[Mlt-devel] Bug in mlt_producer_seek - eof not always checked?

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Hi there

I think there is a slight problem in mlt_producer_seek. I got this from 
kdenlinve today (mlt(++) and friends from current trunk):

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1295262832 (LWP 24651)]
0xb6c747da in mlt_producer_seek (this=0xae949158, position=0) at 
mlt_producer.c:240
240             else if ( use_points && !strcmp( eof, "loop" ) && position >= 
mlt_producer_get_playtime( this ) )

(gdb) p eof
$14 = 0x0

Looking at the code, it seems that eof is checked in some cases, but not in 
this case:

(gdb) l mlt_producer_seek
214
215     /** Seek to a specified position.
216     */
217
218     int mlt_producer_seek( mlt_producer this, mlt_position position )
219     {
220             // Determine eof handling
221             mlt_properties properties = MLT_PRODUCER_PROPERTIES( this );
222             char *eof = mlt_properties_get( properties, "eof" );
223             int use_points = 1 - mlt_properties_get_int( 
properties, "ignore_points" );
(gdb)
224
225             // Recursive behaviour for cuts - repositions parent and then 
repositions cut
226             // hence no return on this condition
227             if ( mlt_producer_is_cut( this ) )
228                     mlt_producer_seek( mlt_producer_cut_parent( this ), 
position + mlt_producer_get_in( this ) );
229
230             // Check bounds
231             if ( position < 0 || mlt_producer_get_playtime( this ) == 0 )
232             {
233                     position = 0;
(gdb)
234             }
235             else if ( use_points && ( eof == NULL || !strcmp( 
Check for eof == NULL

eof, "pause" ) ) && position >= mlt_producer_get_playtime( this ) )
236             {
237                     mlt_producer_set_speed( this, 0 );
238                     position = mlt_producer_get_playtime( this ) - 1;
239             }
240             else if ( use_points && !strcmp( eof, "loop" ) && position >= 
mlt_producer_get_playtime( this ) )
No check for eof == NULL

This looks OK:

(gdb) p *this
$16 = {parent = {parent = {child = 0xb1bd7a48, local = 0xb36facd8, close = 0,
      close_object = 0x0}, get_frame = 0, close = 0, close_object = 0x0,
    local = 0x0, child = 0x0}, get_frame = 0, close = 0, close_object = 0x0,
  local = 0xabec03f0, child = 0x0}

stacktrace looks like this:

