After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 549784 - Memory Corruption Probing v4l2src with Video4Linux1 device
Memory Corruption Probing v4l2src with Video4Linux1 device
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-good
0.10.x
Other Linux
: Normal normal
: 0.10.11
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2008-08-29 04:23 UTC by Mike Ruprecht
Modified: 2008-10-03 11:32 UTC
See Also:
GNOME target: ---
GNOME version: 2.23/2.24


Attachments
Valgrind log of the crash. (67.45 KB, text/x-log)
2008-08-29 04:26 UTC, Mike Ruprecht
Details

Description Mike Ruprecht 2008-08-29 04:23:38 UTC
I have a Logitech QuickCam Express webcam and if you create a v4l2src and then probe for devices it seems to cause memory corruption. I don't know if this could be a GStreamer bug or if it would be the driver. I'm on Ubuntu 8.10 (Intrepid). Doing the following sequence causes a crash.

Steps to cause the crash:
1. Have Logitech QuickCam Express connected.
2. Create a v4l2src.
3. Probe the v4l2src's devices.
4. Create 2 more v4l2srcs.
5. Free all of them.

The program used to cause the crash:
#include <gst/gst.h>
#include <gst/interfaces/propertyprobe.h>

int main(int argc, char *argv[])
{
	gst_init(&argc, &argv);
g_message("creating element");
	GstElement *element1 = gst_element_factory_make("v4l2src", NULL);
g_message("created element1 %p", element1);

g_message("probing devices");
	gst_property_probe_probe_property_name(GST_PROPERTY_PROBE(element1), "device");

g_message("creating more elements");
	GstElement *element2 = gst_element_factory_make("v4l2src", NULL);
g_message("created element2 %p", element2);
	GstElement *element3 = gst_element_factory_make("v4l2src", NULL);
g_message("created element3 %p", element3);

g_message("freeing element3");
	gst_object_unref(element3);
g_message("freeing element2");
	gst_object_unref(element2);
g_message("freeing element1");
	gst_object_unref(element1);
g_message("return");
	return 0;
}
Comment 1 Mike Ruprecht 2008-08-29 04:26:14 UTC
Created attachment 117563 [details]
Valgrind log of the crash.
Comment 2 Wim Taymans 2008-10-03 11:32:54 UTC
        * sys/v4l2/gstv4l2object.h:
        Getting the Class from an instance is not just a matter of casting it to
        the class struct but it involves calling G_OBJECT_GET_CLASS on the
        instance. Fixes #549784.