Bug 669993

Summary: crash in ucil_rawavi_encode_thread() when resolution is changed
Product: [Fedora] Fedora Reporter: Dimitris Kalamaras <dimitris.kalamaras>
Component: libucilAssignee: Robert Scheck <redhat-bugzilla>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 19CC: kdudka, redhat-bugzilla
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:2aab619342a26d08511ebe991e98bcf52b4128f0
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-02-18 13:31:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
File: backtrace none

Description Dimitris Kalamaras 2011-01-16 15:24:27 UTC 
abrt version: 1.1.14
architecture: x86_64
Attached file: backtrace
cmdline: ucview
component: ucview
crash_function: g_main_context_check
executable: /usr/bin/ucview
kernel: 2.6.35.10-74.fc14.x86_64
package: ucview-0.33-1.fc14
rating: 4
reason: Process /usr/bin/ucview was killed by signal 11 (SIGSEGV)
release: Fedora release 14 (Laughlin)
time: 1295191359
uid: 500

How to reproduce
-----
1. Opened UCView
2. Recorded a video
3. Then clicked on menu Device -> Change Device. 

I just changed the resolution to 640x480, pressed OK, then crashed.
Comment 1 Dimitris Kalamaras 2011-01-16 15:24:30 UTC 
Created attachment 473713 [details]
File: backtrace
Comment 2 Kamil Dudka 2011-01-16 16:31:26 UTC 
Thank you for reporting the bug!  What was the resolution before you changed it to 640x480?  Does it crash if you start with lower resolution and then switch to higher resolution?

Possibly related upstream threads:

http://unicap-imaging.org/forums/viewtopic.php?f=8&t=77
http://unicap-imaging.org/forums/viewtopic.php?f=6&t=211
Comment 3 Dimitris Kalamaras 2011-01-16 18:57:52 UTC 
The initial video resolution was (and still is) 320x240. 

I changed that to 640x480 and pressed OK. 

The crash occured  when I clicked on the red record button.

It happens every time I do this. It doesn't even matter if I had recorded something previously. 

So the right procedure to reproduce this bug:
-----
1. Open UCView
2. Click on menu Device -> Change Device. 
3. Change the resolution to 640x480, press OK
4. Click on the record button. 

Crash.
Comment 4 Kamil Dudka 2011-01-16 21:21:09 UTC 
It crashes here:

http://bazaar.launchpad.net/~arne-datafloater/unicap/trunk/view/head:/libucil/src/ucil_rawavi.c?start_revid=104#L118

For whatever reason (__u32*)( avibuf->bData + chunkptr + 4 ) is either out-of-range or invalid.
Comment 5 Kamil Dudka 2011-01-16 21:26:07 UTC 
If the bt is reliable, then chunkptr is zero and avibuf likely valid.  I suspect that avibuf->bData is a dangling pointer.
Comment 6 Kamil Dudka 2011-01-16 21:53:48 UTC 
Could you run it through gdb and print the content of *buffer and *avibuf after the crash?
Comment 7 Dimitris Kalamaras 2011-01-17 20:01:43 UTC 
Please advise, how to run it through gdb.

What package I need to install and what command to issue.
Comment 8 Kamil Dudka 2011-01-17 20:33:30 UTC 
(In reply to comment #7)
> Please advise, how to run it through gdb.

$ gdb ucview
(gdb) run
...
    [do whatever you need to the, in order to trigger the crash]
...

(gdb) backtrace
(gdb) frame 15
(gdb) print *buffer
(gdb) print *avibuf

> What package I need to install and what command to issue.

The 'gdb' package should be sufficient:

# yum install gdb

I guess abrt has already managed to install the necessary debuginfo.  If not, you can install it as follows:

# yum install yum-utils
# debuginfo-install ucview

Thanks in advance!
Comment 9 Dimitris Kalamaras 2011-01-17 21:28:38 UTC 
Here you go:

[dimitris@vaio ~]$  gdb ucview
GNU gdb (GDB) Fedora (7.2-26.fc14)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/ucview...Reading symbols from /usr/lib/debug/usr/bin/ucview.debug...done.
done.
(gdb) run
Starting program: /usr/bin/ucview 
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff0def700 (LWP 3818)]
[New Thread 0x7fffe78d8700 (LWP 3819)]
[New Thread 0x7fffe70d7700 (LWP 3820)]
[New Thread 0x7fffe66d1700 (LWP 3821)]
[Thread 0x7fffe66d1700 (LWP 3821) exited]
[New Thread 0x7fffe66d1700 (LWP 3822)]
[Thread 0x7fffe66d1700 (LWP 3822) exited]

