Bug 195668 - Dragon player crash with corrupted mpg file
Summary: Dragon player crash with corrupted mpg file
Status: RESOLVED UPSTREAM
Alias: None
Product: dragonplayer
Classification: Applications
Component: general (show other bugs)
Version: unspecified
Platform: Unlisted Binaries Linux
: NOR crash
Target Milestone: ---
Assignee: Dragon Player Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-06-08 14:28 UTC by Nils Kassube
Modified: 2009-07-21 14:52 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
Corrupt mpg file (126.00 KB, video/mpeg)
2009-07-21 08:47 UTC, Nils Kassube
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Nils Kassube 2009-06-08 14:28:16 UTC
Application that crashed: dragon
Version of the application: 2.0
KDE Version: 4.2.90 (KDE 4.2.90 (KDE 4.3 Beta2))
Qt Version: 4.5.1
Operating System: Linux 2.6.30-8-generic i686
Distribution: Ubuntu karmic (development branch)

What I was doing when the application crashed:
I have a corrupted movie file which was recorded from DVB-T with Kaffeine (KDE3). I made an excerpt from the file with avidemux. If I play that file with dragon player it crashes reproducibly. It also crashes Kaffeine 0.8.7.

 -- Backtrace:
Application: Dragon Player (dragon), signal: Aborted
[Current thread is 0 (LWP 5484)]

Thread 10 (Thread 0xb6739b90 (LWP 5490)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x030d9412 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0x085535b4 in pthread_cond_timedwait () from /lib/tls/i686/cmov/libc.so.6
#3  0x0016dae3 in metronom_sync_loop (this=0x9fa7d88) at metronom.c:870
#4  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 9 (Thread 0xb5b2db90 (LWP 5491)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x0853ca21 in select () from /lib/tls/i686/cmov/libc.so.6
#2  0x001977d6 in xine_usec_sleep (usec=1000) at utils.c:481
#3  0x0017b4a0 in video_out_loop (this_gen=0x9fa8878) at video_out.c:1246
#4  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 8 (Thread 0xb532cb90 (LWP 5492)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x08539d57 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0x06a11b5b in IA__g_poll (fds=0xa3bfc70, nfds=1, timeout=219) at /build/buildd/glib2.0-2.21.1/glib/gpoll.c:127
#3  0x06a04eab in g_main_context_iterate (context=0xa3c1328, block=<value optimized out>, dispatch=1, self=0xa3bb3c8) at /build/buildd/glib2.0-2.21.1/glib/gmain.c:2758
#4  0x06a051a3 in IA__g_main_context_iteration (context=0xa3c1328, may_block=1) at /build/buildd/glib2.0-2.21.1/glib/gmain.c:2508
#5  0x00a8cfd7 in QEventDispatcherGlib::processEvents (this=0x9f4f0a8, flags={i = 36}) at kernel/qeventdispatcher_glib.cpp:326
#6  0x00a600a9 in QEventLoop::processEvents (this=0xb532c2c4, flags=) at kernel/qeventloop.cpp:149
#7  0x00a604f2 in QEventLoop::exec (this=0xb532c2c4, flags={i = 0}) at kernel/qeventloop.cpp:200
#8  0x0096be13 in QThread::exec (this=0xa3c0030) at thread/qthread.cpp:487
#9  0x03beb1aa in Phonon::Xine::XineThread::run (this=0xa3c0030) at ../../xine/xinethread.cpp:143
#10 0x0096f0fe in QThreadPrivate::start (arg=0xa3c0030) at thread/qthread_unix.cpp:189
#11 0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#12 0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 7 (Thread 0xb0b28b90 (LWP 5498)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x0853409b in read () from /lib/tls/i686/cmov/libc.so.6
#2  0x09bc28e2 in ?? () from /usr/lib/libasound.so.2
#3  0x09bbf6cd in snd_ctl_read () from /usr/lib/libasound.so.2
#4  0x09bbbaaf in snd_hctl_handle_events () from /usr/lib/libasound.so.2
#5  0x09bc78c1 in snd_mixer_handle_events () from /usr/lib/libasound.so.2
#6  0x068f4b69 in ao_alsa_handle_event_thread (data=0xa3cd2d8) at audio_alsa_out.c:175
#7  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#8  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 6 (Thread 0xb0327b90 (LWP 5499)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x030d90e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0x0855355d in pthread_cond_wait () from /lib/tls/i686/cmov/libc.so.6
#3  0x0017ed8e in ao_loop (this_gen=0xa3eb248) at audio_out.c:348
#4  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 5 (Thread 0xafae4b90 (LWP 5500)):
[KCrash Handler]
#6  0x001d7422 in __kernel_vsyscall ()
#7  0x0848b770 in raise () from /lib/tls/i686/cmov/libc.so.6
#8  0x0848d138 in abort () from /lib/tls/i686/cmov/libc.so.6
#9  0x01e8a457 in mpeg2_decode_data (mpeg2dec=0xa5ec980, 
    current=0xb4a3cb70 "B\235n\024dC\005D@9g\207ժTN?Q�:�8�2\177UwP�\233���\225\005��|\205��&�ӣ���v$�\032^�\026m��D�\222O �B\231cx��y���$\225�P\226���\221O*��D]5V\035�tB-$�\225\a�\025�S��\"\021��C\030m\005j��\212\f��\200�\n0���\212��N۰�@�!�,�\203\006\212�\224\215�\036+E\006��\220s\233�J�\016\026��P��`�TN\202\006g�\222\003\235\220\227H�$\025Q\201J\037\rt#\206\204", end=0xb4a3cfe9 "", pts=0)
    at decode.c:459
#10 0x01ea1ff4 in ?? () from /usr/lib/xine/plugins/1.26/xineplug_decode_mpeg2.so

