Bug 761505 – videoconvert / xvimagesink segment fault

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 761505 - videoconvert / xvimagesink segment fault


Summary:	videoconvert / xvimagesink segment fault


Status:	RESOLVED DUPLICATE of bug 767712

Product:	GStreamer
Classification:	Platform
Component:	gst-plugins-base
Version:	git master
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	git master
Assigned To:	GStreamer Maintainers
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2016-02-03 14:13 UTC by James Stevenson
Modified:	2016-06-30 06:25 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description James Stevenson 2016-02-03 14:13:42 UTC

When running 

gst-launch-1.0 -v videotestsrc num-buffers=2 ! videoconvert ! video/x-raw, format=GRAY8 ! videoconvert ! xvimagesink

I get a core. When I change xvimagesink to ximagesink. It seems to work perfectly fine.

when it cores I get the following stack trace

(gdb) bt

+ Trace 235947

#0 nanosleep
at ../sysdeps/unix/syscall-template.S line 81
#1 g_usleep
from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 fault_spin
at gst-launch.c line 112
#3 fault_handler_sighandler
at gst-launch.c line 93
#4 <signal handler called>
#5 ??
#6 video_orc_pack_BGRA
at tmp-orc.c line 4207
#7 video_converter_generic
at video-converter.c line 2848
#8 gst_video_convert_transform_frame
at gstvideoconvert.c line 692
#9 gst_video_filter_transform
at gstvideofilter.c line 271
#10 default_generate_output
at gstbasetransform.c line 2180
#11 gst_base_transform_chain
at gstbasetransform.c line 2333
#12 gst_pad_chain_data_unchecked
at gstpad.c line 4086
#13 gst_pad_push_data
at gstpad.c line 4338
#14 gst_pad_push
at gstpad.c line 4454
#15 gst_base_transform_chain
at gstbasetransform.c line 2369
#16 gst_pad_chain_data_unchecked
at gstpad.c line 4086
#17 gst_pad_push_data
at gstpad.c line 4338
#18 gst_pad_push
at gstpad.c line 4454
#19 gst_base_transform_chain
at gstbasetransform.c line 2369
#20 gst_pad_chain_data_unchecked
at gstpad.c line 4086
#21 gst_pad_push_data
at gstpad.c line 4338
#22 gst_pad_push
at gstpad.c line 4454
#23 gst_base_src_loop
at gstbasesrc.c line 2845
#24 gst_task_func
at gsttask.c line 331
#25 ??
from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#26 ??
from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#27 start_thread
at pthread_create.c line 333
#28 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 109