(ucview:3815): GConf-CRITICAL **: gconf_client_set_string: assertion `val != NULL' failed
search module path: /home/dimitris/.ucview/plugins
search module path: /usr/lib64/ucview/plugins
[New Thread 0x7fffe66d1700 (LWP 3823)]
[New Thread 0x7fffe5cca700 (LWP 3824)]
[Thread 0x7fffe78d8700 (LWP 3819) exited]
[Thread 0x7fffe66d1700 (LWP 3823) exited]
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
[New Thread 0x7fffe66d1700 (LWP 3825)]
[New Thread 0x7fffe78d8700 (LWP 3826)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe78d8700 (LWP 3826)]
0x0000003fb1a68904 in fwrite () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install ORBit2-2.14.19-1.fc14.x86_64 PackageKit-gtk-module-0.6.11-1.fc14.x86_64 alsa-lib-1.0.23-2.fc14.x86_64 alsa-plugins-pulseaudio-1.0.22-1.fc13.x86_64 dbus-glib-0.86-4.fc14.x86_64 dbus-libs-1.4.0-2.fc14.x86_64 expat-2.0.1-10.fc13.x86_64 flac-1.2.1-6.fc12.x86_64 gamin-0.1.10-8.fc14.x86_64 gtk2-engines-2.20.1-2.fc14.x86_64 gvfs-1.6.6-1.fc14.x86_64 ibus-gtk2-1.3.9-2.fc14.x86_64 ibus-libs-1.3.9-2.fc14.x86_64 libICE-1.0.6-2.fc13.x86_64 libSM-1.1.0-7.fc12.x86_64 libX11-1.3.4-3.fc14.x86_64 libXau-1.0.6-1.fc14.x86_64 libXcomposite-0.4.2-1.fc14.x86_64 libXcursor-1.1.10-5.fc14.x86_64 libXdamage-1.1.3-1.fc14.x86_64 libXext-1.1.2-2.fc14.x86_64 libXfixes-4.0.5-1.fc14.x86_64 libXi-1.3.2-1.fc14.x86_64 libXinerama-1.1-2.fc13.x86_64 libXrandr-1.3.0-5.fc13.x86_64 libXrender-0.9.6-1.fc14.x86_64 libXtst-1.0.99.2-3.fc12.x86_64 libXv-1.0.5-1.fc13.x86_64 libasyncns-0.8-1.fc13.x86_64 libcanberra-0.25-4.fc14.x86_64 libcanberra-gtk2-0.25-4.fc14.x86_64 libgcc-4.5.1-4.fc14.x86_64 libogg-1.2.0-1.fc14.x86_64 libraw1394-2.0.5-2.fc14.x86_64 libselinux-2.0.96-6.fc14.1.x86_64 libsndfile-1.0.23-1.fc14.x86_64 libtdb-1.2.1-3.fc14.x86_64 libtheora-1.1.1-1.fc13.x86_64 libtool-ltdl-2.2.10-3.fc14.x86_64 libudev-161-8.fc14.x86_64 libuuid-2.18-4.6.fc14.x86_64 libv4l-0.8.1-1.fc14.x86_64 libvorbis-1.3.1-2.fc14.x86_64 libxcb-1.7-1.fc14.x86_64 pixman-0.18.4-1.fc14.x86_64 pulseaudio-libs-0.9.21-7.fc14.x86_64 tcp_wrappers-libs-7.6-59.fc14.x86_64 zlib-1.2.5-2.fc14.x86_64
(gdb) backtrace
#0  0x0000003fb1a68904 in fwrite () from /lib64/libc.so.6
#1  0x00007ffff7bc18b6 in avi_write_buffer (f=<value optimized out>, buffer=<value optimized out>) at ucil_rawavi.c:321
#2  0x00007ffff7bc1967 in ucil_rawavi_encode_thread (vobj=0xa0de60) at ucil_rawavi.c:122
#3  0x0000003fb1e06d5b in start_thread () from /lib64/libpthread.so.0
#4  0x0000003fb1ae4a7d in clone () from /lib64/libc.so.6
(gdb) frame 15
#0  0x0000000000000000 in ?? ()
(gdb) print *buffer
$1 = 0 '\000'
(gdb) print *avibuf
No symbol "avibuf" in current context.
(gdb) 



Is this useful?
Comment 10 Kamil Dudka 2011-01-17 21:51:42 UTC 
In this case, please replace 'frame 15' in the howto above by 'frame 2'.  Frame #2 is here the frame corresponding to ucil_rawavi_encode_thread().  I didn't realize the signal handler would not appear in the backtrace when running though gdb.
Comment 11 Dimitris Kalamaras 2011-01-17 22:08:52 UTC 
Okay, here you go:

[dimitris@vaio ~]$  gdb ucview
GNU gdb (GDB) Fedora (7.2-26.fc14)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/ucview...Reading symbols from /usr/lib/debug/usr/bin/ucview.debug...done.
done.
(gdb) run
Starting program: /usr/bin/ucview 
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff0def700 (LWP 4560)]
[New Thread 0x7fffe78d8700 (LWP 4561)]
[New Thread 0x7fffe70d7700 (LWP 4562)]
[New Thread 0x7fffe68d6700 (LWP 4563)]
[New Thread 0x7fffe60d5700 (LWP 4564)]
[New Thread 0x7fffe58d4700 (LWP 4565)]
[New Thread 0x7fffe50d3700 (LWP 4566)]
[New Thread 0x7fffcffff700 (LWP 4567)]
[Thread 0x7fffcffff700 (LWP 4567) exited]
[New Thread 0x7fffcffff700 (LWP 4568)]
[Thread 0x7fffcffff700 (LWP 4568) exited]

(ucview:4557): GConf-CRITICAL **: gconf_client_set_string: assertion `val != NULL' failed
search module path: /home/dimitris/.ucview/plugins
search module path: /usr/lib64/ucview/plugins
[New Thread 0x7fffcffff700 (LWP 4569)]
[New Thread 0x7fffcf5f8700 (LWP 4570)]
[Thread 0x7fffe68d6700 (LWP 4563) exited]
[Thread 0x7fffe78d8700 (LWP 4561) exited]
[Thread 0x7fffe50d3700 (LWP 4566) exited]
[Thread 0x7fffe58d4700 (LWP 4565) exited]
[Thread 0x7fffe70d7700 (LWP 4562) exited]
[New Thread 0x7fffe70d7700 (LWP 4571)]
[Thread 0x7fffe70d7700 (LWP 4571) exited]
[Thread 0x7fffcffff700 (LWP 4569) exited]
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
libv4l2: error dequeuing buf: Invalid argument
[New Thread 0x7fffcffff700 (LWP 4572)]
[New Thread 0x7fffe70d7700 (LWP 4573)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe70d7700 (LWP 4573)]
g_list_prepend (list=0xa0cfa0, data=0xa62260) at glist.c:298
298		list->prev->next = new_list;
Missing separate debuginfos, use: debuginfo-install ORBit2-2.14.19-1.fc14.x86_64 PackageKit-gtk-module-0.6.11-1.fc14.x86_64 alsa-lib-1.0.23-2.fc14.x86_64 alsa-plugins-pulseaudio-1.0.22-1.fc13.x86_64 dbus-glib-0.86-4.fc14.x86_64 dbus-libs-1.4.0-2.fc14.x86_64 expat-2.0.1-10.fc13.x86_64 flac-1.2.1-6.fc12.x86_64 gamin-0.1.10-8.fc14.x86_64 gtk2-engines-2.20.1-2.fc14.x86_64 gvfs-1.6.6-1.fc14.x86_64 ibus-gtk2-1.3.9-2.fc14.x86_64 ibus-libs-1.3.9-2.fc14.x86_64 libICE-1.0.6-2.fc13.x86_64 libSM-1.1.0-7.fc12.x86_64 libX11-1.3.4-3.fc14.x86_64 libXau-1.0.6-1.fc14.x86_64 libXcomposite-0.4.2-1.fc14.x86_64 libXcursor-1.1.10-5.fc14.x86_64 libXdamage-1.1.3-1.fc14.x86_64 libXext-1.1.2-2.fc14.x86_64 libXfixes-4.0.5-1.fc14.x86_64 libXi-1.3.2-1.fc14.x86_64 libXinerama-1.1-2.fc13.x86_64 libXrandr-1.3.0-5.fc13.x86_64 libXrender-0.9.6-1.fc14.x86_64 libXtst-1.0.99.2-3.fc12.x86_64 libXv-1.0.5-1.fc13.x86_64 libasyncns-0.8-1.fc13.x86_64 libcanberra-0.25-4.fc14.x86_64 libcanberra-gtk2-0.25-4.fc14.x86_64 libgcc-4.5.1-4.fc14.x86_64 libogg-1.2.0-1.fc14.x86_64 libraw1394-2.0.5-2.fc14.x86_64 libselinux-2.0.96-6.fc14.1.x86_64 libsndfile-1.0.23-1.fc14.x86_64 libtdb-1.2.1-3.fc14.x86_64 libtheora-1.1.1-1.fc13.x86_64 libtool-ltdl-2.2.10-3.fc14.x86_64 libudev-161-8.fc14.x86_64 libuuid-2.18-4.6.fc14.x86_64 libv4l-0.8.1-1.fc14.x86_64 libvorbis-1.3.1-2.fc14.x86_64 libxcb-1.7-1.fc14.x86_64 pixman-0.18.4-1.fc14.x86_64 pulseaudio-libs-0.9.21-7.fc14.x86_64 tcp_wrappers-libs-7.6-59.fc14.x86_64 zlib-1.2.5-2.fc14.x86_64
(gdb) backtrace
#0  g_list_prepend (list=0xa0cfa0, data=0xa62260) at glist.c:298
#1  0x0000003fb3652b21 in g_queue_push_head (queue=0x7fffdc00ca80, data=<value optimized out>) at gqueue.c:296
#2  0x00007ffff7bc198e in ucil_rawavi_encode_thread (vobj=0x98ee00) at ucil_rawavi.c:128
#3  0x0000003fb1e06d5b in start_thread () from /lib64/libpthread.so.0
#4  0x0000003fb1ae4a7d in clone () from /lib64/libc.so.6
(gdb) frame 2
#2  0x00007ffff7bc198e in ucil_rawavi_encode_thread (vobj=0x98ee00) at ucil_rawavi.c:128
128	      g_queue_push_head( vobj->empty_queue, buffer );
(gdb) print *buffer
$1 = {format = {
    identifier = "YUV 4:2:2 (YUYV) ( YUYV )\000\000\000\000\000\360?\002", '\000' <repeats 13 times>, "$@", '\000' <repeats 62 times>, "$@", '\000' <repeats 15 times>, size = {x = 0, y = 0, width = 640, height = 480}, min_size = {x = 0, y = 0, width = 160, height = 120}, max_size = {x = 0, y = 0, width = 640, height = 480}, 
    h_stepping = 0, v_stepping = 0, sizes = 0x6c9660, size_count = 4, bpp = 16, fourcc = 1448695129, flags = UNICAP_FLAGS_SIGNIFICANT_BITS_ALL, buffer_types = 0, 
    system_buffer_count = 0, buffer_size = 614400, buffer_type = UNICAP_BUFFER_TYPE_SYSTEM}, frame_number = 2137123936, fill_time = {tv_sec = 7794, tv_usec = 125403}, 
  duration = {tv_sec = 0, tv_usec = 4607182418800017408}, capture_start_time = {tv_sec = 4635752128936148992, tv_usec = 4628293042053316608}, 
  data = 0xc29c00 "R\207RuT\203SxS\202TzS\203R}T\204T}U\204XzV\202VxW\201VxX\200ZyX\204ZyZ\205ZzZ\204ZzZ\203TzX\203W{W\203W}V\203W}X\203Y|Z\202Y|Z\200[{Z\200Z{Y\177Z{]~\\|]\177]|\\\201Z|Z\205Z~]\206\\\177`\205^}]\204]y_\204Zy[\206\\z]\205b{^\203a{b\202c{b\202`|`\205`|^\205e{d\202fya\206by_\207`y`\206`xa\204b|a\201b}b\203b}a\204`{b\204_z]\203\\z[\201Zz[\203ZzR\205TyK\207Qy"..., buffer_size = 614400, type = UNICAP_BUFFER_TYPE_USER, flags = 0, reserved = {0, 1072693248, 0, 3226828800, 0, 3225092096, 
    0}}
(gdb) print *avibuf
$2 = {dwBufferSize = 38424, dwPtr = 0, bData = 0x9b9520 "00dc"}
(gdb) 



