Bug 719497 – videoflip: crashes on tag list without orientation tag in git master

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 719497 - videoflip: crashes on tag list without orientation tag in git master


Summary:	videoflip: crashes on tag list without orientation tag in git master


Status:	RESOLVED FIXED

Product:	GStreamer
Classification:	Platform
Component:	gst-plugins-good
Version:	git master
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	1.3.1
Assigned To:	GStreamer Maintainers
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-11-28 15:57 UTC by Christian Fredrik Kalager Schaller
Modified:	2013-11-28 17:04 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Christian Fredrik Kalager Schaller 2013-11-28 15:57:51 UTC

(gdb) thread apply all bt

+ Trace 232850

Thread 20 (Thread 0x7f9b9d13c700 (LWP 3699))

#0 _make_words
from /lib64/libvorbis.so.0
#1 vorbis_book_init_encode
from /lib64/libvorbis.so.0
#2 _vds_shared_init
from /lib64/libvorbis.so.0
#3 vorbis_analysis_init
from /lib64/libvorbis.so.0
#4 gst_vorbis_enc_setup
at gstvorbisenc.c line 527
#5 gst_vorbis_enc_set_format
at gstvorbisenc.c line 335
#6 gst_audio_encoder_sink_setcaps
at gstaudioencoder.c line 1284
#7 gst_audio_encoder_chain
at gstaudioencoder.c line 1057
#8 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#9 gst_pad_push_data
at gstpad.c line 3950
#10 gst_pad_push
at gstpad.c line 4053
#11 gst_base_transform_chain
at gstbasetransform.c line 2237
#12 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#13 gst_pad_push_data
at gstpad.c line 3950
#14 gst_pad_push
at gstpad.c line 4053
#15 gst_base_transform_chain
at gstbasetransform.c line 2237
#16 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#17 gst_pad_push_data
at gstpad.c line 3950
#18 gst_pad_push
at gstpad.c line 4053
#19 gst_base_transform_chain
at gstbasetransform.c line 2237
#20 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#21 gst_pad_push_data
at gstpad.c line 3950
#22 gst_pad_push
at gstpad.c line 4053
#23 gst_base_transform_chain
at gstbasetransform.c line 2237
#24 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#25 gst_pad_push_data
at gstpad.c line 3950
#26 gst_pad_push
at gstpad.c line 4053
#27 gst_audio_rate_chain
at gstaudiorate.c line 648
#28 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#29 gst_pad_push_data
at gstpad.c line 3950
#30 gst_pad_push
at gstpad.c line 4053
#31 gst_stream_splitter_chain
at gststreamsplitter.c line 136
#32 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#33 gst_pad_push_data
at gstpad.c line 3950
#34 gst_pad_push
at gstpad.c line 4053
#35 gst_queue_push_one
at gstqueue.c line 1124
#36 gst_queue_loop
at gstqueue.c line 1253
#37 gst_task_func
at gsttask.c line 316
#38 g_thread_pool_thread_proxy
from /lib64/libglib-2.0.so.0
#39 g_thread_proxy
from /lib64/libglib-2.0.so.0
#40 start_thread
at pthread_create.c line 309
#41 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 111

Thread 16 (Thread 0x7f9bb9770700 (LWP 3695))