(gdb) p *convert
$3 = {
  flags = 0, 
  in_info = {
    finfo = 0x7fe42105d7b8 <formats+6008>, 
    interlace_mode = GST_VIDEO_INTERLACE_MODE_PROGRESSIVE, 
    flags = GST_VIDEO_FLAG_NONE, 
    width = 320, 
    height = 240, 
    size = 76800, 
    views = 1, 
    chroma_site = GST_VIDEO_CHROMA_SITE_UNKNOWN, 
    colorimetry = {
      range = GST_VIDEO_COLOR_RANGE_0_255, 
      matrix = GST_VIDEO_COLOR_MATRIX_BT601, 
      transfer = GST_VIDEO_TRANSFER_UNKNOWN, 
      primaries = GST_VIDEO_COLOR_PRIMARIES_UNKNOWN
    }, 
    par_n = 1, 
    par_d = 1, 
    fps_n = 30, 
    fps_d = 1, 
    offset = {0, 0, 0, 0}, 
    stride = {320, 0, 0, 0}, 
    ABI = {
      abi = {
        multiview_mode = GST_VIDEO_MULTIVIEW_MODE_NONE, 
        multiview_flags = GST_VIDEO_MULTIVIEW_FLAGS_NONE
      }, 
      _gst_reserved = {0xffffffff, 0x0, 0x0, 0x0}
    }
  }, 
  out_info = {
    finfo = 0x7fe42105c7c8 <formats+1928>, 
    interlace_mode = GST_VIDEO_INTERLACE_MODE_PROGRESSIVE, 
    flags = GST_VIDEO_FLAG_NONE, 
    width = 320, 
    height = 240, 
    size = 307200, 
    views = 1, 
    chroma_site = GST_VIDEO_CHROMA_SITE_UNKNOWN, 
    colorimetry = {
      range = GST_VIDEO_COLOR_RANGE_0_255, 
      matrix = GST_VIDEO_COLOR_MATRIX_RGB, 
      transfer = GST_VIDEO_TRANSFER_SRGB, 
      primaries = GST_VIDEO_COLOR_PRIMARIES_BT709
    }, 
    par_n = 1, 
    par_d = 1, 
    fps_n = 30, 
    fps_d = 1, 
    offset = {0, 0, 0, 0}, 
    stride = {1280, 0, 0, 0}, 
    ABI = {
      abi = {
        multiview_mode = GST_VIDEO_MULTIVIEW_MODE_NONE, 
        multiview_flags = GST_VIDEO_MULTIVIEW_FLAGS_NONE
      }, 
      _gst_reserved = {0xffffffff, 0x0, 0x0, 0x0}
    }
  }, 
  in_x = 0, 
  in_y = 0, 
  in_width = 320, 
  in_height = 240, 
  in_maxwidth = 320, 
  in_maxheight = 240, 
  out_x = 0, 
  out_y = 0, 
  out_width = 320, 
  out_height = 240, 
  out_maxwidth = 320, 
  out_maxheight = 240, 
  current_pstride = 4, 
  current_width = 320, 
  current_height = 240, 
  current_format = GST_VIDEO_FORMAT_ARGB, 
  current_bits = 8, 
  config = 0x7fe410002060, 
  tmpline = 0x0, 
  fill_border = 1, 
  borderline = 0x0, 
  borders = {0, 0, 0, 0}, 
  border_argb = 4278190080, 
  alpha_value = 255, 
  alpha_mode = ALPHA_MODE_NONE, 
  convert = 0x7fe420e02c00 <video_converter_generic>, 
  unpack_lines = 0x1640d80, 
  unpack_format = GST_VIDEO_FORMAT_AYUV, 
  unpack_bits = 8, 
  unpack_rgb = 0, 
  identity_unpack = 0, 
  unpack_pstride = 4, 
  upsample_lines = 0x0, 
  upsample = 0x0, 
  upsample_p = 0x0, 
  upsample_i = 0x0, 
  up_n_lines = 1, 
  up_offset = 0, 
  to_RGB_lines = 0x0, 
  to_RGB_matrix = {
    dm = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}}, 
    im = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}}, 
    width = 0, 
    orc_p1 = 0, 
    orc_p2 = 0, 
    orc_p3 = 0, 
    orc_p4 = 0, 
    t_r = 0x0, 
    t_g = 0x0, 
    t_b = 0x0, 
    t_c = 0, 
    matrix_func = 0x0
  }, 
  gamma_dec = {
    gamma_table = 0x0, 
    width = 0, 
    gamma_func = 0x0
  }, 
  hscale_lines = 0x0, 
  h_scaler = 0x0, 
  h_scale_format = 0, 
  vscale_lines = 0x0, 
  v_scaler = 0x0, 
  v_scaler_p = 0x0, 
  v_scaler_i = 0x0, 
  v_scale_width = 0, 
  v_scale_format = 0, 
  convert_lines = 0x1640de0, 
  convert_matrix = {
    dm = {{256.00001513957977, 0, 358.91202122569086, -45940.738716888431}, {256.00001513957977, -88.098894477540426, -182.81890007918494, 34677.477703260847}, {256.00001513957977, 
        453.63202682733532, 0, -58064.899433898921}, {0, 0, 0, 1}}, 
    im = {{256, 0, 359, -45941}, {256, -88, -183, 34677}, {256, 454, 0, -58065}, {0, 0, 0, 1}}, 
    width = 320, 
    orc_p1 = 0, 
    orc_p2 = 0, 
    orc_p3 = 0, 
    orc_p4 = 0, 
    t_r = 0x0, 
    t_g = 0x0, 
    t_b = 0x0, 
    t_c = 0, 
    matrix_func = 0x7fe420e00610 <video_converter_matrix8_AYUV_ARGB>
  }, 
  in_bits = 8, 
  out_bits = 8, 
  alpha_lines = 0x0, 
  alpha_func = 0x0, 
  gamma_enc = {
    gamma_table = 0x0, 
    width = 0, 
    gamma_func = 0x0
  }, 
  to_YUV_lines = 0x0, 
  to_YUV_matrix = {
    dm = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}}, 
    im = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}}, 
    width = 0, 
    orc_p1 = 0, 
    orc_p2 = 0, 
    orc_p3 = 0, 
    orc_p4 = 0, 
    t_r = 0x0, 
    t_g = 0x0, 
    t_b = 0x0, 
    t_c = 0, 
    matrix_func = 0x0
  }, 
  downsample_lines = 0x0, 
  downsample = 0x0, 
  downsample_p = 0x0, 
  downsample_i = 0x0, 
  down_n_lines = 1, 
  down_offset = 0, 
  dither_lines = 0x0, 
  dither = 0x0, 
  pack_lines = 0x1640de0, 
  pack_nlines = 1, 
  pack_format = GST_VIDEO_FORMAT_ARGB, 
  pack_bits = 8, 
  pack_rgb = 2, 
  identity_pack = 0, 
  pack_pstride = 4, 
  pack_pal = 0x0, 
  pack_palsize = 0, 
  src = 0x7fe41ed0d4f0, 
  dest = 0x7fe41ed0d790, 
  fformat = {GST_VIDEO_FORMAT_UNKNOWN, GST_VIDEO_FORMAT_UNKNOWN, GST_VIDEO_FORMAT_UNKNOWN, GST_VIDEO_FORMAT_UNKNOWN}, 
  fin_x = {0, 0, 0, 0}, 
  fin_y = {0, 0, 0, 0}, 
  fout_x = {0, 0, 0, 0}, 
  fout_y = {0, 0, 0, 0}, 
  fout_width = {0, 0, 0, 0}, 
  fout_height = {0, 0, 0, 0}, 
  fsplane = {0, 0, 0, 0}, 
  ffill = {0, 0, 0, 0}, 
  fh_scaler = {0x0, 0x0, 0x0, 0x0}, 
  fv_scaler = {0x0, 0x0, 0x0, 0x0}, 
  fconvert = {0x0, 0x0, 0x0, 0x0}


