[gstreamer-bugs] [Bug 148061] New: - qtdemux crash

[bugzilla-daemon at bugzilla.gnome.org]

http://bugzilla.gnome.org/show_bug.cgi?id=148061
GStreamer | gst-plugins | Ver: HEAD CVS

           Summary: qtdemux crash
           Product: GStreamer
           Version: HEAD CVS
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: critical
          Priority: Normal
         Component: gst-plugins
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: teuf at users.sourceforge.net
         QAContact: gstreamer-bugs at lists.sourceforge.net


I've got a .mov file (its size is 1 MB, I can attach it if needed) which
triggers a crash in qtdemux with this backtrace: 

#0  qtdemux_audio_caps (qtdemux=0x817c588, fourcc=843924561, data=0x0, len=0)
    at qtdemux.c:2531
#1  0x406b26d6 in qtdemux_parse_trak (qtdemux=0x817c588, trak=0x817e774)
    at qtdemux.c:1967
#2  0x406b225c in qtdemux_parse_tree (qtdemux=0x817c588) at qtdemux.c:1807
#3  0x406adbcd in gst_qtdemux_loop_header (element=0x817c588) at qtdemux.c:624
#4  0x406c75b6 in loop_group_schedule_function (argc=0, argv=0x817d598)
    at gstoptimalscheduler.c:1340
#5  0x406c6e8f in schedule_group (group=0x817d598)
    at gstoptimalscheduler.c:1166
#6  0x406c70de in gst_opt_scheduler_schedule_run_queue (osched=0x8059200)
    at gstoptimalscheduler.c:1213
#7  0x406c723a in schedule_chain (chain=0x817d578)
    at gstoptimalscheduler.c:1266
#8  0x406cb02f in gst_opt_scheduler_iterate (sched=0x8059200)
    at gstoptimalscheduler.c:2598
#9  0x400641b9 in gst_scheduler_iterate (sched=0x8059200) at gstscheduler.c:705
#10 0x40033c78 in gst_bin_iterate_func (bin=0x817ca78) at gstbin.c:1197
#11 0x4007b999 in gst_marshal_BOOLEAN__VOID (closure=0x8059120,
    return_value=0xbffff170, n_param_values=1, param_values=0x0,
    invocation_hint=0xbffff198, marshal_data=0x40033bf0) at gstmarshal.c:472
#12 0x4027d6c7 in g_type_class_meta_marshal (closure=0x8059120,
    return_value=0x0, n_param_values=0, param_values=0xbffff2a0,
    invocation_hint=0x0, marshal_data=0x0) at gclosure.c:514
#13 0x4027d330 in g_closure_invoke (closure=0x8059120, return_value=0x0,
    n_param_values=0, param_values=0x0, invocation_hint=0x0) at gclosure.c:437
#14 0x40290d65 in signal_emit_unlocked_R (node=0x8059158, detail=0,
    instance=0x817ca78, emission_return=0xbffff240,
    instance_and_params=0xbffff2a0) at gsignal.c:2473
#15 0x402900ce in g_signal_emit_valist (instance=0x817ca78, signal_id=0,
    detail=0, var_args=0xbffff42c "Hôÿ¿Þ\004") at gsignal.c:2204
#16 0x402905f4 in g_signal_emit (instance=0x0, signal_id=0, detail=0)
    at gsignal.c:2238
#17 0x40033e6b in gst_bin_iterate (bin=0x817ca78) at gstbin.c:1250
#18 0x080495e5 in idle_func (data=0x0) at gst-launch.c:78
#19 0x402f0333 in g_idle_dispatch (source=0x8176798, callback=0x324d4451,
    user_data=0x0) at gmain.c:3802
#20 0x402ecf72 in g_main_dispatch (context=0x81767e8) at gmain.c:1942
#21 0x402ee068 in g_main_context_dispatch (context=0x81767e8) at gmain.c:2492
#22 0x402ee3a0 in g_main_context_iterate (context=0x81767e8, block=1,
    dispatch=1, self=0x80508e8) at gmain.c:2573
#23 0x402ee9e3 in g_main_loop_run (loop=0x81768a8) at gmain.c:2777
#24 0x4002e06b in gst_main () at gst.c:853
#25 0x0804a402 in main (argc=7, argv=0xbffff7e4) at gst-launch.c:514


qtdemux_parse_trak calls qtdemux_audio_caps with 
    stream->caps = qtdemux_audio_caps (qtdemux, fourcc, NULL, 0);
ie data is NULL, but then it does

    case GST_MAKE_FOURCC ('Q', 'D', 'M', '2'):
      /* FIXME: QDesign music version 2 (no constant) */
      return gst_caps_new_simple ("audio/x-qdm2",
          "framesize", G_TYPE_INT, QTDEMUX_GUINT32_GET (data + 52),
          "bitrate", G_TYPE_INT, QTDEMUX_GUINT32_GET (data + 40),
          "blocksize", G_TYPE_INT, QTDEMUX_GUINT32_GET (data + 44), NULL);

ie it assumes data is not NULL, hence the crash (at least this is my guess).

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are the QA contact for the bug, or are watching the QA contact.