#0 __GI_raise
at ../nptl/sysdeps/unix/sysv/linux/raise.c line 56
#1 __GI_abort
at abort.c line 89
#2 __libc_message
at ../sysdeps/posix/libc_fatal.c line 175
#3 malloc_printerr
#4 _int_free
at malloc.c line 3782
#5 g_free
from /lib64/libglib-2.0.so.0
#6 gst_video_flip_sink_event
at gstvideoflip.c line 1222
#7 gst_pad_send_event_unchecked
at gstpad.c line 4995
#8 gst_pad_push_event_unchecked
at gstpad.c line 4691
#9 push_sticky
at gstpad.c line 3324
#10 events_foreach
at gstpad.c line 533
#11 check_sticky
at gstpad.c line 3380
#12 gst_pad_push_event
at gstpad.c line 4808
#13 gst_base_transform_sink_eventfunc
at gstbasetransform.c line 1879
#14 gst_pad_send_event_unchecked
at gstpad.c line 4995
#15 gst_pad_push_event_unchecked
at gstpad.c line 4691
#16 push_sticky
at gstpad.c line 3324
#17 events_foreach
at gstpad.c line 533
#18 check_sticky
at gstpad.c line 3380
#19 gst_pad_push_event
at gstpad.c line 4808
#20 event_forward_func
at gstpad.c line 2741
#21 gst_pad_forward
at gstpad.c line 2695
#22 gst_pad_event_default
at gstpad.c line 2792
#23 gst_deinterlace_sink_event
at gstdeinterlace.c line 2582
#24 gst_pad_send_event_unchecked
at gstpad.c line 4995
#25 gst_pad_push_event_unchecked
at gstpad.c line 4691
#26 push_sticky
at gstpad.c line 3324
#27 events_foreach
at gstpad.c line 533
#28 check_sticky
at gstpad.c line 3380
#29 gst_pad_push_event
at gstpad.c line 4808
#30 event_forward_func
at gstpad.c line 2741
#31 gst_pad_forward
at gstpad.c line 2695
#32 gst_pad_event_default
at gstpad.c line 2792
#33 gst_pad_send_event_unchecked
at gstpad.c line 4995
#34 gst_pad_push_event_unchecked
at gstpad.c line 4691
#35 push_sticky
at gstpad.c line 3324
#36 events_foreach
at gstpad.c line 533
#37 check_sticky
at gstpad.c line 3380
#38 gst_pad_push_event
at gstpad.c line 4808
#39 event_forward_func
at gstpad.c line 2741
#40 gst_pad_forward
at gstpad.c line 2695
#41 gst_pad_event_default
at gstpad.c line 2792
#42 gst_pad_send_event_unchecked
at gstpad.c line 4995
#43 gst_pad_push_event_unchecked
at gstpad.c line 4691
#44 push_sticky
at gstpad.c line 3324
#45 events_foreach
at gstpad.c line 533
#46 check_sticky
at gstpad.c line 3380
#47 gst_pad_push_event
at gstpad.c line 4808
#48 gst_video_decoder_push_event
at gstvideodecoder.c line 907
#49 gst_video_decoder_finish_frame
at gstvideodecoder.c line 2469
#50 handle_slice
at gstmpeg2dec.c line 950
#51 gst_mpeg2dec_handle_frame
at gstmpeg2dec.c line 1045
#52 gst_video_decoder_decode_frame
at gstvideodecoder.c line 2779
#53 gst_video_decoder_chain_forward
at gstvideodecoder.c line 1769
#54 gst_video_decoder_chain
at gstvideodecoder.c line 2018
#55 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#56 gst_pad_push_data
at gstpad.c line 3950
#57 gst_pad_push
at gstpad.c line 4053
#58 gst_base_parse_push_frame
at gstbaseparse.c line 2289
#59 gst_base_parse_handle_and_push_frame
at gstbaseparse.c line 2111
#60 gst_base_parse_finish_frame
at gstbaseparse.c line 2415
#61 gst_mpegv_parse_handle_frame
at gstmpegvideoparse.c line 701
#62 gst_base_parse_handle_buffer
at gstbaseparse.c line 1959
#63 gst_base_parse_chain
at gstbaseparse.c line 2842
#64 gst_pad_chain_data_unchecked
at gstpad.c line 3717
#65 gst_pad_push_data
at gstpad.c line 3950
#66 gst_pad_push
at gstpad.c line 4053
#67 gst_single_queue_push_one
at gstmultiqueue.c line 1083
#68 gst_multi_queue_loop
at gstmultiqueue.c line 1331
#69 gst_task_func
at gsttask.c line 316
#70 g_thread_pool_thread_proxy
from /lib64/libglib-2.0.so.0
#71 g_thread_proxy
from /lib64/libglib-2.0.so.0
#72 start_thread
at pthread_create.c line 309
#73 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 111