Thread 4 (Thread 0xb44e4b90 (LWP 5501)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x030d90e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0x0855355d in pthread_cond_wait () from /lib/tls/i686/cmov/libc.so.6
#3  0x00171246 in fifo_buffer_get (fifo=0xa57bea8) at buffer.c:230
#4  0x001781f2 in audio_decoder_loop (stream_gen=0xa569328) at audio_decoder.c:66
#5  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#6  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 3 (Thread 0xb3ce3b90 (LWP 5502)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x030d90e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0x0855355d in pthread_cond_wait () from /lib/tls/i686/cmov/libc.so.6
#3  0x00181bd2 in listener_loop (queue_gen=0xa599a38) at events.c:56
#4  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 2 (Thread 0xb3383b90 (LWP 5503)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x0853ca21 in select () from /lib/tls/i686/cmov/libc.so.6
#2  0x001977d6 in xine_usec_sleep (usec=100000) at utils.c:481
#3  0x00187140 in demux_loop (stream_gen=0xa569328) at demux.c:352
#4  0x030d54ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0x0854470e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 1 (Thread 0xb7ee1710 (LWP 5484)):
#0  0x001d7422 in __kernel_vsyscall ()
#1  0x030d90e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0x0855355d in pthread_cond_wait () from /lib/tls/i686/cmov/libc.so.6
#3  0x00970167 in QWaitCondition::wait (this=0xa3bd1cc, mutex=0xa3bd1bc, time=4294967295) at thread/qwaitcondition_unix.cpp:87
#4  0x03bf03a2 in Phonon::Xine::XineStream::closeBlocking (this=0xa3bd180) at ../../xine/xinestream.cpp:1548
#5  0x03c05fa2 in ~MediaObject (this=0xa3bb1f8) at ../../xine/mediaobject.cpp:109
#6  0x0012ce4c in Phonon::MediaNodePrivate::deleteBackendObject (this=0xa3bb8c8) at ../3rdparty/phonon/phonon/medianode.cpp:81
#7  0x0013c5dd in ~FactoryPrivate (this=0x9e59c58) at ../3rdparty/phonon/phonon/factory.cpp:193
#8  0x0013b1e5 in destroy () at ../3rdparty/phonon/phonon/factory.cpp:84
#9  0x0013884b in ~CleanUpGlobalStatic (this=0x15d3f0) at ../3rdparty/phonon/phonon/globalstatic_p.h:55
#10 0x0848ec59 in exit () from /lib/tls/i686/cmov/libc.so.6
#11 0x010a96ab in qt_xio_errhandler () at kernel/qapplication_x11.cpp:707
#12 0x003a999a in KApplication::xioErrhandler (this=0xbfea97e8, dpy=0x9d85680) at ../../kdeui/kernel/kapplication.cpp:408
#13 0x003a99d6 in kde_xio_errhandler (dpy=0x9d85680) at ../../kdeui/kernel/kapplication.cpp:125
#14 0x025f4256 in _XIOError (dpy=0x9d85680) at ../../src/XlibInt.c:2959
#15 0x025fbeda in process_responses (dpy=0x9d85680, wait_for_first_event=<value optimized out>, current_error=0x0, current_request=0) at ../../src/xcb_io.c:240
#16 0x025fc816 in _XEventsQueued (dpy=0x9d85680, mode=1) at ../../src/xcb_io.c:256
#17 0x025cf584 in XCheckTypedWindowEvent (dpy=0x9d85680, w=39845946, type=22, event=0xbfea7e6c) at ../../src/ChkTypWEv.c:69
#18 0x010acf62 in QETWidget::translateConfigEvent (this=0x9e4f3e0, event=0xbfea946c) at kernel/qapplication_x11.cpp:5273
#19 0x010baf0e in QApplication::x11ProcessEvent (this=0xbfea97e8, event=0xbfea946c) at kernel/qapplication_x11.cpp:3471
#20 0x010e8292 in x11EventSourceDispatch (s=0x9d70500, callback=0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#21 0x06a01ad8 in IA__g_main_context_dispatch (context=0x9d6f698) at /build/buildd/glib2.0-2.21.1/glib/gmain.c:1814
#22 0x06a05070 in g_main_context_iterate (context=0x9d6f698, block=<value optimized out>, dispatch=1, self=0x9d6d3c0) at /build/buildd/glib2.0-2.21.1/glib/gmain.c:2445
#23 0x06a051a3 in IA__g_main_context_iteration (context=0x9d6f698, may_block=1) at /build/buildd/glib2.0-2.21.1/glib/gmain.c:2508
#24 0x00a8cf9c in QEventDispatcherGlib::processEvents (this=0x9d6d1f8, flags={i = 36}) at kernel/qeventdispatcher_glib.cpp:324
#25 0x010e7975 in QGuiEventDispatcherGlib::processEvents (this=0x9d6d1f8, flags={i = 36}) at kernel/qguieventdispatcher_glib.cpp:202
#26 0x00a600a9 in QEventLoop::processEvents (this=0xbfea9764, flags=) at kernel/qeventloop.cpp:149
#27 0x00a604f2 in QEventLoop::exec (this=0xbfea9764, flags={i = 0}) at kernel/qeventloop.cpp:200
#28 0x00a6287f in QCoreApplication::exec () at kernel/qcoreapplication.cpp:888
#29 0x01045a97 in QApplication::exec () at kernel/qapplication.cpp:3526
#30 0x0806f581 in main (argc=2, argv=0xbfea9944) at ../../../../dragonplayer/src/app/main.cpp:58
Comment 1 Dario Andres 2009-06-09 01:40:01 UTC
A XIO error.
Comment 2 Raphael Kubo da Costa 2009-07-21 02:59:28 UTC
Can you attach the movie here or is it too big? Is there any other movie we can test Dragon with?
Comment 3 Nils Kassube 2009-07-21 08:47:04 UTC
Created attachment 35507 [details]
Corrupt mpg file

