Debian Bug report logs - #647432
audacious crashes when it gets an I/O error scanning for ID3 tags

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Russell Howe <rhowe@moonfruit.com>

To: submit@bugs.debian.org

Subject: audacious crashes when it gets an I/O error scanning for ID3 tags

Date: Wed, 2 Nov 2011 17:24:39 +0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: audacious
Version: 2.4.4-1
Tags: patch

The following patch fixes the crash detailed below. I was dealing with a
rather corrupt filesystem and there were I/O errors all over the place.
This one was an attempt to read beyond the end of the device, I think.


- --- audacious-2.4.4/src/libaudtag/id3/id3v1.c.orig	2011-11-02
17:17:13.823242388 +0000
+++ audacious-2.4.4/src/libaudtag/id3/id3v1.c	2011-11-02
17:11:30.787244848 +0000
@@ -38,7 +38,8 @@
     if (vfs_fseek(f, -355, SEEK_END))
         return FALSE;

- -    tag = read_char_data(f, 4);
+    if (!(tag = read_char_data(f, 4)))
+	return FALSE;

     if (!strncmp(tag, "TAG+", 4))
         has_id3v1_ext = TRUE;


Program received signal SIGSEGV, Segmentation fault.
id3v1_can_handle_file (f=0x9591d0) at id3/id3v1.c:44
44	id3/id3v1.c: No such file or directory.
	in id3/id3v1.c
(gdb) directory /home/rhowe/projects/audacious/audacious
audacious-2.4.4/                 audacious_2.4.4-1.debian.tar.gz
audacious_2.4.4-1.dsc            audacious_2.4.4.orig.tar.gz
(gdb) directory /home/rhowe/projects/audacious/audacious-2.4.4/src/lib
libaudclient/   libaudcore/     libaudgui/      libaudtag/
libeggsmclient/
(gdb) directory
/home/rhowe/projects/audacious/audacious-2.4.4/src/libaudtag/
Makefile      ape/          audtag.h      tag_module.c  util.c
wma/
aac/          audtag.c      id3/          tag_module.h  util.h
(gdb) directory /home/rhowe/projects/audacious/audacious-2.4.4/src/libaudtag
Source directories searched:
/home/rhowe/projects/audacious/audacious-2.4.4/src/libaudtag:$cdir:$cwd
(gdb) ls
Undefined command: "ls".  Try "help".
(gdb) bt
#0  id3v1_can_handle_file (f=0x9591d0) at id3/id3v1.c:44
#1  0x00007ffff7307fda in find_tag_module (fd=0x9591d0, new_type=0) at
tag_module.c:54
#2  0x00007ffff73076c3 in tag_image_read (handle=0x9591d0,
data=0x7fffffffd810, size=0x7fffffffd81c) at audtag.c:52
#3  0x000000000041b3ea in file_read_image (
    filename=0x8b3cc0
"file:///mnt2/Music%203/D%20Ramirez%20and%20Mark%20Knight%20-%20System.mp3",
decoder=0x7fffe4e62800,
    data=0x7fffffffd810, size=0x7fffffffd81c) at probe.c:248
#4  0x00007ffff7525c76 in aud_file_read_image (size=0x7fffffffd81c,
data=0x7fffffffd810, decoder=<optimized out>,
    filename=0x8b3cc0
"file:///mnt2/Music%203/D%20Ramirez%20and%20Mark%20Knight%20-%20System.mp3")
at ../audacious/misc-api.h:56
#5  audgui_pixbuf_for_file (name=0x8b3cc0
"file:///mnt2/Music%203/D%20Ramirez%20and%20Mark%20Knight%20-%20System.mp3")
at util.c:122
#6  0x00007fffe6773227 in get_current_album_art () at ui_infoarea.c:271
#7  ui_infoarea_draw_album_art (area=0x7db9e0) at ui_infoarea.c:280
#8  0x00007fffe6773461 in ui_infoarea_expose_event (area=0x7db9e0,
event=<optimized out>, unused=<optimized out>) at ui_infoarea.c:358
#9  0x00007ffff64ea1a8 in ?? () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#10 0x00007ffff5c9503e in g_closure_invoke () from
/usr/lib/libgobject-2.0.so.0
#11 0x00007ffff5ca5edb in ?? () from /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff5caf44b in g_signal_emit_valist () from
/usr/lib/libgobject-2.0.so.0
#13 0x00007ffff5caf832 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#14 0x00007ffff6603051 in ?? () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#15 0x00007ffff64e89c0 in gtk_main_do_event () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#16 0x00007ffff613bb0c in ?? () from
/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0
#17 0x00007ffff613babb in ?? () from
/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0
#18 0x00007ffff6136ad3 in ?? () from
/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0
#19 0x00007ffff6138e4d in gdk_window_process_updates () from
/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0
#20 0x00007ffff65e69e7 in ?? () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#21 0x00007ffff65e6c72 in ?? () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#22 0x00007ffff65e713c in gtk_tree_view_set_cursor_on_cell () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#23 0x00007fffe6779b04 in treeview_set_focus_now (tree=0x82c090,
focus=<optimized out>) at playlist_util.c:296
#24 0x00007fffe677730b in ui_playlist_model_playlist_update
(hook_data=0x0, user_data=<optimized out>) at ui_playlist_model.c:656
#25 0x00007ffff774a2b9 in hook_call (name=<optimized out>,
hook_data=0x0) at hook.c:180
#26 0x0000000000414c95 in update (unused=<optimized out>) at
playlist-new.c:361
#27 0x00007ffff6c37edd in g_main_context_dispatch () from
/lib/libglib-2.0.so.0
#28 0x00007ffff6c386b8 in ?? () from /lib/libglib-2.0.so.0
#29 0x00007ffff6c38cfa in g_main_loop_run () from /lib/libglib-2.0.so.0
#30 0x00007ffff64e7717 in gtk_main () from
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#31 0x0000000000411b17 in main (argc=1, argv=0x7fffffffe388) at main.c:512
(gdb) l
39	        return FALSE;
40	
41	    tag = read_char_data(f, 4);
42	
43	    if (!strncmp(tag, "TAG+", 4))
44	        has_id3v1_ext = TRUE;
45	    else
46	        has_id3v1_ext = FALSE;
47	    g_free(tag);
48	
(gdb) print tag
$1 = (gchar *) 0x0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJOsXzWAAoJEJ2trZuuThLO7U8H/1srZYUl7QosaQq1jekIOmlY
cyuH85wp/WHH7gLAEMfz9zfFwaiOGPMeu+G8CIgj2LiMH4+hYzx4PqoTILFnbdqM
UyckeGUgVbRaBoAMuCDSMYBpc28c1I0ZlDNj4ZwaZYbOUioon64DjvjnW4/druud
rHkcpoXIjGQlC2rVlRJPOoAl1iT4GKRfmJPPiY2cxZIRipEzoYeU5paKCSxIKQrv
e8xVuT0BpHz+56VgxsSApD7XpiGmZpO/19qpPOBpJoqfc9cyxjvYCyNPLDu/wMBh
dkcbN08A+I6gnMtCikExpmDjMMeTF/T2h1Ub+WTRVksuFjeCAoo6vITAPVvF1PA=
=vnUX
-----END PGP SIGNATURE-----

