#24 Infinite loop bug in reference Structured Storage library


An infinite loop bug in the Structured Storage library
librefstg.a distributed in the Linux AAF SDK has been
discovered. It was uncovered when using InfoDumper on
an AAF file exported from Avid DV Xpress 3.0.
InfoDumper was built from the Build-501 tag of AAF cvs
on an i686 RedHat 6.2 machine using gcc-2.95.2. The
bug does not occur when using InfoDumper with the
native MS Windows implementation of Structured Storage.

The nature of the bug is an infinite loop after
InfoDumper calls StgOpenStorage() at line 2370 in
OMMSSStoredObject.cpp. The following instructions are
involved in the infinite loop.
0x40323443 mov 0x18(%ecx),%eax
0x40323446 cmpl $0x0,0x1c(%eax)
0x4032344a je 0x40323453
0x4032344c mov (%eax),%eax
0x4032344e mov %eax,0x18(%ecx)
0x40323451 jmp 0x40323443

When this section of code is first entered, the value
loaded into %eax is 0x0809ea28. As each iteration of
the loop is executed, the value of (%eax)+0x1c is
compared with 0, perhaps as a check that the end of a
linked list has been reached. However, the values
loaded and dereferenced in %eax repeat every 12
iteractions without the termination condition being
satisfied. The twelfth deference stores 0x0809ea28
back into a local variable and causes the loop to repeat:
address (pointer) contents (dereferenced pointer)
0x809ea28: 0x0809e800
0x809e800: 0x0809e5d8
0x809e5d8: 0x0809e3b0
0x809e3b0: 0x0809e188
0x809e188: 0x0809df60
0x809df60: 0x080a2930
0x80a2930: 0x080a2b58
0x80a2b58: 0x080a2d80
0x80a2d80: 0x080a2fa8
0x80a2fa8: 0x080a31d0
0x80a31d0: 0x080a33f8
0x80a33f8: 0x0809ea28

The attached first_minute.aaf file was the file that
triggered this bug.


  • Stuart Cunningham

    Logged In: YES

    The first_minute.aaf file could not be attached as it was
    too large. However, it appears that every AAF file over
    about 80MB triggers this bug. At least, every large file I
    have tested triggers this bug.

  • Phil Tudor

    Phil Tudor - 2003-08-21
    • priority: 5 --> 7
  • Phil Tudor

    Phil Tudor - 2003-08-21

    Logged In: YES

    This bug report was also forwarded to the AAF Board for
    comment. I don't believe there is an intention to fix it.
    Instead, a move to an alternative implementation of SS is
    under discussion.



  • Stuart Cunningham

    • status: open --> closed-wont-fix
  • Stuart Cunningham

    Logged In: YES

    The Microsoft reference implementation of structured storage
    has been removed from the SDK. Microsoft indicated to the
    AAF Engineering Committee that this software would never be
    fixed. The refactoring of the OM structured storage layer
    now allows a choice of implementation including SchemaSoft's
    proprietary library
    (AAFi686LinuxSDK/g++/sss-impl/libSSRW2C.a) and the open
    source libgsf.