(gdb) bt
#0  0xb6c747da in mlt_producer_seek (this=0xae949158, position=0) at 
mlt_producer.c:240
#1  0xb6c78cb3 in producer_get_frame (producer=0xad57ef98, frame=0x8a1d7d8, 
index=0) at mlt_playlist.c:368
#2  0xb6c750ca in producer_get_frame (service=0xad57ef98, frame=0x8a1d7d8, 
index=0) at mlt_producer.c:434
#3  0xb6c73cc6 in mlt_service_get_frame (this=0xad57ef98, frame=0x8a1d7d8, 
index=0) at mlt_service.c:367
#4  0xb6c7632e in producer_get_frame (parent=0xb36bafb8, frame=0x8a1d7d8, 
index=2) at mlt_multitrack.c:376
#5  0xb6c750ca in producer_get_frame (service=0xb36bafb8, frame=0x8a1d7d8, 
index=2) at mlt_producer.c:434
#6  0xb6c73cc6 in mlt_service_get_frame (this=0xb36bafb8, frame=0x8a1d7d8, 
index=2) at mlt_service.c:367
#7  0xb6c7bd4e in transition_get_frame (service=0xaf589728, frame=0x872a120, 
index=2) at mlt_transition.c:229
#8  0xb6c73cc6 in mlt_service_get_frame (this=0xaf589728, frame=0x872a120, 
index=2) at mlt_service.c:367
#9  0xb6c7bd4e in transition_get_frame (service=0xabebacc8, frame=0x8567a10, 
index=0) at mlt_transition.c:229
#10 0xb6c73cc6 in mlt_service_get_frame (this=0xabebacc8, frame=0x8567a10, 
index=0) at mlt_service.c:367
#11 0xb6c7bd4e in transition_get_frame (service=0xad587bd0, frame=0x8a2ee98, 
index=2) at mlt_transition.c:229
#12 0xb6c73cc6 in mlt_service_get_frame (this=0xad587bd0, frame=0x8a2ee98, 
index=2) at mlt_service.c:367
#13 0xb6c7bd4e in transition_get_frame (service=0xaf586d68, frame=0x9243608, 
index=0) at mlt_transition.c:229
#14 0xb6c73cc6 in mlt_service_get_frame (this=0xaf586d68, frame=0x9243608, 
index=0) at mlt_service.c:367
#15 0xb6c7bd4e in transition_get_frame (service=0xaf586d10, frame=0x8a11260, 
index=2) at mlt_transition.c:229
#16 0xb6c73cc6 in mlt_service_get_frame (this=0xaf586d10, frame=0x8a11260, 
index=2) at mlt_service.c:367
#17 0xb6c7bd4e in transition_get_frame (service=0xad588180, frame=0x8a01d48, 
index=2) at mlt_transition.c:229
#18 0xb6c73cc6 in mlt_service_get_frame (this=0xad588180, frame=0x8a01d48, 
index=2) at mlt_service.c:367
#19 0xb6c7bd4e in transition_get_frame (service=0xabe69128, frame=0x92f1b08, 
index=0) at mlt_transition.c:229
#20 0xb6c73cc6 in mlt_service_get_frame (this=0xabe69128, frame=0x92f1b08, 
index=0) at mlt_service.c:367
#21 0xb6c7bd4e in transition_get_frame (service=0xabe69090, frame=0x922b7f0, 
index=0) at mlt_transition.c:229
#22 0xb6c73cc6 in mlt_service_get_frame (this=0xabe69090, frame=0x922b7f0, 
index=0) at mlt_service.c:367
#23 0xb6c7bd4e in transition_get_frame (service=0xaf012f30, frame=0x8963f04, 
index=1) at mlt_transition.c:229
#24 0xb6c73cc6 in mlt_service_get_frame (this=0xaf012f30, frame=0x8963f04, 
index=1) at mlt_service.c:367
#25 0xb6c7bd4e in transition_get_frame (service=0xac0e5c98, frame=0x859e064, 
index=1) at mlt_transition.c:229
#26 0xb6c73cc6 in mlt_service_get_frame (this=0xac0e5c98, frame=0x859e064, 
index=1) at mlt_service.c:367
#27 0xb6c7bd4e in transition_get_frame (service=0xac0e7380, frame=0x8680e44, 
index=1) at mlt_transition.c:229
#28 0xb6c73cc6 in mlt_service_get_frame (this=0xac0e7380, frame=0x8680e44, 
index=1) at mlt_service.c:367
#29 0xb6c7bd4e in transition_get_frame (service=0xac0e8dc0, frame=0x867bc8c, 
index=1) at mlt_transition.c:229
#30 0xb6c73cc6 in mlt_service_get_frame (this=0xac0e8dc0, frame=0x867bc8c, 
index=1) at mlt_service.c:367
#31 0xb6c7bd4e in transition_get_frame (service=0xad587ff0, frame=0xb2cbd1a4, 
index=0) at mlt_transition.c:229
#32 0xb6c73cc6 in mlt_service_get_frame (this=0xad587ff0, frame=0xb2cbd1a4, 
index=0) at mlt_service.c:367
#33 0xb6c7ce71 in producer_get_frame (parent=0xb1b2e460, frame=0xb2cbd368, 
track=0) at mlt_tractor.c:321
#34 0xb6c750ca in producer_get_frame (service=0xb1b2e460, frame=0xb2cbd368, 
index=0) at mlt_producer.c:434
#35 0xb6c73cc6 in mlt_service_get_frame (this=0xb1b2e460, frame=0xb2cbd368, 
index=0) at mlt_service.c:367
#36 0xb6c73de4 in service_get_frame (this=0x5, frame=0xb2cbd368, index=37) at 
mlt_service.c:298
#37 0xb6c73cc6 in mlt_service_get_frame (this=0x8837bf8, frame=0xb2cbd368, 
index=0) at mlt_service.c:367
#38 0xb6c79d96 in mlt_consumer_get_frame (this=0x8837bf8) at 
mlt_consumer.c:420
#39 0xb5c09ea6 in consumer_thread (arg=0x8837bf8) at 
consumer_sdl_preview.c:284
#40 0xb764846b in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#41 0xb6ac76de in clone () from /lib/tls/i686/cmov/libc.so.6

I am sorry I can not provide information about reproducing it - kdenlive to me 
is way to unstable to reliably reproduce this kind of errors. (I suspect some 
thread race conditions?), but not checking eof against NULL in this case 
looks wrong to me?

Regards

Mads

-- 
Mads Bondo Dydensborg.                               ma...@ch...
Smoking kills. If you're killed, you've lost a very important part of your
life.  
            - Brooke Shields, during an interview to become spokesperson for a
                                               federal anti-smoking campaign.