Message #14 received at 647432@bugs.debian.org (full text, mbox, reply):

From: Russell Howe <rhowe@moonfruit.com>

To: "647432@bugs.debian.org" <647432@bugs.debian.org>

Subject: Re: Bug#647432: Acknowledgement (audacious crashes when it gets an I/O error scanning for ID3 tags)

Date: Wed, 2 Nov 2011 17:52:22 +0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Apologies for the broken patch - Thunderbird's being stupid

- --- audacious-2.4.4/src/libaudtag/id3/id3v1.c.orig	2011-11-02 17:17:13.823242388 +0000
+++ audacious-2.4.4/src/libaudtag/id3/id3v1.c	2011-11-02 17:11:30.787244848 +0000
@@ -38,7 +38,8 @@
     if (vfs_fseek(f, -355, SEEK_END))
         return FALSE;

- -    tag = read_char_data(f, 4);
+    if (!(tag = read_char_data(f, 4)))
+	return FALSE;

     if (!strncmp(tag, "TAG+", 4))
         has_id3v1_ext = TRUE;

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJOsYNWAAoJEJ2trZuuThLOYCcH/1RbuP21ZDsI58HPoGzciQxE
1iKZRwh/dl4fcHPLS8DD0kFRdTyMsVp2vMsxPZ1EXIrwxdaAh7HSM7bLUycDnvHc
sT86tGKZKwAzPz4wxDpY3YrW56hW94MAIg2eSW9WWadk27ST1imNYFQBo/9G/ETc
rPhpXab+33xltosHi2f3H3w/bFjeeLR1A3njJwDwHfRnK+Qt7lq8OVwz+KLwX+Tq
1896J4vIl2eJx+KK0kUYB6BdwpmUPjbC+ttnv+XytM3Pyr/EOmh0qeKPrVMpxeqF
CAwHukDR44P0sK0w3e91f6FMD2fMaaN7uITrVjKFZ28phho3SEDqxEC4EphZnuc=
=Eahs
-----END PGP SIGNATURE-----

Message #19 received at 647432@bugs.debian.org (full text, mbox, reply):

From: John Lindgren <john.lindgren@tds.net>

To: Russell Howe <rhowe@moonfruit.com>, control@bugs.debian.org

Cc: 647432@bugs.debian.org

Subject: Re: audacious crashes when it gets an I/O error scanning for ID3 tags

Date: Wed, 02 Nov 2011 16:35:30 -0400

tags 647432 fixed-upstream
thanks

Hi Russell,

Thanks for finding this.  The ID3v1 tag parsing code was badly written,
and error checking was missing in a number of places.  It will be fixed
in Audacious 3.1 by this commit:
http://git.atheme.org/audacious/commit/?id=d1804a5bfb0ede58ca688b17dacb152955e869dd

-- John Lindgren

Message #26 received at 647432-done@bugs.debian.org (full text, mbox, reply):

From: Alessio Treglia <alessio@debian.org>

To: 647432-done@bugs.debian.org

Cc: 647432-submitter@bugs.debian.org

Subject: Closing #647432

Date: Sun, 19 Feb 2012 11:33:24 +0100

Version: 3.2-1

Fixed since audacious 3.2-1.
Regards,

-- 
Alessio Treglia          | www.alessiotreglia.com
Debian Developer         | alessio@debian.org
Ubuntu Core Developer    | quadrispro@ubuntu.com
0416 0004 A827 6E40 BB98 90FB E8A4 8AE5 311D 765A

Send a report that this bug log contains spam.