time asked for the output of orc-bugreport

Orc 0.4.24 - integrated testing tool
Active backend: sse
L1 cache: 32768
L2 cache: 262144
L3 cache: 8388608
Family/Model/Stepping: 6/94/3
CPU name: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz
Compiler options: sse2 sse3 ssse3 sse41 sse42 64bit 
Opcode test:
No errors detected.

Comment 1 Vincent Penquerc'h 2016-02-10 10:13:23 UTC

Works fine here (Linux 64 bit) with latest master, and is valgrind clean.
Orc 0.4.23.1, I'll update that on the off chance it's an Orc regression.

Comment 2 Vincent Penquerc'h 2016-02-10 10:17:22 UTC

Same results with Orc 0.4.24.1.
Do you still get the same crash with either:
- latest git master
- running with the env var ORC_CODE=debug

Comment 3 James Stevenson 2016-02-10 11:14:02 UTC

It will still crash when running with ORC_CODE=debug

Comment 4 Tim-Philipp Müller 2016-02-10 11:27:06 UTC

I think that should probably have been ORC_CODE=backup to see if it's caused by alignment issues or such.

Comment 5 Vincent Penquerc'h 2016-02-10 11:32:59 UTC

Oops, I meant that, yes, sorry.

Comment 6 James Stevenson 2016-02-10 11:44:49 UTC

I re-ran the tests with ORC_CODE=backup. Which cored in the same way in 1.6.3

This also cored in the current git-master version with and without ORC_CODE=backup being set.

Comment 7 Tim-Philipp Müller 2016-02-10 11:54:27 UTC

Ok, next step could you try running it in valgrind? (May need to run it on gstreamer/tools/.libs/lt-gst-launch-1.0)

