[gstreamer-bugs] [Bug 553295] New: fuzzed mpeg causes segfault in gstreamer

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=553295

  GStreamer | don't know | Ver: 0.10.19
           Summary: fuzzed mpeg causes segfault in gstreamer
           Product: GStreamer
           Version: 0.10.19
          Platform: Other
        OS/Version: All
            Status: UNCONFIRMED
          Severity: critical
          Priority: Normal
         Component: don't know
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: candrews at integralblue.com
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: 2.23/2.24
   GNOME milestone: Unspecified


Steps to reproduce:
1. Open totem
2. Play attached mpeg
3. Look at crash


Stack trace:
Thread 4 (Thread 0x41840950 (LWP 24943)):
#0  0x00007f77826a3373 in memcpy () from /lib/libc.so.6
#1  0x00007f77829ea088 in g_memdup () from /usr/lib/libglib-2.0.so.0
#2  0x00007f7773bd7963 in ?? () from /usr/lib/gstreamer-0.10/libgstavi.so
#3  0x00007f7773bdc6b9 in ?? () from /usr/lib/gstreamer-0.10/libgstavi.so
#4  0x00007f7773be3348 in ?? () from /usr/lib/gstreamer-0.10/libgstavi.so
#5  0x00007f778a7563a6 in ?? () from /usr/lib/libgstreamer-0.10.so.0
#6  0x00007f77829f4837 in ?? () from /usr/lib/libglib-2.0.so.0
#7  0x00007f77829f32a4 in ?? () from /usr/lib/libglib-2.0.so.0
#8  0x00007f77867f73ea in start_thread () from /lib/libpthread.so.0
#9  0x00007f7782704b9d in clone () from /lib/libc.so.6
#10 0x0000000000000000 in ?? ()

Thread 2 (Thread 0x41037950 (LWP 24940)):
#0  0x00007f77867fe851 in nanosleep () from /lib/libpthread.so.0
#1  0x00007f77829f5508 in g_usleep () from /usr/lib/libglib-2.0.so.0
#2  0x00007f777a387978 in ?? () from
/usr/lib/gstreamer-0.10/libgstximagesink.so
#3  0x00007f77829f32a4 in ?? () from /usr/lib/libglib-2.0.so.0
#4  0x00007f77867f73ea in start_thread () from /lib/libpthread.so.0
#5  0x00007f7782704b9d in clone () from /lib/libc.so.6
#6  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7f778afbf790 (LWP 24936)):
#0  0x00007f778264e4ce in ?? () from /lib/libc.so.6
#1  0x00007f778264c5c5 in ?? () from /lib/libc.so.6
#2  0x00007f778264bf34 in ?? () from /lib/libc.so.6
#3  0x00007f7784ea4536 in ?? () from /usr/lib/libgio-2.0.so.0
#4  0x0000000000430ad7 in totem_get_mount_for_media ()
#5  0x00000000004217ec in totem_action_set_mrl_with_warning ()
#6  0x0000000000421c59 in totem_action_set_mrl_and_play ()
#7  0x00000000004224a9 in totem_action_play_pause ()
#8  0x0000000000424728 in main ()
#0  0x00007f77826a3373 in memcpy () from /lib/libc.so.6

Other information:
https://bugs.launchpad.net/ubuntu/+source/gstreamer0.10/+bug/164940


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=553295.