[Bug 731227] New: crash bug in 0.4.19

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=731227
  GStreamer | orc | 1.x

           Summary: crash bug in 0.4.19
    Classification: Platform
           Product: GStreamer
           Version: 1.x
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: critical
          Priority: Normal
         Component: orc
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: jcupitt at gmail.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
                CC: ds at schleef.org
     GNOME version: ---


Created an attachment (id=277890)
 --> (https://bugzilla.gnome.org/attachment.cgi?id=277890)
crash orc 0.4.19

Hi, I'm seeing crashes in my image processing library with orc-0.4.19. I've
made a test-case, attached. It's been generated automatically as a trace of the
orc calls my library is making, so I'm afraid it's very long, sorry about that,
but it does crash every time for me.

Sample run:

$ gcc -g -Wall orc-crash.c `pkg-config orc-0.4 --cflags --libs`
$ valgrind --db-attach=yes ./a.out
==21575== Memcheck, a memory error detector
==21575== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==21575== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==21575== Command: ./a.out
==21575== 
==21575== Invalid read of size 4
==21575==    at 0x4E4A168: orc_code_chunk_free (orccodemem.c:192)
==21575==    by 0x4E59E8D: orc_code_free (orccode.c:33)
==21575==    by 0x4E4A5EA: orc_program_free (orcprogram.c:175)
==21575==    by 0x40F72B: main (orc-crash.c:2238)
==21575==  Address 0x6b18e08 is 24 bytes inside a block of size 40 free'd
==21575==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==21575==    by 0x4E4A17F: orc_code_chunk_free (orccodemem.c:190)
==21575==    by 0x4E59E8D: orc_code_free (orccode.c:33)
==21575==    by 0x4E4A5EA: orc_program_free (orcprogram.c:175)
==21575==    by 0x40F5F3: main (orc-crash.c:2210)

This is on Ubuntu 14.04 with orc-0.4.19 compiled from source. It seems to also
crash on OS X. I've not tested other platforms. 

All orcs before 0.4.19 seem to work fine. 

This is only compiling code, no code is executed. 

The crash occurs when p[274] is freed, but I think the corruption of the
orccodemem heap is happening some time before that. 

John

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.