[gstreamer-bugs] [Bug 399613] New: goom doesn't check sink caps (occasional segfault on AAC files)

[GStreamer (bugzilla.gnome.org)]

Do not reply to this via email (we are currently unable to handle email
responses and they get discarded).  You can add comments to this bug at
http://bugzilla.gnome.org/show_bug.cgi?id=399613

  GStreamer | gst-plugins-good | Ver: 0.10.11

           Summary: goom doesn't check sink caps (occasional segfault on AAC
                    files)
           Product: GStreamer
           Version: 0.10.11
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: ed at catmur.co.uk
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: 2.17/2.18
   GNOME milestone: Unspecified


Occasionally when playing AACs, Rhythmbox segvs when I load the Goom
visualisation:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1343255664 (LWP 325)]
gst_goom_chain (pad=0x90b1d90, buffer=0x926f6d0) at gstgoom.c:492
492             goom->datain[0][i] = *data;
(gdb) p data
$1 = (const guint16 *) 0x0
(gdb) bt
#0  gst_goom_chain (pad=0x90b1d90, buffer=0x926f6d0) at gstgoom.c:492
#1  0xb6f52d1a in gst_pad_chain_unchecked (pad=0x90b1d90, buffer=0x926f6d0)
    at gstpad.c:3412
#2  0xb6f57a4c in gst_pad_push (pad=0x9166320, buffer=0x926f6d0)
    at gstpad.c:3578
#3  0xb6f443aa in gst_proxy_pad_do_chain (pad=0x935b620, buffer=0x926f6d0)
    at gstghostpad.c:189
#4  0xb6f52d1a in gst_pad_chain_unchecked (pad=0x935b620, buffer=0x926f6d0)
    at gstpad.c:3412
#5  0xb6f57a4c in gst_pad_push (pad=0x90b1c10, buffer=0x926f6d0)
    at gstpad.c:3578
#6  0xb6fbc042 in gst_base_transform_chain (pad=0x922f248, buffer=0x926f6d0)
    at gstbasetransform.c:1548
#7  0xb6f52d1a in gst_pad_chain_unchecked (pad=0x922f248, buffer=0x926f6d0)
    at gstpad.c:3412
#8  0xb6f57a4c in gst_pad_push (pad=0x9195b30, buffer=0x926f6d0)
    at gstpad.c:3578
#9  0xb52f5a50 in gst_queue_loop (pad=0x9195b30) at gstqueue.c:786
#10 0xb6f6bf96 in gst_task_func (task=0x909ac10, tclass=0x922cd00)
    at gsttask.c:192
#11 0xb6cbbfd7 in g_thread_pool_thread_proxy (data=0x902d6c8)
    at gthreadpool.c:265
#12 0xb6cbacdf in g_thread_create_proxy (data=0x9207a40) at gthread.c:591
---Type <return> to continue, or q <return> to quit---
#13 0xb6eb94ab in start_thread (arg=0xafef8b90) at pthread_create.c:296
#14 0xb6b8c1ae in clone () from /lib/libc.so.6
(gdb) p goom->bps
$10 = 0
(gdb) p *goom
$11 = {element = {object = {object = {g_type_instance = {g_class = 0x8feae08}, 
        ref_count = 2, qdata = 0x0}, refcount = 0, lock = 0x902ada8, 
      name = 0x90ad860 "goom3", name_prefix = 0x0, parent = 0x908e2e0, 
      flags = 0, _gst_reserved = 0x0}, state_lock = 0x8b7e1d0, 
    state_cond = 0x9324c28, state_cookie = 3, 
    current_state = GST_STATE_PLAYING, next_state = GST_STATE_VOID_PENDING, 
    pending_state = GST_STATE_VOID_PENDING, 
    last_return = GST_STATE_CHANGE_SUCCESS, bus = 0x89560b0, 
    clock = 0x8b9c168, base_time = 0, numpads = 2, pads = 0xb3c80400, 
    numsrcpads = 1, srcpads = 0x8b83bc0, numsinkpads = 1, 
    sinkpads = 0x8e84cd0, pads_cookie = 2, _gst_reserved = {0x0, 0x0, 0x0, 
      0x0}}, sinkpad = 0x90b1d90, srcpad = 0x9051488, adapter = 0x8ff8020, 
  rate = 0, channels = 0, bps = 0, fps_n = 20, fps_d = 1, width = 320, 
  height = 240, duration = 50000000, outsize = 307200, spf = 0, datain = {{
      0 <repeats 512 times>}, {0 <repeats 512 times>}}, goomdata = {
    pixel = 0xb4c00018, back = 0xb4c4b0a0, p1 = 0xb4c00080, p2 = 0xb4c4b100, 
    cycle = 0, resolx = 320, resoly = 240, buffsize = 76800, lockvar = 0, 
    goomvar = 0, totalgoom = 0, agoom = 0, loopvar = 0, speedvar = 0, 
    lineMode = 0, goomlimit = 2 '\002', zfd = 0x8956c38, rand_tab = 0x9656f80, 
    rand_pos = 65536}, segment = {rate = 1, abs_rate = 1, 
    format = GST_FORMAT_TIME, flags = GST_SEEK_FLAG_NONE, start = 0, 
    stop = -1, time = 0, accum = 0, last_stop = 0, duration = -1, 
    applied_rate = 1, _gst_reserved = "\000\000\000\000\000\000\000"}, 
---Type <return> to continue, or q <return> to quit---
  next_ts = 40031201814, proportion = 1, earliest_time = 18446744073709551615}

Evidently in gst_goom_sink_setcaps() gst_structure_get_int() returned 0 for
channels and rate.  Goom should refuse to set caps if this happens.


-- 
Configure bugmail: http://bugzilla.gnome.org/userprefs.cgi?tab=email