Comment 8 James Stevenson 2016-02-10 12:39:33 UTC

Some valgrind output

ORC_CODE=debug valgrind ./gstreamer/tools/.libs/gst-launch-1.0 -v videotestsrc num-buffers=2 ! videoconvert ! video/x-raw, format=GRAY8 ! videoconvert ! xvimagesink
==14337== Memcheck, a memory error detector
==14337== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==14337== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==14337== Command: ./gstreamer/tools/.libs/gst-launch-1.0 -v videotestsrc num-buffers=2 ! videoconvert ! video/x-raw, format=GRAY8 ! videoconvert ! xvimagesink
==14337== 
Setting pipeline to PAUSED ...
Pipeline is PREROLLING ...
/GstPipeline:pipeline0/GstVideoTestSrc:videotestsrc0.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstVideoConvert:videoconvert0.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstCapsFilter:capsfilter0.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstVideoConvert:videoconvert1.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive\,\ format\=\(string\)BGRx"
/GstPipeline:pipeline0/GstXvImageSink:xvimagesink0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive\,\ format\=\(string\)BGRx"
/GstPipeline:pipeline0/GstVideoConvert:videoconvert1.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstCapsFilter:capsfilter0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstVideoConvert:videoconvert0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
==14337== Thread 3 videotestsrc0:sr:
==14337== Invalid write of size 8
==14337==    at 0x4036A67: ??? (in /run/user/1000/orcexec.cZ5fBJ)
==14337==    by 0x8B7B28D: video_orc_pack_BGRA (tmp-orc.c:4207)
==14337==    by 0x8B49F22: video_converter_generic (video-converter.c:2848)
==14337==    by 0x929D69B: gst_video_convert_transform_frame (gstvideoconvert.c:692)
==14337==    by 0x8B57EE5: gst_video_filter_transform (gstvideofilter.c:271)
==14337==    by 0x8DE5684: default_generate_output (gstbasetransform.c:2180)
==14337==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==14337==    by 0x8DE7C7C: gst_base_transform_chain (gstbasetransform.c:2369)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==14337==  Address 0x8884460 is 16 bytes inside a block of size 19 alloc'd
==14337==    at 0x4C2BBCF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14337==    by 0x5406578: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x94AA7FD: gst_xvimage_allocator_alloc (xvimageallocator.c:494)
==14337==    by 0x94A9987: xvimage_buffer_pool_alloc (xvimagepool.c:176)
==14337==    by 0x4E75E17: do_alloc_buffer.constprop.5 (gstbufferpool.c:268)
==14337==    by 0x4E760E2: default_acquire_buffer (gstbufferpool.c:1091)
==14337==    by 0x4E776F3: gst_buffer_pool_acquire_buffer (gstbufferpool.c:1199)
==14337==    by 0x8DE6D31: default_prepare_output_buffer (gstbasetransform.c:1661)
==14337==    by 0x8DE5593: default_generate_output (gstbasetransform.c:2151)
==14337==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==14337== 
==14337== Invalid write of size 8
==14337==    at 0x4036A59: ??? (in /run/user/1000/orcexec.cZ5fBJ)
==14337==    by 0x8B7B28D: video_orc_pack_BGRA (tmp-orc.c:4207)
==14337==    by 0x8B49F22: video_converter_generic (video-converter.c:2848)
==14337==    by 0x929D69B: gst_video_convert_transform_frame (gstvideoconvert.c:692)
==14337==    by 0x8B57EE5: gst_video_filter_transform (gstvideofilter.c:271)
==14337==    by 0x8DE5684: default_generate_output (gstbasetransform.c:2180)
==14337==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==14337==    by 0x8DE7C7C: gst_base_transform_chain (gstbasetransform.c:2369)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==14337==  Address 0x8884470 is 13 bytes after a block of size 19 alloc'd
==14337==    at 0x4C2BBCF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14337==    by 0x5406578: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x94AA7FD: gst_xvimage_allocator_alloc (xvimageallocator.c:494)
==14337==    by 0x94A9987: xvimage_buffer_pool_alloc (xvimagepool.c:176)
==14337==    by 0x4E75E17: do_alloc_buffer.constprop.5 (gstbufferpool.c:268)
==14337==    by 0x4E760E2: default_acquire_buffer (gstbufferpool.c:1091)
==14337==    by 0x4E776F3: gst_buffer_pool_acquire_buffer (gstbufferpool.c:1199)
==14337==    by 0x8DE6D31: default_prepare_output_buffer (gstbasetransform.c:1661)
==14337==    by 0x8DE5593: default_generate_output (gstbasetransform.c:2151)
==14337==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==14337== 
==14337== Jump to the invalid address stated on the next line
==14337==    at 0xFF919191FF919191: ???
==14337==    by 0x8B7AFBD: video_orc_unpack_GRAY8 (tmp-orc.c:3877)
==14337==    by 0x8B49A42: do_unpack_lines (video-converter.c:2519)
==14337==    by 0x8B49BC9: gst_line_cache_get_lines (video-converter.c:418)
==14337==    by 0x8B4A3D3: do_convert_lines (video-converter.c:2643)
==14337==    by 0x8B49BC9: gst_line_cache_get_lines (video-converter.c:418)
==14337==    by 0x8B49E6A: video_converter_generic (video-converter.c:2840)
==14337==    by 0x929D69B: gst_video_convert_transform_frame (gstvideoconvert.c:692)
==14337==    by 0x8B57EE5: gst_video_filter_transform (gstvideofilter.c:271)
==14337==    by 0x8DE5684: default_generate_output (gstbasetransform.c:2180)
==14337==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==14337==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==14337==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==14337==  Address 0xff919191ff919191 is not stack'd, malloc'd or (recently) free'd
==14337== 
Caught SIGSEGV
==14337== Thread 1:
==14337== Invalid read of size 4
==14337==    at 0x5400ADE: g_main_context_check (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x540118F: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x5401571: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x4E79B18: gst_bus_poll (gstbus.c:1153)
==14337==    by 0x4047E7: event_loop (gst-launch.c:532)
==14337==    by 0x403788: main (gst-launch.c:1074)
==14337==  Address 0xffebebebffebebeb is not stack'd, malloc'd or (recently) free'd
==14337== 
==14337== 
==14337== Process terminating with default action of signal 11 (SIGSEGV)
==14337==  General Protection Fault
==14337==    at 0x5400ADE: g_main_context_check (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x540118F: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x5401571: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x4E79B18: gst_bus_poll (gstbus.c:1153)
==14337==    by 0x4047E7: event_loop (gst-launch.c:532)
==14337==    by 0x403788: main (gst-launch.c:1074)
==14337== 
==14337== HEAP SUMMARY:
==14337==     in use at exit: 1,402,453 bytes in 15,176 blocks
==14337==   total heap usage: 61,227 allocs, 46,051 frees, 23,210,433 bytes allocated
==14337== 
==14337== LEAK SUMMARY:
==14337==    definitely lost: 2,060 bytes in 10 blocks
==14337==    indirectly lost: 0 bytes in 0 blocks
==14337==      possibly lost: 5,940 bytes in 64 blocks
==14337==    still reachable: 1,309,885 bytes in 14,808 blocks
==14337==                       of which reachable via heuristic:
==14337==                         length64           : 392 bytes in 8 blocks
==14337==                         newarray           : 1,616 bytes in 21 blocks
==14337==         suppressed: 0 bytes in 0 blocks
==14337== Rerun with --leak-check=full to see details of leaked memory
==14337== 
==14337== For counts of detected and suppressed errors, rerun with: -v
==14337== ERROR SUMMARY: 5781 errors from 4 contexts (suppressed: 0 from 0)

