Bug 470686

Summary:	libpulse segfaults on invalidated **environ.
Product:	[Fedora] Fedora	Reporter:	leigh scott <leigh123linux>
Component:	pulseaudio	Assignee:	Lennart Poettering <lpoetter>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	gauret, kevin, lkundrak, lpoetter, pierre-bugzilla, rdieter, udovdh
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-12-08 22:53:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description leigh scott 2008-11-08 21:06:14 UTC

Description of problem: xine-lib-pulseaudio causes xine to Segmentation fault


Version-Release number of selected component (if applicable):

xine-lib-pulseaudio-1.1.15-3.fc10.x86_64.rpm

How reproducible:

xine crashes every time if xine-lib-pulseaudio is installed


Steps to Reproduce:
1.
2.
3.
  
Actual results:

with xine-lib-pulseaudio xine crashes


Expected results:



Additional info:

[leigh@localhost ~]$ xine
This is xine (X11 gui) - a free video player v0.99.5.
(c) 2000-2007 The xine Team.
Segmentation fault
[leigh@localhost ~]$

Comment 1 Rex Dieter 2008-11-08 21:18:24 UTC

xine crash -> xine bug (!= xine-lib), unless there is evidence to the contrary.

Comment 2 leigh scott 2008-11-09 11:51:23 UTC

If I remove xine-lib-pulseaudio xine runs OK  .

This sort of reply puts me off reporting bug .

Comment 3 Rex Dieter 2008-11-09 13:15:12 UTC

Sorry, but xine crashing really is a *xine* bug, unless, as I said, there is evidence to the contrary.  Now, as xine isn't shipped by/in fedora, not much we can do to test this.  

My implicit suggestion was to report this to wherever/whomever you got xine from.

Comment 4 leigh scott 2008-11-09 14:18:33 UTC

Sorry Rex , I thought the xine-ui package was provided by fedora.



close(7)                                = 0
open("/home/leigh/.pulse/client.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/pulse/client.conf", O_RDONLY) = 7
fstat(7, {st_mode=S_IFREG|0644, st_size=1184, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f618523b000
read(7, "# This file is part of PulseAudio"..., 4096) = 1184
read(7, ""..., 4096)                    = 0
close(7)                                = 0
munmap(0x7f618523b000, 4096)            = 0
open("/dev/shm/", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 7
fstat(7, {st_mode=S_IFDIR|S_ISVTX|0777, st_size=80, ...}) = 0
getdents(7, /* 4 entries */, 4096)      = 128
statfs("/dev/shm/", {f_type=0x1021994, f_bsize=4096, f_blocks=128267, f_bfree=128245, f_bavail=128245, f_files=128267, f_ffree=128264, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
futex(0x3d2de08320, FUTEX_WAKE_PRIVATE, 2147483647) = 0
open("/dev/shm/pulse-shm-3149937787", O_RDONLY|O_NOFOLLOW|O_CLOEXEC) = 8
fcntl(8, F_GETFD)                       = 0x1 (flags FD_CLOEXEC)
fstat(8, {st_mode=S_IFREG|0400, st_size=67108904, ...}) = 0
mmap(NULL, 67108904, PROT_READ, MAP_SHARED, 8, 0) = 0x7f618123b000
close(8)                                = 0
kill(7674, SIG_0)                       = -1 ESRCH (No such process)
munmap(0x7f618123b000, 67108904)        = 0
unlink("/dev/shm/pulse-shm-3149937787") = 0
open("/dev/shm/pulse-shm-2429004095", O_RDONLY|O_NOFOLLOW|O_CLOEXEC) = 8
fstat(8, {st_mode=S_IFREG|0400, st_size=67108904, ...}) = 0
mmap(NULL, 67108904, PROT_READ, MAP_SHARED, 8, 0) = 0x7f618123b000
close(8)                                = 0
kill(3136, SIG_0)                       = 0
munmap(0x7f618123b000, 67108904)        = 0
getdents(7, /* 0 entries */, 4096)      = 0
close(7)                                = 0
open("/dev/urandom", O_RDONLY|O_NOCTTY) = 7
read(7, "|\256\203\26"..., 4)           = 4
close(7)                                = 0
open("/dev/shm/pulse-shm-377728636", O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW|O_CLOEXEC, 0400) = 7
ftruncate(7, 67108904)                  = 0
mmap(NULL, 67108904, PROT_READ|PROT_WRITE, MAP_SHARED, 7, 0) = 0x7f618123b000
close(7)                                = 0
uname({sys="Linux", node="localhost.localdomain", ...}) = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 7
fcntl(7, F_GETFD)                       = 0
fcntl(7, F_SETFD, FD_CLOEXEC)           = 0
setsockopt(7, SOL_SOCKET, SO_PRIORITY, [6], 4) = 0
fcntl(7, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(7, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
connect(7, {sa_family=AF_FILE, path="/home/leigh/.pulse/ff1c932e9ab2af6f85c1461148afd388:runtime/native"...}, 110) = 0
sendto(6, "W"..., 1, MSG_NOSIGNAL, NULL, 0) = -1 ENOTSOCK (Socket operation on non-socket)
write(6, "W"..., 1)                     = 1
gettimeofday({1226239537, 367856}, NULL) = 0
write(6, "W"..., 1)                     = 1
futex(0x2a0a6a0, FUTEX_UNLOCK_PI, 262743855960) = 0
futex(0x2a0a824, FUTEX_WAIT_PRIVATE, 1, NULL <unfinished ...>
+++ killed by SIGSEGV +++
[leigh@localhost ~]$ 


I got xine from rpmfusion.

