Bug 902037 - vlc segfault in dvdnav_describe_title_chapters () from /lib64/libdvdnav.so.4 when trying to play a DVD
Summary: vlc segfault in dvdnav_describe_title_chapters () from /lib64/libdvdnav.so.4 ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libdvdnav
Version: 19
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Dominik 'Rathann' Mierzejewski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-20 15:10 UTC by Marek
Modified: 2014-01-05 06:06 UTC (History)
5 users (show)

Fixed In Version: libdvdnav-4.2.1-1.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-12-24 03:38:45 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
gdb trace from segfault (11.42 KB, text/plain)
2013-01-20 15:10 UTC, Marek
no flags Details
Patch to fix nr_of_cells == 0 in pgc (486 bytes, patch)
2013-08-10 07:57 UTC, Matt Hirsch
no flags Details | Diff
Corrected patch to fix nr_of_cells == 0 in pgc (493 bytes, patch)
2013-08-10 08:12 UTC, Matt Hirsch
no flags Details | Diff
srpm with zerocells patch applied (118.04 KB, application/octet-stream)
2013-08-10 08:14 UTC, Matt Hirsch
no flags Details
gdb trace from segfault with Matt's patched libdvdnav (7.75 KB, text/plain)
2013-08-12 16:14 UTC, Marek
no flags Details

Description Marek 2013-01-20 15:10:49 UTC
Created attachment 683621 [details]
gdb trace from segfault

Description of problem: When trying to play a DVD using vlc, vlc segfaults. Some DVDs work, this one ("Cars" (2006), region 2) doesn't. "Dragon player" can play it though; maybe it's not using dvdnav_describe_title_chapters()?


Version-Release number of selected component (if applicable): libdvdnav-4.2.0-2.fc17


How reproducible: vlc /dev/sr0


Steps to Reproduce:
1. Insert DVD "Cars"
2. Select "Open with VLC media player", or in a terminal execute "vlc /dev/sr0" 
3. segfault
  
Actual results: Segfault.


Expected results: Movie starts.


Additional info: Attached trace from gdb.

Comment 1 Fedora End Of Life 2013-07-03 22:14:37 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 2 Marek 2013-07-09 18:46:43 UTC
Still segfaults on Fedora 19 / vlc-2.0.7-1.fc19.x86_64 + libdvdnav-4.2.0-4.fc19.x86_64

(gdb) r /dev/sr0
...
libdvdread: Found 20 VTS's
libdvdread: Elapsed time 0
Please send bug report - no VTS_TMAPT ?? 
Please send bug report - no VTS_TMAPT ?? 
Please send bug report - no VTS_TMAPT ?? 
Please send bug report - no VTS_TMAPT ?? 

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffec175700 (LWP 32017)]
0x00007ffff0c52fd3 in dvdnav_describe_title_chapters () from /lib64/libdvdnav.so.4
(gdb) bt
#0  0x00007ffff0c52fd3 in dvdnav_describe_title_chapters () from /lib64/libdvdnav.so.4
#1  0x00007ffff0e657aa in Open () from /usr/lib64/vlc/plugins/access/libdvdnav_plugin.so
#2  0x0000003701c84db0 in vlc_module_load () from /lib64/libvlccore.so.5
#3  0x0000003701c434a8 in demux_New () from /lib64/libvlccore.so.5
#4  0x0000003701c4feac in InputSourceInit () from /lib64/libvlccore.so.5
#5  0x0000003701c50db8 in Init () from /lib64/libvlccore.so.5
#6  0x0000003701c544b6 in Run () from /lib64/libvlccore.so.5
#7  0x0000003702807c53 in start_thread () from /lib64/libpthread.so.0
#8  0x00000037020f513d in clone () from /lib64/libc.so.6
(gdb)

Comment 3 Marek 2013-07-09 18:55:54 UTC
Maybe Fedora could apply the patches described in http://lists.mplayerhq.hu/pipermail/dvdnav-discuss/2012-August/001753.html thread?

Comment 4 Matt Hirsch 2013-08-10 07:57:17 UTC
Created attachment 785105 [details]
Patch to fix nr_of_cells == 0 in pgc

This seems to be a problem with Disney DVDs (E.g. ran into this with "Oz").

