[Bug 740505] New: rtspsrc: segmentation fault when requesting srtp key

Fri Nov 21 11:38:35 PST 2014

https://bugzilla.gnome.org/show_bug.cgi?id=740505
  GStreamer | gst-plugins-good | git

           Summary: rtspsrc: segmentation fault when requesting srtp key
    Classification: Platform
           Product: GStreamer
           Version: git
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: aconchillo at gmail.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

If request_key signal callback is executed at the same time as
gst_rtspsrc_configure_caps (which is called from gst_rtspsrc_play) we end up
crashing.

My guess is that we start receiving packets while configuring the caps. Because
packets are encrypted we request a key. request_key modifies the caps as well
as gst_rtspsrc_configure_caps.

(xxxxx:33046): GStreamer-CRITICAL **: gst_caps_set_simple: assertion
'IS_WRITABLE (caps)' failed

Thread 70 below shows the assertion and the caps that fails is the same pointer
that make Thread 1 to crash.

#0  type_get_qdata_L (quark=1, node=0x7f4cec000188) at gtype.c:3641
#1  type_check_is_value_type_U (type=<optimized out>) at gtype.c:4121
#2  g_type_check_value (value=<optimized out>) at gtype.c:4154
#3  0x00007f4dd66fc56c in gst_value_init_and_copy (dest=0x7f4b76782e98,
src=0x7f4b6e5d4bc8) at gstvalue.c:5038
#4  0x00007f4dd66dd0b4 in gst_structure_copy (structure=0x7f4cec0517a0) at
gststructure.c:353
#5  0x00007f4dd668ceaa in _gst_caps_copy (caps=0x7f4b820f34f0) at gstcaps.c:168
#6  0x00007f4dd66b3d38 in gst_mini_object_make_writable
(mini_object=0x7f4b820f34f0) at gstminiobject.c:322
#7  0x00007f4d37843f87 in request_key (srtpdec=<optimized out>,
ssrc=3694519760, stream=0x7f4b802b9f20) at gstrtspsrc.c:3034
#8  0x00007f4dd29b5a14 in ffi_call_unix64 () from
/usr/lib/x86_64-linux-gnu/libffi.so.6
#9  0x00007f4dd29b5435 in ffi_call () from
/usr/lib/x86_64-linux-gnu/libffi.so.6
#10 0x00007f4dd640b23c in g_cclosure_marshal_generic_va
(closure=0x7f4b6e743740, return_value=0x7f4b76783500, instance=0x7f4b837781a0,
args_list=<optimized out>, marshal_data=0x7f4d37843ee0, n_params=1,
param_types=0x7f4d3004eb10)
    at gclosure.c:1541
#11 0x00007f4dd640a5fa in _g_closure_invoke_va (closure=0x7f4b6e743740,
return_value=0x7f4b76783500, instance=0x7f4b837781a0, args=0x7f4b76783588,
n_params=1, param_types=<optimized out>) at gclosure.c:831
#12 0x00007f4dd6424217 in g_signal_emit_valist (instance=0x7f4b837781a0,
signal_id=<optimized out>, detail=0, var_args=<optimized out>) at
gsignal.c:3218
#13 0x00007f4dd6424de2 in g_signal_emit (instance=<optimized out>,
signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3365
#14 0x00007f4d25bab7fc in signal_get_srtp_params (signal=<optimized out>,
ssrc=3694519760, filter=0x7f4b837781a0) at gstsrtpdec.c:483
#15 request_key_with_signal (filter=0x7f4b837781a0, ssrc=<optimized out>,
signal=<optimized out>) at gstsrtpdec.c:697
#16 0x00007f4d25babdfc in validate_buffer (is_rtcp=<synthetic pointer>,
ssrc=0x7f4b7678394c, buf=0x7f4b5c30f900, filter=0x7f4b837781a0) at
gstsrtpdec.c:593
#17 gst_srtp_dec_chain (pad=0x7f4ca4011400, parent=0x7f4b837781a0,
buf=0x7f4b5c30f900, is_rtcp=0) at gstsrtpdec.c:1029
#18 0x00007f4dd66b8ad9 in gst_pad_chain_data_unchecked (data=0x7f4b5c30f900,
type=<optimized out>, pad=0x7f4ca4011400) at gstpad.c:3836
#19 gst_pad_push_data (pad=0x7f4b6fe1e4b0, type=<optimized out>,
data=<optimized out>) at gstpad.c:4069
#20 0x00007f4dd66a793b in gst_proxy_pad_chain_default (pad=<optimized out>,
parent=<optimized out>, buffer=0x7f4b5c30f900) at gstghostpad.c:126
#21 0x00007f4dd66b8ad9 in gst_pad_chain_data_unchecked (data=0x7f4b5c30f900,
type=<optimized out>, pad=0x7f4b6e026ed0) at gstpad.c:3836
#22 gst_pad_push_data (pad=0x7f4c80012dd0, type=<optimized out>,
data=<optimized out>) at gstpad.c:4069
#23 0x00007f4dd6989e28 in gst_base_src_loop (pad=0x7f4c80012dd0) at
gstbasesrc.c:2835
#24 0x00007f4dd66e905f in gst_task_func (task=0x7f4b9331d710) at gsttask.c:317
#25 0x00007f4dd612e0c6 in g_thread_pool_thread_proxy (data=<optimized out>) at
gthreadpool.c:307
#26 0x00007f4dd612d5b5 in g_thread_proxy (data=0x7f4d20003940) at gthread.c:764
#27 0x00007f4dde8a08f4 in ?? () from /usr/lib/nvidia-304/libGL.so.1
#28 0x00007f4ddb2b0e9a in start_thread (arg=0x7f4b76784700) at
pthread_create.c:308
#29 0x00007f4ddb5ba31d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#30 0x0000000000000000 in ?? ()

