Description of problem: Player that uses gstreamer (Rhythmbox/Totem) crashes. Version-Release number of selected component (if applicable): gstreamer-0.10.9-2 How reproducible: seldom Steps to Reproduce: It appeared always while i was playing with "Next/Previous" buttons in Rhythmbox/Totem Actual results: SIGSEGV Additional info: see bt attached
Created attachment 138239 [details] GDB backtrace
We believe that the crash only exists with this specific file. Could you please attach the file you were playing when this happened?
Tim believes this is fixed in GStreamer CVS: http://webcvs.freedesktop.org/gstreamer/gst-plugins-base/ext/ogg/gstoggdemux.c?r1=1.158&r2=1.159
Here is a list of short movies on which i managed to reproduce the bug: http://commons.wikimedia.org/wiki/Image:A_wasp_eating_a_fly_DSCN2741.ogg http://commons.wikimedia.org/wiki/Image:Apollo_15_launch.ogg http://commons.wikimedia.org/wiki/Image:Bonnie_and_Clyde_death_scene.ogg http://commons.wikimedia.org/wiki/Image:Hurricane_Jeanne_2004.ogg http://commons.wikimedia.org/wiki/Image:Superconstellation_movie.ogg Playing around with B,N,Left and Right keys.
Any chance for you to test the patch?
Tested it, bug is still there. Versions: gstreamer-0.10.10-2.fc6 gstreamer-debuginfo-0.10.10-2.fc6 gstreamer-plugins-base-0.10.10-1.fc6 gstreamer-plugins-base-debuginfo-0.10.10-1.fc6 gstreamer-plugins-fluendo-0.10-6 gstreamer-plugins-good-0.10.4-1.fc6 gstreamer-plugins-good-debuginfo-0.10.4-1.fc6 gstreamer-tools-0.10.10-2.fc6
Created attachment 143158 [details] latest crash bt
Could you also attach the full output of GST_DEBUG=*.5 totem *.ogg when you reproduce the problem?
Created attachment 143166 [details] GST_DEBUG output (last 1000 lines)
did it help at all ? the whole output is rather long :)
Right, this is very old, and I think it's caused by libtheora as per bug 232179. Let me know if it's still a problem.
(In reply to comment #12) > Right, this is very old, and I think it's caused by libtheora as per bug 232179. > Let me know if it's still a problem. Yes, this sounds very much like the libtheora memory corruption bug, which is fixed in F-7 (through updates) and F-8, since FC-6 is end of life I'm closing this as won't fix.