I found some old dvdnav patches here:
http://www.fabiankeil.de/sourcecode/libdvdnav-4.2.0-combined-fixes.diff

All but one of these has been applied to Fedora libdvdnav. Guess which one solves this problem...

Anyway, I've created a condensed patch against the current libdvdnav rpm in Fedora 19. I don't know why that one patch has not been applied, or what side effects it may have, but after applying this patch and rebuilding I can watch the questionable and purposely broken dvd in vlc.

Comment 5 Matt Hirsch 2013-08-10 08:12:37 UTC
Created attachment 785107 [details]
Corrected patch to fix nr_of_cells == 0 in pgc

Well, slightly embarrassing.. I was hacking around in my rpmbuild directory, and generated the previous patch against a modified version of searching.c. Here's a patch that applies cleanly to libdvdnav-4.2.0-4.fc19.src.rpm.

Comment 6 Matt Hirsch 2013-08-10 08:14:03 UTC
Created attachment 785117 [details]
srpm with zerocells patch applied

And for kicks, here's the srpm with the patch applied.

Comment 7 Marek 2013-08-12 16:14:03 UTC
Created attachment 785772 [details]
gdb trace from segfault with Matt's patched libdvdnav

Hi Matt, I installed your patched version of libdvdnav but unfortunately vlc still segfaults in dvdnav_describe_title_chapters() :-(

Trace from gdb attached.

Comment 8 Matt Hirsch 2013-08-12 17:02:06 UTC
That's too bad. Are you running the latest version of libdvdread? The problem I was seeing was that pgc was NULL. Here, you have a valid pgc block with corrupted data. 

The reason I ask about libdvdread is that there are some patches there that try to set invalid pgc blocks to NULL. I'm currently running a libdvdread with this patch applied:

http://lists.mplayerhq.hu/pipermail/dvdnav-discuss/2012-October/001777.html

If you want to try that, I can send you an srpm for that as well, but I don't have access to it at the moment.

Comment 9 Marek 2013-08-12 20:28:49 UTC
I'm on an up to date F19 with libdvdread-4.2.0-4.fc19.x86_64. 

I know nothing about libdvdread/libdvdnav but it looks to me like something is rewriting the memory in pgc so it ends up pointing to invalid memory address. Or pgc->cell_playback[cellnr-1] is actually beyond allocated memory for that array. But I'm just guessing from what I saw in gdb...

I can always try the patched libdvdread :-)

Comment 10 Simo Sorce 2013-08-19 16:04:45 UTC
I got the came trace and I found a bug that I think matches this segfault.
I posted a patch here:
http://lists.mplayerhq.hu/pipermail/dvdnav-discuss/2013-August/001939.html

I see this is basically equivalent to the patch in comment 5, and I know my patch fixes my segfualt issue.

Can we get a koji build with those patches ?

Comment 11 Dominik 'Rathann' Mierzejewski 2013-09-09 22:31:36 UTC
http://koji.fedoraproject.org/koji/taskinfo?taskID=5915727

Build in progress, please check once finished.

Comment 12 Simo Sorce 2013-09-09 22:38:28 UTC
Works perfectly, thanks a lot.

Comment 13 Fedora Update System 2013-12-20 08:31:36 UTC
libdvdnav-4.2.1-1.fc20,libdvdread-4.2.1-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/libdvdnav-4.2.1-1.fc20,libdvdread-4.2.1-1.fc20

Comment 14 Fedora Update System 2013-12-20 08:31:47 UTC
libdvdnav-4.2.1-1.fc19,libdvdread-4.2.1-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/libdvdnav-4.2.1-1.fc19,libdvdread-4.2.1-1.fc19

Comment 15 Fedora Update System 2013-12-21 02:22:16 UTC
Package libdvdnav-4.2.1-1.fc20, libdvdread-4.2.1-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libdvdnav-4.2.1-1.fc20 libdvdread-4.2.1-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-23723/libdvdnav-4.2.1-1.fc20,libdvdread-4.2.1-1.fc20
then log in and leave karma (feedback).

Comment 16 Fedora Update System 2013-12-24 03:38:45 UTC
libdvdnav-4.2.1-1.fc20, libdvdread-4.2.1-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Fedora Update System 2014-01-05 06:06:17 UTC
libdvdnav-4.2.1-1.fc19, libdvdread-4.2.1-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.