Comment 9 Vincent Penquerc'h 2016-02-10 17:12:42 UTC

==14337==  Address 0x8884460 is 16 bytes inside a block of size 19 alloc'd
==14337==    at 0x4C2BBCF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14337==    by 0x5406578: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==14337==    by 0x94AA7FD: gst_xvimage_allocator_alloc (xvimageallocator.c:494)
==14337==    by 0x94A9987: xvimage_buffer_pool_alloc (xvimagepool.c:176)

That seems very odd. That line allocates the image buffer, and 19 seems low.
Can you run with GST_DEBUG=2,xv*:5 and attach the log of that please ?

Comment 10 James Stevenson 2016-02-11 10:44:14 UTC

Output from

GST_DEBUG=2,xv*:5 ORC_CODE=debug valgrind ./gstreamer/tools/.libs/gst-launch-1.0 -v videotestsrc num-buffers=2 ! videoconvert name=first ! video/x-raw, format=GRAY8 ! queue ! videoconvert name=second ! xvimagesink


==27693== Memcheck, a memory error detector
==27693== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==27693== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==27693== Command: ./gstreamer/tools/.libs/gst-launch-1.0 -v videotestsrc num-buffers=2 ! videoconvert name=first ! video/x-raw, format=GRAY8 ! queue ! videoconvert name=second ! xvimagesink
==27693== 
Setting pipeline to PAUSED ...
0:00:01.253846610 27693      0x87b8890 DEBUG            xvimagesink xvimagesink.c:1746:gst_xv_image_sink_open:<xvimagesink0> set calculated PAR on object's PAR
0:00:01.266707054 27693      0x87b8890 DEBUG            xvimagesink xvimagesink.c:610:gst_xv_image_sink_manage_event_thread:<xvimagesink0> run xevent thread, expose 1, events 1
Pipeline is PREROLLING ...
/GstPipeline:pipeline0/GstVideoTestSrc:videotestsrc0.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstVideoConvert:first.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstCapsFilter:capsfilter0.GstPad:src: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstQueue:queue0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
/GstPipeline:pipeline0/GstCapsFilter:capsfilter0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
0:00:01.572801217 27693      0x87bc6c0 DEBUG            xvimagesink xvimagesink.c:705:gst_xv_image_sink_setcaps:<xvimagesink0> In setcaps. Possible caps video/x-raw, format=(string)YUY2, width=(int)[ 1, 8192 ], height=(int)[ 1, 8192 ], framerate=(fraction)[ 0/1, 2147483647/1 ]; video/x-raw, format=(string)UYVY, width=(int)[ 1, 8192 ], height=(int)[ 1, 8192 ], framerate=(fraction)[ 0/1, 2147483647/1 ]; video/x-raw, format=(string)BGRx, width=(int)[ 1, 8192 ], height=(int)[ 1, 8192 ], framerate=(fraction)[ 0/1, 2147483647/1 ], setting caps video/x-raw, width=(int)320, height=(int)240, framerate=(fraction)30/1, pixel-aspect-ratio=(fraction)1/1, interlace-mode=(string)progressive, format=(string)BGRx
/GstPipeline:pipeline0/GstCapsFilter:capsfilter0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
0:00:01.579853660 27693      0x87bc6c0 DEBUG            xvimagesink xvimagesink.c:748:gst_xv_image_sink_setcaps:<xvimagesink0> video width/height: 320x240, calculated display ratio: 4/3
/GstPipeline:pipeline0/GstVideoConvert:first.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
0:00:01.581012194 27693      0x87bc6c0 DEBUG            xvimagesink xvimagesink.c:757:gst_xv_image_sink_setcaps:<xvimagesink0> keeping video height
0:00:01.582176102 27693      0x87bc6c0 DEBUG            xvimagesink xvimagesink.c:773:gst_xv_image_sink_setcaps:<xvimagesink0> scaling to 320x240
/GstPipeline:pipeline0/GstXvImageSink:xvimagesink0.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive\,\ format\=\(string\)BGRx"
0:00:01.619628038 27693      0x87bc6c0 DEBUG            xvimagesink xvimagesink.c:1069:gst_xv_image_sink_propose_allocation:<xvimagesink0> create new pool
/GstPipeline:pipeline0/GstVideoConvert:second.GstPad:sink: caps = "video/x-raw\,\ width\=\(int\)320\,\ height\=\(int\)240\,\ framerate\=\(fraction\)30/1\,\ format\=\(string\)GRAY8\,\ pixel-aspect-ratio\=\(fraction\)1/1\,\ interlace-mode\=\(string\)progressive"
0:00:01.916671597 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:364:gst_xvimage_allocator_alloc:<xvimageallocator0> creating image 0x88ef700 (320x240) cropped 0x0-320x240
0:00:01.921391342 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:503:gst_xvimage_allocator_alloc:<xvimageallocator0> memory 0x88f0500, align 15, offset 0
0:00:01.922853857 27693      0x87bc6c0 DEBUG            xvimagepool xvimagepool.c:186:xvimage_buffer_pool_alloc:<xvimagebufferpool1> adding GstVideoMeta
0:00:01.925998845 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:157:gst_xvimage_allocator_free:<xvimageallocator0> free memory 0x88ef700
0:00:01.926768784 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:364:gst_xvimage_allocator_alloc:<xvimageallocator0> creating image 0x88f1970 (320x240) cropped 0x0-320x240
0:00:01.927135744 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:503:gst_xvimage_allocator_alloc:<xvimageallocator0> memory 0x88f2770, align 15, offset 0
0:00:01.927258882 27693      0x87bc6c0 DEBUG            xvimagepool xvimagepool.c:186:xvimage_buffer_pool_alloc:<xvimagebufferpool1> adding GstVideoMeta
0:00:01.927356213 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:157:gst_xvimage_allocator_free:<xvimageallocator0> free memory 0x88f1970
0:00:01.927910466 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:364:gst_xvimage_allocator_alloc:<xvimageallocator0> creating image 0x88f3be0 (320x240) cropped 0x0-320x240
