GNOME Bugzilla – Bug 603515
segment seek event sent to decodebin2 causes segfault in libmp3lame.so.0
Last modified: 2009-12-02 17:11:44 UTC
Created attachment 148844 [details] Vala source The attached program tries to loop a file by repeatedly doing a segment seek. Occasionally (maybe one of 5 tries) the first seek causes a segmentation fault in libmp3lame.so.0 (see attached backtrace). I'm using the GStreamer packages that come with Ubuntu Karmic Koala (gstreamer0.10-plugins-base 0.10.25-2ubuntu1.1, gstreamer0.10-plugins-good 0.10.16-1ubuntu3, gstreamer0.10-plugins-bad 0.10.14-4ubuntu1, gstreamer0.10-plugins-ugly 0.10.12-1). The installed lame package is libmp3lame0 3.98.2+debian-0ubuntu2. I attached the Vala source written by myself as well as the C source generated by the Vala compiler.
Created attachment 148845 [details] C source, generated by valac
Created attachment 148847 [details] backtrace (copied from gdb)
By "looping a file" I meant playing an audio file in an endless loop and sending the result to an MP3-encoded file (whether .mp3 or .flv, doesn't matter).
Created attachment 148898 [details] A better trace This time, a useful trace.
Created attachment 148906 [details] Backtrace using "lamemp3enc" instead of "lame" I replaced the "lame" element with a "lamemp3enc" element, with the same result. Backtrace attached.
Created attachment 148908 [details] Trace using "thread apply all bt"
Created attachment 148915 [details] Complete trace (with debug info enabled in gstreamer and lame)
Created attachment 148916 [details] [review] avoid the crash
Module: gst-plugins-ugly Branch: master Commit: 82ab87032d46ca92eb4262e2340dffb0d7fad15e URL: http://cgit.freedesktop.org/gstreamer/gst-plugins-ugly/commit/?id=82ab87032d46ca92eb4262e2340dffb0d7fad15e Author: Thiago Santos <thiago.sousa.santos@collabora.co.uk> Date: Wed Dec 2 11:21:22 2009 -0300 lame: Avoid crash when seeking before negotiating lame's 'lgv' variable is only initialized when the caps is negotiated, whenever a seek happens before that, it would attempt to call a function on an empty pointer, causing the crash. Fixes #603515
Review of attachment 148916 [details] [review]: Commited with an additional line of comment for the reason of the condition.