Thread 70 (Thread 0x7f1499a6d700 (LWP 16326)):
#0  _IO_old_init (fp=0x7f1499a6c620, flags=<optimized out>) at genops.c:617
#1  0x00007f150c6964d8 in _IO_no_init (fp=0x7f1499a6c620, flags=<optimized
out>, orientation=-1, wd=0x0, jmp=0x0) at genops.c:649
#2  0x00007f150c7248b5 in __GI___vasprintf_chk (result_ptr=0x7f1499a6c768,
flags=1, format=0x7f15098c6efd "%s: assertion '%s' failed",
args=0x7f1499a6c848) at vasprintf_chk.c:56
#3  0x00007f150989011b in g_vasprintf () from
/opt/oblong/deps-64-10/lib/libglib-2.0.so.0
#4  0x00007f1509866aed in g_strdup_vprintf () from
/opt/oblong/deps-64-10/lib/libglib-2.0.so.0
#5  0x00007f150984f8b3 in g_logv () from
/opt/oblong/deps-64-10/lib/libglib-2.0.so.0
#6  0x00007f150984fc92 in g_log () from
/opt/oblong/deps-64-10/lib/libglib-2.0.so.0
#7  0x00007f1509dcfcd3 in gst_caps_set_simple (caps=<optimized out>,
field=<optimized out>) at gstcaps.c:1049
#8  0x00007f149b5b3c76 in gst_rtspsrc_configure_caps (reset_manager=1,
segment=0x3ff0000000000000, src=0x2368bd20) at gstrtspsrc.c:4041
#9  gst_rtspsrc_play (src=0x2368bd20, segment=0x3ff0000000000000, async=1) at
gstrtspsrc.c:7450
#10 0x00007f149b5b4fc6 in gst_rtspsrc_thread (src=0x2368bd20) at
gstrtspsrc.c:7739
#11 0x00007f1509e2b05f in gst_task_func (task=0x7f13c4e7acb0) at gsttask.c:317
#12 0x00007f15098700c6 in ?? () from
/opt/oblong/deps-64-10/lib/libglib-2.0.so.0
#13 0x00007f150986f5b5 in ?? () from
/opt/oblong/deps-64-10/lib/libglib-2.0.so.0
#14 0x00007f150c404e9a in start_thread (arg=0x7f1499a6d700) at
pthread_create.c:308
#15 0x00007f150c70e3fd in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#16 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.