Comment 1 Christian Fredrik Kalager Schaller 2013-11-28 16:00:30 UTC

This is what happens in the terminal running the application

*** Error in `python3': free(): invalid pointer: 0x00007f9bcc56ad3c ***
======= Backtrace: =========
/lib64/libc.so.6(+0x75d9f)[0x7f9be24fad9f]
/lib64/libc.so.6(+0x7d098)[0x7f9be2502098]
/lib64/libglib-2.0.so.0(g_free+0xf)[0x7f9bdac7df7f]
/usr/lib64/gstreamer-1.0/libgstvideofilter.so(+0x5129)[0x7f9bb83dc129]
/lib64/libgstreamer-1.0.so.0(+0x5fe7b)[0x7f9bced48e7b]
/lib64/libgstreamer-1.0.so.0(+0x60666)[0x7f9bced49666]
/lib64/libgstreamer-1.0.so.0(+0x60ae8)[0x7f9bced49ae8]
/lib64/libgstreamer-1.0.so.0(+0x5eed2)[0x7f9bced47ed2]
/lib64/libgstreamer-1.0.so.0(gst_pad_push_event+0x378)[0x7f9bced52148]
/lib64/libgstbase-1.0.so.0(+0x34df6)[0x7f9bcc56cdf6]
/lib64/libgstreamer-1.0.so.0(+0x5fe7b)[0x7f9bced48e7b]
/lib64/libgstreamer-1.0.so.0(+0x60666)[0x7f9bced49666]
/lib64/libgstreamer-1.0.so.0(+0x60ae8)[0x7f9bced49ae8]
/lib64/libgstreamer-1.0.so.0(+0x5eed2)[0x7f9bced47ed2]
/lib64/libgstreamer-1.0.so.0(gst_pad_push_event+0x378)[0x7f9bced52148]
/lib64/libgstreamer-1.0.so.0(+0x692cf)[0x7f9bced522cf]
/lib64/libgstreamer-1.0.so.0(gst_pad_forward+0x1c7)[0x7f9bced4f187]
/lib64/libgstreamer-1.0.so.0(gst_pad_event_default+0xfe)[0x7f9bced4f2be]
/usr/lib64/gstreamer-1.0/libgstdeinterlace.so(+0xa76e)[0x7f9b9fdc676e]
/lib64/libgstreamer-1.0.so.0(+0x5fe7b)[0x7f9bced48e7b]
/lib64/libgstreamer-1.0.so.0(+0x60666)[0x7f9bced49666]
/lib64/libgstreamer-1.0.so.0(+0x60ae8)[0x7f9bced49ae8]
/lib64/libgstreamer-1.0.so.0(+0x5eed2)[0x7f9bced47ed2]
/lib64/libgstreamer-1.0.so.0(gst_pad_push_event+0x378)[0x7f9bced52148]
/lib64/libgstreamer-1.0.so.0(+0x692cf)[0x7f9bced522cf]
/lib64/libgstreamer-1.0.so.0(gst_pad_forward+0x1c7)[0x7f9bced4f187]
/lib64/libgstreamer-1.0.so.0(gst_pad_event_default+0xfe)[0x7f9bced4f2be]
/lib64/libgstreamer-1.0.so.0(+0x5fe7b)[0x7f9bced48e7b]
/lib64/libgstreamer-1.0.so.0(+0x60666)[0x7f9bced49666]
/lib64/libgstreamer-1.0.so.0(+0x60ae8)[0x7f9bced49ae8]
/lib64/libgstreamer-1.0.so.0(+0x5eed2)[0x7f9bced47ed2]
/lib64/libgstreamer-1.0.so.0(gst_pad_push_event+0x378)[0x7f9bced52148]
/lib64/libgstreamer-1.0.so.0(+0x692cf)[0x7f9bced522cf]
/lib64/libgstreamer-1.0.so.0(gst_pad_forward+0x1c7)[0x7f9bced4f187]
/lib64/libgstreamer-1.0.so.0(gst_pad_event_default+0xfe)[0x7f9bced4f2be]
/lib64/libgstreamer-1.0.so.0(+0x5fe7b)[0x7f9bced48e7b]
/lib64/libgstreamer-1.0.so.0(+0x60666)[0x7f9bced49666]
/lib64/libgstreamer-1.0.so.0(+0x60ae8)[0x7f9bced49ae8]
/lib64/libgstreamer-1.0.so.0(+0x5eed2)[0x7f9bced47ed2]
/lib64/libgstreamer-1.0.so.0(gst_pad_push_event+0x378)[0x7f9bced52148]
/lib64/libgstvideo-1.0.so.0(+0x20f7b)[0x7f9bccc30f7b]
/lib64/libgstvideo-1.0.so.0(gst_video_decoder_finish_frame+0x2e0)[0x7f9bccc34100]
/usr/lib64/gstreamer-1.0/libgstmpeg2dec.so(+0x404b)[0x7f9bc000904b]

(more listings)

Comment 2 Nicolas Dufresne (ndufresne) 2013-11-28 16:07:07 UTC

Looks like my fault again, it's in videoflip ...

Comment 3 Tim-Philipp Müller 2013-11-28 16:11:59 UTC

commit b8f689a9d97b7a90a3c40d5249c964e35a000b4a
Author: Tim-Philipp Müller <tim@centricular.com>
Date:   Thu Nov 28 16:09:04 2013 +0000

    videoflip: don't crash on tag events without orientation tag
    
    Would crash in g_free() trying to free an uninitialised pointer.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=719497

Comment 4 Nicolas Dufresne (ndufresne) 2013-11-28 17:04:43 UTC

And to redeem myself ...

commit 77833b886d1ac162cb75d749e3e4d912823cabd5
Author: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Date:   Thu Nov 28 11:58:42 2013 -0500

    videoflip: Add unit test for the 'automatic' method
    
    These new tests send a tag event before seding the buffer. Tested case are an
    empty tag list, a tag list with orientation-180 set and an invalid orientation value.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=719497