Bug 159032 – Crash in libpng

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 159032 - Crash in libpng


Summary:	Crash in libpng


Status:	RESOLVED NOTGNOME

Product:	totem
Classification:	Core
Component:	general
Version:	0.99.20
Hardware:	Other Linux

Importance:	Normal major
Target Milestone:	---
Assigned To:	General Totem maintainer(s)
QA Contact:	General Totem maintainer(s)

URL:
Whiteboard:

Duplicates:	159396 159650 163120 (view as bug list)
Depends on:
Blocks:

Reported:	2004-11-22 08:01 UTC by Jens Granseuer
Modified:	2005-01-06 14:09 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Jens Granseuer 2004-11-22 08:01:37 UTC

Totem hangs when I completely clear the playlist (0.99.21 too). It doesn't seem
to matter how many items are in the list.

I've tried to track it down but the best I've come up with so far is this
stacktrace:

Program received signal SIGSEGV, Segmentation fault.

+ Trace 52410

Thread 8201 (LWP 13132)

#0 chunk_free
from /lib/libc.so.6
#1 free
from /lib/libc.so.6
#2 png_free_default
from /usr/lib/libpng.so.3
#3 png_free
from /usr/lib/libpng.so.3
#4 png_zfree
from /usr/lib/libpng.so.3
#5 inflateEnd
from /lib/libz.so.1
#6 png_read_destroy
from /usr/lib/libpng.so.3
#7 png_destroy_read_struct
from /usr/lib/libpng.so.3


libpng version is 1.2.7.

Comment 1 Bastien Nocera 2004-11-22 16:23:51 UTC

Is that with the xine backend?
If so, could you compile xine-lib with debug (follow the instructions at
http://www.hadess.net/totem.php3#bugs), and get a backtrace of the crash?

Comment 2 Jens Granseuer 2004-11-23 17:17:23 UTC

Yes, it's with xine. If I enable debugging, totem already hangs at
startup and even with an empty playlist. This is the trace I get then.

Program received signal SIGSEGV, Segmentation fault.

+ Trace 52524

Thread 8201 (LWP 28773)

#0 chunk_free
from /lib/libc.so.6
#1 free
from /lib/libc.so.6
#2 png_free_default
from /usr/lib/libpng.so.3
#3 png_free
from /usr/lib/libpng.so.3
#4 png_zfree
from /usr/lib/libpng.so.3
#5 inflateEnd
from /lib/libz.so.1
#6 png_read_destroy
from /usr/lib/libpng.so.3
#7 png_destroy_read_struct
from /usr/lib/libpng.so.3
#8 finalize_png_reader
at image.c line 120
#9 end_callback
at image.c line 223
#10 png_push_have_end
from /usr/lib/libpng.so.3
#11 png_push_read_chunk
from /usr/lib/libpng.so.3
#12 png_process_some_data
from /usr/lib/libpng.so.3
#13 png_process_data
from /usr/lib/libpng.so.3
#14 process_data
#15 image_decode_data
at image.c line 295
#16 video_decoder_loop
at video_decoder.c line 363
#17 pthread_start_thread
from /lib/libpthread.so.0
#18 pthread_start_thread_event
from /lib/libpthread.so.0

Comment 3 Sebastien Bacher 2004-11-24 20:57:29 UTC

A bug report has been opened in the Debian BTS with a similar backtrace, but the
bug happen on startup with 0.99.22:
http://bugs.debian.org/282683

"I just upgraded from 0.99.16 and found out that it crashes on start up. I
removed all previous configuration files, but that didn't solve the problem."
"I found out that if I pass a MRL to totem from the command line, not
necessarily a valid one, (e.g. dvd://, xxx://) it doesn't crash."

not sure if that's a dup or a different bug

Comment 4 Sebastien Bacher 2004-11-24 23:12:59 UTC

downgrading libpng fixes the issue, probably not a totem bug

Comment 5 Bastien Nocera 2004-11-25 11:47:33 UTC

*** Bug 159396 has been marked as a duplicate of this bug. ***

Comment 6 Bastien Nocera 2004-11-25 16:42:15 UTC

The double-free seems to come from libpng. Closing.

Comment 7 Jens Granseuer 2004-11-26 09:03:06 UTC

I can confirm that the problem goes away by reverting to libpng 1.2.6.
1.2.8rc1 is still crashing though. I've filed a report for libpng at
http://sourceforge.net/tracker/index.php?func=detail&aid=1073614&group_id=5624&atid=105624

Comment 8 Bastien Nocera 2004-11-28 13:30:24 UTC

*** Bug 159650 has been marked as a duplicate of this bug. ***

Comment 9 Bastien Nocera 2005-01-06 14:09:57 UTC

*** Bug 163120 has been marked as a duplicate of this bug. ***