Debian Bug report logs - #438556
tagpy: Fix segfault in tapgy.id3v2.Tag.addFrame()

version graph

Package: tagpy; Maintainer for tagpy is Michal Čihař <nijel@debian.org>;

Reported by: Andreas Hemel <debian-bugs@daishan.de>

Date: Fri, 17 Aug 2007 19:57:04 UTC

Severity: normal

Tags: patch

Found in version 0.91-1

Fixed in version tagpy/0.91-2

Done: Michal Čihař <nijel@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Michal Čihař <nijel@debian.org>:
Bug#438556; Package tagpy. Full text and rfc822 format available.

Acknowledgement sent to Andreas Hemel <debian-bugs@daishan.de>:
New Bug report received and forwarded. Copy sent to Michal Čihař <nijel@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Andreas Hemel <debian-bugs@daishan.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: tagpy: Fix segfault in tapgy.id3v2.Tag.addFrame()
Date: Fri, 17 Aug 2007 21:51:18 +0200
[Message part 1 (text/plain, inline)]
Package: tagpy
Version: 0.91-1
Severity: normal
Tags: patch

Subject: tagpy: Fix segfault in tapgy.id3v2.Tag.addFrame()
Package: tagpy
Version: 0.91-1
Severity: important
Tags: patch

Adding a new Frame to an ID3v2 Tag reproducibly causes a segementation
fault. The TagLib documentation specifies that Tag::addFrame() takes
ownership of the pointer passed to it, but tagpy ignores this. I think
the result is that both, python and TagLib try to free() the Frame
pointer.

The crash is reproducible using the following python script:

import tagpy
import tagpy.id3v2

fileref = tagpy.FileRef('file.mp3')
file = fileref.file()
tag = file.ID3v2Tag(True)
frame = tagpy.id3v2.UniqueFileIdentifierFrame('blah', 'blah')
tag.addFrame(frame)
file.save()


According to the Boost.Python FAQ[1] the solution would be to use
std::auto_ptr. But I wasn't able to get it to work, so I worked around
using std::auto_ptr by simply cloning the Frame object before passing it
to addFrame().

Maybe somebody who is more knowledgeable in C++ than I am, can fix this
the right way.


[1] http://www.boost.org/libs/python/doc/v2/faq.html#ownership



-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.22.2 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.22.2 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
[tagpy-fix-addFrame-segfault.patch (text/plain, attachment)]

Reply sent to Michal Čihař <nijel@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Andreas Hemel <debian-bugs@daishan.de>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #10 received at 438556-close@bugs.debian.org (full text, mbox):

From: Michal Čihař <nijel@debian.org>
To: 438556-close@bugs.debian.org
Subject: Bug#438556: fixed in tagpy 0.91-2
Date: Sun, 19 Aug 2007 17:02:03 +0000
Source: tagpy
Source-Version: 0.91-2

We believe that the bug you reported is fixed in the latest version of
tagpy, which is due to be installed in the Debian FTP archive:

python-tagpy_0.91-2_i386.deb
  to pool/main/t/tagpy/python-tagpy_0.91-2_i386.deb
tagpy_0.91-2.diff.gz
  to pool/main/t/tagpy/tagpy_0.91-2.diff.gz
tagpy_0.91-2.dsc
  to pool/main/t/tagpy/tagpy_0.91-2.dsc



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 438556@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michal Čihař <nijel@debian.org> (supplier of updated tagpy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 19 Aug 2007 18:43:25 +0200
Source: tagpy
Binary: python-tagpy
Architecture: source i386
Version: 0.91-2
Distribution: unstable
Urgency: low
Maintainer: Michal Čihař <nijel@debian.org>
Changed-By: Michal Čihař <nijel@debian.org>
Description: 
 python-tagpy - Python module for manipulating tags in music files
Closes: 426865 435785 438556
Changes: 
 tagpy (0.91-2) unstable; urgency=low
 .
   * Add XS-Vcs headers.
   * Fix build with current boost libraries (Closes: #426865).
   * Rebuilt package is installable (Closes: #435785).
   * Fix crash caused by double free in addFrame (Closes: #438556).
Files: 
 86df5495c8fa6fff1b44809d9258de17 770 python extra tagpy_0.91-2.dsc
 fdc439dad756719527bc96f2bcc24f25 3082 python extra tagpy_0.91-2.diff.gz
 3091cc32c28baeb2f7f00fbbf3b299f0 327950 python extra python-tagpy_0.91-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGyHPi3DVS6DbnVgQRAlGiAKDpQ903k4X9LykjsLWgzOw1dkkidwCgwLOJ
/NhWMHamD3aYcnPSPA9hz08=
=o0FU
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 17 Sep 2007 07:29:23 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Apr 18 03:12:23 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.