This is the file that caused the crash. It is cut down to an acceptable size with avidemux using the copy option for audio and video and output type mpeg PS (or mpeg TS?).
Comment 4 Dario Andres 2009-07-21 14:46:05 UTC
Here using:

Qt: 4.5.2 (KDE-Qt git commit 46a247a2c9a8c0c4456a02f6a0922d859d88fe76
        Date:   Fri Jun 26 13:45:37 2009 +0200)
KDE: 4.3.61 (KDE 4.3.61 (KDE 4.4 >= 20090717))
kdelibs svn rev. 999250 / kdebase svn rev. 999250
xine-lib 1.1.16.3
on ArchLinux i686 - Kernel 2.6.30.1

+ the attached corrupted mpeg video:

It crashes DragonPlayer with this backtrace:

(gdb) bt full                              
#0  0xb7f91424 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb6249461 in raise () from /lib/libc.so.6
No symbol table info available.
#2  0xb624ac62 in abort () from /lib/libc.so.6
No symbol table info available.
#3  0xae8bf7eb in mpeg2_decode_data () from /usr/lib/xine/plugins/1.26/xineplug_decode_mpeg2.so
No symbol table info available.
#4  0x00000238 in ?? ()
No symbol table info available.
#5  0xae792010 in ?? ()
No symbol table info available.
#6  0x0000001b in ?? ()
No symbol table info available.
#7  0xb77b2052 in xine_monotonic_clock () from /usr/lib/libxine.so.1
No symbol table info available.
#8  0x00000001 in ?? ()
No symbol table info available.
#9  0xb03d31cc in ?? ()
No symbol table info available.
#10 0xae8d41d6 in ?? () from /usr/lib/xine/plugins/1.26/xineplug_decode_mpeg2.so
No symbol table info available.
#11 0xae8d41b2 in ?? () from /usr/lib/xine/plugins/1.26/xineplug_decode_mpeg2.so
No symbol table info available.
#12 0x013614c0 in ?? ()
No symbol table info available.

, but it also crashes "xine" (from xine-ui), with the same backtrace.
So it is indeed a xine-lib bug. 

MPlayer and VLC both stopped when trying to reproduce the corrupted MPEG but they didn't crashed at all.

This should be closed as UPSTREAM.
Comment 5 Dario Andres 2009-07-21 14:52:44 UTC
Ok, reported upstream: 
http://bugs.xine-project.org/show_bug.cgi?id=261
Closing this report as UPSTREAM
Thanks