0:00:01.928390464 27693      0x87bc6c0 DEBUG       xvimageallocator xvimageallocator.c:503:gst_xvimage_allocator_alloc:<xvimageallocator0> memory 0x88f49e0, align 15, offset 0
0:00:01.928555197 27693      0x87bc6c0 DEBUG            xvimagepool xvimagepool.c:186:xvimage_buffer_pool_alloc:<xvimagebufferpool1> adding GstVideoMeta
==27693== Thread 3 queue0:src:
==27693== Invalid write of size 8
==27693==    at 0x4036A67: ??? (in /run/user/1000/orcexec.ThdDHi)
==27693==    by 0x8B7B28D: video_orc_pack_BGRA (tmp-orc.c:4207)
==27693==    by 0x8B49F22: video_converter_generic (video-converter.c:2848)
==27693==    by 0x929D69B: gst_video_convert_transform_frame (gstvideoconvert.c:692)
==27693==    by 0x8B57EE5: gst_video_filter_transform (gstvideofilter.c:271)
==27693==    by 0x8DE5684: default_generate_output (gstbasetransform.c:2180)
==27693==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==27693==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==27693==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==27693==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==27693==    by 0x94CE918: gst_queue_push_one (gstqueue.c:1340)
==27693==    by 0x94CE918: gst_queue_loop (gstqueue.c:1487)
==27693==    by 0x4ED9D70: gst_task_func (gsttask.c:331)
==27693==    by 0x54282FD: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==27693==  Address 0x88f49f0 is 16 bytes inside a block of size 19 alloc'd
==27693==    at 0x4C2BBCF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==27693==    by 0x5406578: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==27693==    by 0x97067FD: gst_xvimage_allocator_alloc (xvimageallocator.c:494)
==27693==    by 0x9705987: xvimage_buffer_pool_alloc (xvimagepool.c:176)
==27693==    by 0x4E75E17: do_alloc_buffer.constprop.5 (gstbufferpool.c:268)
==27693==    by 0x4E760E2: default_acquire_buffer (gstbufferpool.c:1091)
==27693==    by 0x4E776F3: gst_buffer_pool_acquire_buffer (gstbufferpool.c:1199)
==27693==    by 0x8DE6D31: default_prepare_output_buffer (gstbasetransform.c:1661)
==27693==    by 0x8DE5593: default_generate_output (gstbasetransform.c:2151)
==27693==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==27693==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==27693==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==27693==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==27693== 
==27693== Invalid write of size 8
==27693==    at 0x4036A59: ??? (in /run/user/1000/orcexec.ThdDHi)
==27693==    by 0x8B7B28D: video_orc_pack_BGRA (tmp-orc.c:4207)
==27693==    by 0x8B49F22: video_converter_generic (video-converter.c:2848)
==27693==    by 0x929D69B: gst_video_convert_transform_frame (gstvideoconvert.c:692)
==27693==    by 0x8B57EE5: gst_video_filter_transform (gstvideofilter.c:271)
==27693==    by 0x8DE5684: default_generate_output (gstbasetransform.c:2180)
==27693==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==27693==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==27693==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==27693==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==27693==    by 0x94CE918: gst_queue_push_one (gstqueue.c:1340)
==27693==    by 0x94CE918: gst_queue_loop (gstqueue.c:1487)
==27693==    by 0x4ED9D70: gst_task_func (gsttask.c:331)
==27693==    by 0x54282FD: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==27693==  Address 0x88f4a00 is 13 bytes after a block of size 19 alloc'd
==27693==    at 0x4C2BBCF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==27693==    by 0x5406578: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4600.2)
==27693==    by 0x97067FD: gst_xvimage_allocator_alloc (xvimageallocator.c:494)
==27693==    by 0x9705987: xvimage_buffer_pool_alloc (xvimagepool.c:176)
==27693==    by 0x4E75E17: do_alloc_buffer.constprop.5 (gstbufferpool.c:268)
==27693==    by 0x4E760E2: default_acquire_buffer (gstbufferpool.c:1091)
==27693==    by 0x4E776F3: gst_buffer_pool_acquire_buffer (gstbufferpool.c:1199)
==27693==    by 0x8DE6D31: default_prepare_output_buffer (gstbasetransform.c:1661)
==27693==    by 0x8DE5593: default_generate_output (gstbasetransform.c:2151)
==27693==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==27693==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==27693==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==27693==    by 0x4EAF232: gst_pad_push (gstpad.c:4526)
==27693== 
==27693== Jump to the invalid address stated on the next line
==27693==    at 0xFF515151FF515151: ???
==27693==    by 0x8B7AFBD: video_orc_unpack_GRAY8 (tmp-orc.c:3877)
==27693==    by 0x8B49A42: do_unpack_lines (video-converter.c:2519)
==27693==    by 0x8B49BC9: gst_line_cache_get_lines (video-converter.c:418)
==27693==    by 0x8B4A3D3: do_convert_lines (video-converter.c:2643)
==27693==    by 0x8B49BC9: gst_line_cache_get_lines (video-converter.c:418)
==27693==    by 0x8B49E6A: video_converter_generic (video-converter.c:2840)
==27693==    by 0x929D69B: gst_video_convert_transform_frame (gstvideoconvert.c:692)
==27693==    by 0x8B57EE5: gst_video_filter_transform (gstvideofilter.c:271)
==27693==    by 0x8DE5684: default_generate_output (gstbasetransform.c:2180)
==27693==    by 0x8DE7B95: gst_base_transform_chain (gstbasetransform.c:2333)
==27693==    by 0x4EA6EF2: gst_pad_chain_data_unchecked (gstpad.c:4155)
==27693==    by 0x4EA6EF2: gst_pad_push_data (gstpad.c:4407)
==27693==  Address 0xff515151ff515151 is not stack'd, malloc'd or (recently) free'd
==27693== 
Caught SIGSEGV

