthreadpool.c:309)
==19743==    by 0x57E6DF4: g_thread_proxy (gthread.c:801)
==19743==    by 0x5E83B4F: start_thread (pthread_create.c:304)
==19743== 
==19743== Invalid write of size 1
==19743==    at 0x4C2A88A: memcpy (mc_replace_strmem.c:838)
==19743==    by 0xB0E2B14: gst_rtp_mpa_robust_depay_push_mp3_frames
(gstbytewriter.h:255)
==19743==    by 0xB0E4033: gst_rtp_mpa_robust_depay_process
(gstrtpmparobustdepay.c:636)
==19743==    by 0x8F60A36: gst_rtp_base_depayload_chain
(gstrtpbasedepayload.c:332)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0xDDE26BA: gst_rtp_pt_demux_chain (gstrtpptdemux.c:436)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0xDDDD801: gst_rtp_jitter_buffer_loop
(gstrtpjitterbuffer.c:1902)
==19743==    by 0x4EBD620: gst_task_func (gsttask.c:316)
==19743==    by 0x57E75F1: g_thread_pool_thread_proxy (gthreadpool.c:309)
==19743==  Address 0x7a23f3f is 1 bytes before a block of size 428 alloc'd
==19743==    at 0x4C28BED: malloc (vg_replace_malloc.c:263)
==19743==    by 0x57C9DE0: g_malloc (gmem.c:159)
==19743==    by 0xD1B9DEA: gst_udpsrc_create (gstudpsrc.c:441)
==19743==    by 0x8D295B1: gst_base_src_get_range (gstbasesrc.c:2313)
==19743==    by 0x8D2ABA2: gst_base_src_loop (gstbasesrc.c:2558)
==19743==    by 0x4EBD620: gst_task_func (gsttask.c:316)
==19743==    by 0x57E75F1: g_thread_pool_thread_proxy (gthreadpool.c:309)
==19743==    by 0x57E6DF4: g_thread_proxy (gthread.c:801)
==19743==    by 0x5E83B4F: start_thread (pthread_create.c:304)
==19743== 
==19743== Invalid write of size 2
==19743==    at 0x4C2A846: memcpy (mc_replace_strmem.c:838)
==19743==    by 0xB0E33EC: gst_rtp_mpa_robust_depay_push_mp3_frames
(gstbytewriter.h:255)
==19743==    by 0xB0E4033: gst_rtp_mpa_robust_depay_process
(gstrtpmparobustdepay.c:636)
==19743==    by 0x8F60A36: gst_rtp_base_depayload_chain
(gstrtpbasedepayload.c:332)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0xDDE26BA: gst_rtp_pt_demux_chain (gstrtpptdemux.c:436)
==19743==    by 0x4E8F937: gst_pad_push_data (gstpad.c:3587)
==19743==    by 0xDDDD801: gst_rtp_jitter_buffer_loop
(gstrtpjitterbuffer.c:1902)
==19743==    by 0x4EBD620: gst_task_func (gsttask.c:316)
==19743==    by 0x57E75F1: g_thread_pool_thread_proxy (gthreadpool.c:309)
==19743==  Address 0x10a72d92 is not stack'd, malloc'd or (recently) free'd
==19743== 
--19743-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) -
exiting
--19743-- si_code=80;  Faulting address: 0x0;  sp: 0x407e9fdb0

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.