GNOME Bugzilla – Bug 696681
shm: clients array must be last in ShmBuffer struct
Last modified: 2013-03-28 18:40:11 UTC
Created attachment 239936 [details] [review] Keep clients array last in ShmBuffer struct On a 32-bit machine, I get a segfault in the unit test for elements/shm. A backtrace in gdb is as follows:
+ Trace 231689
Further debugging shows that in pollthread_func in gstshmsink.c, the pointer tag gets the value -1 from sp_writer_recv, and the segfault comes when gst_buffer_unref is called on that pointer. The problem is that the field "tag" has been put last in the ShmBuffer struct. It is important that the "clients" array pointer is last in that struct, because in sp_writer_send_buf memory is allocated for two blocks, where sp->clients points into the second block. The attached patch moves the tag field before the array.
I've seen these test crashes as well.
Oops.. Strange thing that GCC doesn't warn about a zero-sized array that's not last.. Fixed in 1.0 commit 1558a45ba2451288e43e4256d22166e5cd4cfdf8 Author: Olivier Crête <olivier.crete@collabora.com> Date: Thu Mar 28 14:36:16 2013 -0400 shm: Make sure the zero-sized array is always last in the struct https://bugzilla.gnome.org/show_bug.cgi?id=696681 And 1.1.x commit 6e9ff0a160b89b6b9a87d7bd5c8c7dba68b813df Author: Olivier Crête <olivier.crete@collabora.com> Date: Thu Mar 28 14:36:16 2013 -0400 shm: Make sure the zero-sized array is always last in the struct https://bugzilla.gnome.org/show_bug.cgi?id=696681