+ Trace 235960

#0 ??
#1 ??
#2 ??
#3 ??
#4 ??
#5 ??

Comment 11 Edward Hervey 2016-02-22 07:41:42 UTC

Works fine for me in master. Can you recheck and confirm ?

Comment 12 James Stevenson 2016-02-22 11:45:48 UTC

Yes I can confirm it still happens. This seems specific to ubuntu 15.10 on a skylake intel i7. This does not happen on an identical system also running ubuntu 15.10 with an nvidia card. So it may be some graphics driver issue in xwindows.


In fact I have traced it down to a specific part of the code. It looks like the XvCreateImage is returning a really short buffer

See below (note that data_size = 4) in the returned value from XvCreateImage

Breakpoint 1, gst_xvimage_allocator_alloc (allocator=0x670b80, im_format=406996818, padded_width=320, padded_height=240, 
    crop=crop@entry=0x7fffe40103ac, error=error@entry=0x7ffff3584840) at xvimageallocator.c:487
487	    mem->xvimage = XvCreateImage (context->disp,
(gdb) list
482	        mem->SHMInfo.shmid, mem->SHMInfo.shmseg);
483	  } else
484	  no_xshm:
485	#endif /* HAVE_XSHM */
486	  {
487	    mem->xvimage = XvCreateImage (context->disp,
488	        context->xv_port_id, im_format, NULL, padded_width, padded_height);
489	    if (!mem->xvimage || error_caught)
490	      goto create_failed;
491	
(gdb) p mem->xvimage
$1 = (XvImage *) 0x0
(gdb) n
370	  handler = XSetErrorHandler (gst_xvimage_handle_xerror);
(gdb) p mem->xvimage
$2 = (XvImage *) 0x0
(gdb) n
487	    mem->xvimage = XvCreateImage (context->disp,
(gdb) 
489	    if (!mem->xvimage || error_caught)
(gdb) p mem->xvimage
$3 = (XvImage *) 0x0
(gdb) n
487	    mem->xvimage = XvCreateImage (context->disp,
(gdb) 
489	    if (!mem->xvimage || error_caught)
(gdb) p mem->xvimage
$4 = (XvImage *) 0x7fffe400a500
(gdb) p *mem->xvimage
$5 = {id = 406996818, width = 320, height = 240, data_size = 4, num_planes = 1, pitches = 0x7fffe400a538, 
  offsets = 0x7fffe400a53c, data = 0x0, obdata = 0x0}
(gdb) p padded_width
$6 = 320
(gdb) p padded_height
$7 = 240