Comment 5 leigh scott 2008-11-09 14:32:10 UTC

I have filed a bug against xine @ rpmfusion

https://bugzilla.rpmfusion.org/show_bug.cgi?id=125

Comment 6 Rex Dieter 2008-11-09 17:15:43 UTC

Thanks.

Comment 7 udo 2008-12-04 18:50:49 UTC

Errors I got:

xine[16384]: segfault at 0 ip 00000000015cf3b6 sp 00007fb34aa1aa10 error 4 in libpulse.so.0.7.0[1575000+77000]
xine[16390]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f428db36a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[16401]: segfault at 0 ip 00000039b5a5a3b6 sp 00007fb4dd118a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
SELinux: initialized (dev fuse, type fuse), uses genfs_contexts
xine[18611]: segfault at 0 ip 00000039b5a5a3b6 sp 00007fe33af89a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[18652]: segfault at 0 ip 00000039b5a5a3b6 sp 00007fd61868ba10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[18662]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f228d1a1a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19746]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f6c51b1ca10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19768]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f469a73fa10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19781]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f757119ca10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19795]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f44d3b51a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19841]: segfault at 0 ip 00000039b5a5a3b6 sp 00007fdd68cd1a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19872]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f1f3e791a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[19886]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f22bf6f1a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[20507]: segfault at 0 ip 00000039b5a5a3b6 sp 00007fccb5916a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[20526]: segfault at 0 ip 00000039b5a5a3b6 sp 00007f615fa18a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]
xine[20851]: segfault at 0 ip 00007f423d1a33b6 sp 00007f422c681a10 error 4 in libpulse.so.0.7.0[7f423d149000+77000]
xine[20866]: segfault at 0 ip 00007fe0aa2d13b6 sp 00007fe0997afa10 error 4 in libpulse.so.0.7.0[7fe0aa277000+77000]
xine[20879]: segfault at 0 ip 00000039b5a5a3b6 sp 00007fee87558a10 error 4 in libpulse.so.0.7.0[39b5a00000+77000]


After rpm -e xine-lib-pulseaudio stuff was fine. (!?)

Comment 8 Rex Dieter 2008-12-04 19:20:47 UTC

Interesting, looks like libpulse,  I'll try to generate another backtrace.

Comment 9 Rex Dieter 2008-12-04 19:28:19 UTC

Lennart, does this tickle anything?

> gdb xine
...
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f29825a9950 (LWP 24571)]
0x00007f298323a3b6 in pa_init_proplist (p=0x25c1800) at pulsecore/proplist-util.c:47
47          for (e = environ; *e; e++) {
(gdb) backtrace
#0  0x00007f298323a3b6 in pa_init_proplist (p=0x25c1800) at pulsecore/proplist-util.c:47
#1  0x00007f29831ecb69 in setup_complete_callback (pd=0x25c9a10, command=2, tag=1, t=0x25c9980, userdata=0x25c1710)
    at pulse/context.c:464
#2  0x00007f2983228b81 in run_action (pd=0x25c9a10, r=0x25c2eb0, command=2, ts=0x25c9980) at pulsecore/pdispatch.c:183
#3  0x00007f2983228eb3 in pa_pdispatch_run (pd=0x25c9a10, packet=0x25c9950, creds=0x25c2420, userdata=0x25c1710)
    at pulsecore/pdispatch.c:234
#4  0x00007f29831ec1aa in pstream_packet_callback (p=0x25c22d0, packet=0x25c9950, creds=0x25c2420, userdata=0x25c1710)
    at pulse/context.c:323
#5  0x00007f298322c715 in do_read (p=0x25c22d0) at pulsecore/pstream.c:816
#6  0x00007f2983229d48 in do_something (p=0x25c22d0) at pulsecore/pstream.c:184
#7  0x00007f2983229f57 in io_callback (io=0x25c9900, userdata=0x25c22d0) at pulsecore/pstream.c:213
#8  0x00007f298321b706 in callback (m=0x25c13d8, e=0x25c9820, fd=11, f=PA_IO_EVENT_INPUT, userdata=0x25c9900)
    at pulsecore/iochannel.c:119
#9  0x00007f29831fa1e7 in dispatch_pollfds (m=0x25c1380) at pulse/mainloop.c:683
#10 0x00007f29831faea2 in pa_mainloop_dispatch (m=0x25c1380) at pulse/mainloop.c:896
#11 0x00007f29831fb027 in pa_mainloop_iterate (m=0x25c1380, block=1, retval=0x0) at pulse/mainloop.c:926
#12 0x00007f29831fb08a in pa_mainloop_run (m=0x25c1380, retval=0x0) at pulse/mainloop.c:941
#13 0x00007f298320a0a2 in thread (userdata=0x25c1160) at pulse/thread-mainloop.c:90
#14 0x00007f298323b201 in internal_thread_func (userdata=0x25c1500) at pulsecore/thread-posix.c:72
#15 0x00007f29967903da in start_thread (arg=<value optimized out>) at pthread_create.c:297
#16 0x00007f2996a8c27d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

Comment 10 udo 2008-12-05 17:59:30 UTC

FYI: I am on fc10, fresh install, x86_64.
Can I provide more info?
Please also have a look at the rpmfusion bugreport.

Comment 11 Lennart Poettering 2008-12-08 22:53:10 UTC


*** This bug has been marked as a duplicate of bug 473080 ***