GNOME Bugzilla – Bug 337785
[ffmpeg] A particular GIF file crashes rhymbox
Last modified: 2009-09-10 07:43:11 UTC
That bug has been opened on https://launchpad.net/distros/ubuntu/+source/rhythmbox/+bug/38809 "After an upgrade (to 0.9.3.1-0ubuntu3), rhythmbox started crashing while scanning local music files. The output of 'rhythmbox -d' was: [0x812b700] [action_thread_main] rhythmdb.c:2016 (11:28:56): executing RHYTHMDB_ACTION_LOAD for "file:///mnt/shared/music/Violent%20Femmes/Freak%20Magnet/vf_freak.gif" [0x812b700] [rb_metadata_load] rb-metadata-gst.c:760 (11:28:56): loading metadata for uri: file:///mnt/shared/music/Violent%20Femmes/Freak%20Magnet/vf_freak.gif[0x812b700] [rb_metadata_load] rb-metadata-gst.c:832 (11:28:56): going to PAUSED for metadata, uri: file:///mnt/shared/music/Violent%20Femmes/Freak%20Magnet/vf_freak.gif [0x812b700] [rb_metadata_gst_typefind_cb] rb-metadata-gst.c:563 (11:28:56): found type image/gif [0x893aab0] [rb_metadata_gst_new_decoded_pad_cb] rb-metadata-gst.c:598 (11:28:56): got decoded video pad of type video/x-raw-rgb *** glibc detected *** double free or corruption (out): 0x08971e20 *** Removing this GIF file fixed the issue. When I put the file back, the problem recurred with 100% repeatability. A different GIF file in the same location caused no problem. A copy of the file is here: http://clublinux.almatech.net.au/files/images/vf_freak_0.gif" $ gdb --args gst-launch-0.10 -t filesrc location=bug.gif ! decodebin ! fakesink ... Program received signal SIGSEGV, Segmentation fault.
+ Trace 67546
Thread NaN (LWP 20237)
due to gst-ffmpeg
Other backtrace: *** glibc detected *** free(): invalid next size (normal): 0x08260400 *** Program received signal SIGABRT, Aborted.
+ Trace 67547
Thread NaN (LWP 20413)
*** Bug 338691 has been marked as a duplicate of this bug. ***
I can't reproduce this problem. Would it be possible to get a debug log from: GST_DEBUG=5 gst-launch-0.10 -t filesrc location=bug.gif ! decodebin ! fakesink
This bug will only be triggered if the gdkpixbufdec element isn't available. FWIW, I can still reproduce it with current gst-ffmpeg CVS: $ gst-launch-0.10 filesrc location=337785.gif ! ffdemux_gif ! fakesink Setting pipeline to PAUSED ... Pipeline is PREROLLING ... Pipeline is PREROLLED ... Setting pipeline to PLAYING ... New clock: GstSystemClock Got EOS from element "pipeline0". Execution ended after 1474000 ns. Setting pipeline to PAUSED ... Setting pipeline to READY ... *** glibc detected *** free(): invalid next size (normal): 0x0818bc00 *** Aborted FWIW, valgrind also complains about this (probably not related though): ==25913== Invalid write of size 1 ==25913== at 0x4956D2D: gif_parse_next_image (gifdec.c:363) ==25913== by 0x4956F24: gif_read_packet (gifdec.c:575) ==25913== by 0x4915748: av_read_packet (utils.c:632) ==25913== by 0x4919C9A: av_read_frame_internal (utils.c:919) ==25913== by 0x4912044: gst_ffmpegdemux_loop (gstffmpegdemux.c:1110) ==25913== Address 0x4F3718A is 2 bytes after a block of size 121,800 alloc'd ==25913== at 0x401C970: memalign (vg_replace_malloc.c:332) ==25913== by 0x401C9FB: posix_memalign (vg_replace_malloc.c:384) ==25913== by 0x49617F7: av_malloc (mem.c:62) ==25913== by 0x495647D: gif_read_header (gifdec.c:549) ==25913== by 0x49156A9: av_open_input_stream (utils.c:492) ==25913== by 0x4918487: av_open_input_file (utils.c:605) ==25913== by 0x4912A38: gst_ffmpegdemux_loop (gstffmpegdemux.c:977) In gst-ffmpeg CVS the ffdemux_* elements all have a rank of NONE now so they're not getting autoplugged any longer, that should 'fix' this issue as well.
moving to less critical as the demuxers will be disabled soon and you have to manually select the demuxer. Still keeping it open until we find a way to not make ffmpeg demuxers crash.
Sebastien, could you make that file available again so we can test it with the latest fixes to ffmpeg and gif decoding/demuxing .
Created attachment 101170 [details] vf_freak_0.gif Still crashes for me with CVS.
crashes somewhere else now : Program received signal SIGSEGV, Segmentation fault.
+ Trace 182228
Thread 1082132816 (LWP 28192)
Disabling display 1 to avoid infinite recursion. 1: *avctx->codec = Cannot access memory at address 0x69fde769fde769fd
This can be closed now, ffmpeg doesn't contain a GIF animation decoder anymore.