The next code that is executed is then to allocate the buffer based on data_size. But for something like GRAY8 I would expect this to be at least (320 * 240)

   /* we have to use the returned data_size for our image size */
    align = 15;                 /* g_malloc aligns to 8, we need 16 */
    mem->xvimage->data = g_malloc (mem->xvimage->data_size + align);

    XSync (context->disp, FALSE);


The other part I have considers that may be incorrect is the im_format parameter in the call to XvCreateImage. I am not sure what a sensible value looks like for an im_format I am not familiar with x windows programming at all.

p *mem
$10 = {parent = {mini_object = {type = 7630384, refcount = 0, lockstate = 0, flags = 0, copy = 0x0, dispose = 0x0, 
      free = 0x0, n_qdata = 0, qdata = 0x0}, allocator = 0x0, parent = 0x0, maxsize = 0, align = 0, offset = 0, 
    size = 0}, im_format = 406996818, crop = {x = 0, y = 0, w = 320, h = 240}, xvimage = 0x7fffe400a500}

Comment 13 Edward Hervey 2016-02-22 12:17:40 UTC

What version are you using ? This seems to be fixed in current master (pretty much the same as the 1.7.2 release from yesterday).

Comment 14 James Stevenson 2016-02-22 13:42:02 UTC

I am using the current versions of git. Which I updated this morning.

Output from

for i in * ; do echo -n "$i " ; (cd $i ; git rev-parse HEAD) ; done

gst-libav 81934eaf90cea01088f2dca6fa9aa43dcc50e250
gst-plugins-bad 18ac9d239e940b7627b37cf7645bf4050de4e17e
gst-plugins-base a62c7bd54c9361196dc6e4e9a5fefea0cb6a6893
gst-plugins-good 7150b89c59b22e2b73d2926ed7ac0d35dfd3b9e5
gst-plugins-ugly f1bb44460dafff9cafaa198923f0bade944ead01
gstreamer fefd65fea074f17ec07e9593e9a23d1c53a07dcc

Comment 15 Edward Hervey 2016-02-22 14:45:33 UTC

I'm on a Fedora 23 with a "Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz" and I'm not getting this issue. I'm suspecting it's indeed a xwindow driver issue...

Could you attach the output of xvinfo ?

Comment 16 James Stevenson 2016-02-23 13:04:55 UTC

Output from xvinfo

X-Video Extension version 2.2
screen #0
  Adaptor #0: "Intel(R) Video Sprite"
    number of ports: 1
    port base: 77
    operations supported: PutImage 
    supported visuals:
      depth 24, visualID 0x20
    number of attributes: 2
      "XV_COLORKEY" (range 0 to 16777215)
              client settable attribute
              client gettable attribute (current value is 526352)
      "XV_ALWAYS_ON_TOP" (range 0 to 1)
              client settable attribute
              client gettable attribute (current value is 0)
    maximum XvImage size: 8192 x 8192
    Number of image formats: 3
      id: 0x32595559 (YUY2)
        guid: 59555932-0000-0010-8000-00aa00389b71
        bits per pixel: 16
        number of planes: 1
        type: YUV (packed)
      id: 0x59565955 (UYVY)
        guid: 55595659-0000-0010-8000-00aa00389b71
        bits per pixel: 16
        number of planes: 1
        type: YUV (packed)
      id: 0x18424752
        guid: 50415353-5448-524f-5547-485247423234
        bits per pixel: 32
        number of planes: 1
        type: RGB (packed)
        depth: 24
        red, green, blue masks: 0xff0000, 0xff00, 0xff

Comment 17 Tim-Philipp Müller 2016-05-22 19:21:50 UTC

Looks like a bug in the driver then, doesn't it?

Perhaps we should add some sanity checking though..

Comment 18 Tim-Philipp Müller 2016-05-22 19:22:46 UTC

Also, it's using/allocating RGBx here, so size should be even larger.

Comment 19 Duncan Palmer 2016-06-30 01:55:52 UTC

This seems to be a duplicate of https://bugzilla.gnome.org/show_bug.cgi?id=767712 . I've uploaded a patch there to add some sanity checking on RGB pixel formats, and error out on sanity check failure, so we don't end up with a segfault.

Comment 20 Sebastian Dröge (slomo) 2016-06-30 06:25:19 UTC

Yes, let's track it there as there is a patch

*** This bug has been marked as a duplicate of bug 767712 ***