Hope this helps :)
Comment 12 Kamil Dudka 2011-01-18 12:16:34 UTC 
Thanks.  It looks crazy.  You gave me three different backtraces.  The first (provided by abrt) shows the crash at ucil_rawavi.c:118, the second crashes at ucil_rawavi.c:122 and the last one crashes at ucil_rawavi.c:128.  I tend to think that the crash in fact occurs in some other thread, or at least is caused by work of another thread.
Comment 13 abrt-bot 2012-03-30 14:11:47 UTC 
Backtrace analysis found this bug to be similar to bug #699927, closing as duplicate. This bug seems to belong to component gtk2.

Bugs which were found to be similar to this bug: 
  bluefish: bug #695111
  evolution: bug #661543
  gnome-media: bug #564193
  gnome-packagekit: bug #615760
  gnome-settings-daemon: bug #699927
  synce-trayicon: bug #564199

This comment is automatically generated.

*** This bug has been marked as a duplicate of bug 699927 ***
Comment 14 Kamil Dudka 2012-04-02 08:06:07 UTC 
(In reply to comment #13)
> Backtrace analysis found this bug to be similar to bug #699927, closing as
> duplicate. This bug seems to belong to component gtk2.

Nonsense.  This is not a gtk2 bug.  Reopening.
Comment 15 Fedora End Of Life 2013-04-03 20:14:08 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19
Comment 16 Fedora End Of Life 2015-01-09 21:46:54 UTC 
This message is a notice that Fedora 19 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 19. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained. Approximately 4 (four) weeks from now this bug will
be closed as EOL if it remains open with a Fedora 'version' of '19'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 19 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 17 Fedora End Of Life 2015-02-18 13:31:08 UTC 
Fedora 19 changed to end-of-life (EOL) status on 2015-01-06. Fedora 19 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.