[Bug 690679] GstRSVG crash with large SVG file

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=690679
  GStreamer | gst-plugins-bad | 1.2.4

Jens Georg <mail> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|MediaExport plugin          |gst-plugins-bad
            Version|0.16.x                      |1.2.4
         AssignedTo|mail at jensge.org             |gstreamer-bugs at lists.freede
                   |                            |sktop.org
            Product|Rygel                       |GStreamer
   Target Milestone|---                         |HEAD
            Summary|segfault; last debug        |GstRSVG crash with large
                   |message comes from          |SVG file
                   |MediaExport                 |
          QAContact|rygel-maint at gnome.bugs      |gstreamer-bugs at lists.freede
                   |                            |sktop.org

--- Comment #5 from Jens Georg <mail at jensge.org> 2014-06-14 08:13:08 UTC ---
Still crashing with GStreamer 1.2.4, moving to GStreamer

(gdb) run
Starting program: /usr/bin/gst-discoverer-1.0 challenge2.svg
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Analyzing file:///home/jens/tmp/challenge2.svg
[New Thread 0x7ffff4fd1700 (LWP 8939)]
[New Thread 0x7fffebb6b700 (LWP 8940)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff4fd1700 (LWP 8939)]
gst_rsvg_decode_unpremultiply (height=53454, width=24458, data=0x7fffe4022000
"") at gstrsvgdec.c:131
131          a = data[3];
(gdb) bt
#0  gst_rsvg_decode_unpremultiply (height=53454, width=24458,
data=0x7fffe4022000 "") at gstrsvgdec.c:131
#1  gst_rsvg_decode_image (rsvg=rsvg at entry=0x7ffff005a0a0,
buffer=0x7ffff022ea70, frame=frame at entry=0x7ffff001f2b0)
    at gstrsvgdec.c:242
#2  0x00007ffff43b5d4a in gst_rsvg_dec_handle_frame (decoder=0x7ffff005a0a0,
frame=0x7ffff001f2b0) at gstrsvgdec.c:338
#3  0x00007ffff6b4aa19 in gst_video_decoder_decode_frame
(decoder=decoder at entry=0x7ffff005a0a0, frame=0x7ffff001f2b0)
    at gstvideodecoder.c:2832
#4  0x00007ffff6b50c2b in gst_video_decoder_have_frame (decoder=0x7ffff005a0a0)
at gstvideodecoder.c:2764
#5  0x00007ffff6b4ac79 in gst_video_decoder_parse_available
(dec=dec at entry=0x7ffff005a0a0, at_eos=at_eos at entry=0, new_buffer=0, 
    new_buffer at entry=1) at gstvideodecoder.c:929
#6  0x00007ffff6b4adcc in gst_video_decoder_chain_forward
(decoder=decoder at entry=0x7ffff005a0a0, buf=buf at entry=0x7ffff022e960, 
    at_eos=at_eos at entry=0) at gstvideodecoder.c:1763
#7  0x00007ffff6b4cf7d in gst_video_decoder_chain (pad=<optimized out>,
parent=0x7ffff005a0a0, buf=0x7ffff022e960)
    at gstvideodecoder.c:2037
#8  0x00007ffff7910d08 in gst_pad_chain_data_unchecked (data=0x7ffff022e960,
type=4112, pad=0x7e6920) at gstpad.c:3760
#9  gst_pad_push_data (pad=0x7e6290, type=type at entry=4112, data=<optimized
out>) at gstpad.c:3990
#10 0x00007ffff79179b6 in gst_pad_push (pad=<optimized out>, buffer=<optimized
out>) at gstpad.c:4093
#11 0x00007ffff50007a3 in gst_type_find_element_loop (pad=<optimized out>) at
gsttypefindelement.c:1094
#12 0x00007ffff793e549 in gst_task_func (task=0x7f0050) at gsttask.c:316
#13 0x00007ffff73c589c in g_thread_pool_thread_proxy (data=<optimized out>)
    at /build/buildd/glib2.0-2.40.0/./glib/gthreadpool.c:307
#14 0x00007ffff73c4f15 in g_thread_proxy (data=0x6a3540) at
/build/buildd/glib2.0-2.40.0/./glib/gthread.c:764
#15 0x00007ffff7141182 in start_thread (arg=0x7ffff4fd1700) at
pthread_create.c:312
#16 0x00007ffff6e6e30d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.