#12 Crash in xine with xine-lib-1.2.12 (1.2.11 is fine)

[Sam James]

Forwarding a downstream report from users in Gentoo:

• https://bugs.gentoo.org/845396
• https://forums.gentoo.org/viewtopic-p-8709560.html

I can't reproduce this myself but some users (including the one who provided this backtrace) reliably can:

$ gdb --args xine Videos/newmouse.wmv
GNU gdb (Gentoo 11.2 vanilla) 11.2
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from xine...
(No debugging symbols found in xine)
(gdb) r
Starting program: /usr/bin/xine Videos/newmouse.wmv
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
This is xine (X11 gui) - a free video player v0.99.12.
(c) 2000-2019 The xine Team.
[New Thread 0x7ffff7065640 (LWP 25938)]
[New Thread 0x7ffff6864640 (LWP 25939)]
[New Thread 0x7fffefebc640 (LWP 25944)]
[New Thread 0x7fffef6bb640 (LWP 25945)]
[New Thread 0x7fffeedb1640 (LWP 25946)]
[New Thread 0x7fffee1b1640 (LWP 25947)]
[New Thread 0x7fffed833640 (LWP 25948)]
[New Thread 0x7fffed032640 (LWP 25949)]
[New Thread 0x7fffdffff640 (LWP 25950)]
[New Thread 0x7fffdf7fe640 (LWP 25951)]
[New Thread 0x7fffdeffd640 (LWP 25952)]
[New Thread 0x7fffde7fc640 (LWP 25953)]
[New Thread 0x7fffddbfc640 (LWP 25954)]
[New Thread 0x7fffdd3fb640 (LWP 25955)]
[New Thread 0x7fffdcbfa640 (LWP 25956)]

Thread 1 "xine" received signal SIGSEGV, Segmentation fault.
__memmove_sse2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:524
524 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory.
(gdb) bt
#0  __memmove_sse2_unaligned_erms ()
    at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:524
#1  0x00007ffff7f6539c in memcpy
    (__len=2047, __src=<optimized out>, __dest=0x7fffffff6fc0)
    at /usr/include/bits/string_fortified.h:29
#2  file_input_read
    (this_gen=0x5555559f2fb0, buf=0x7fffffff6fc0, len=<optimized out>)
    at ../input/input_file.c:186
#3  0x00007ffff7f53085 in _x_demux_read_header
    (input=0x5555559f2fb0, buffer=0x7fffffff6fc0, size=2047) at demux.c:667
#4  0x00007ffff5eb95be in mpd_input_get_instance (cls_gen=
    0x55555597fd00, stream=0x5555558a77b0, mrl=0x5555557ecef0 "Videos/newmouse.wmv") at input_mpegdash.c:1371
#5  0x00007ffff7f39515 in _x_find_input_plugin
    (stream=stream@entry=0x5555558a77b0, mrl=mrl@entry=0x5555557ecef0 "Videos/newmouse.wmv") at load_plugins.c:2006
#6  0x00007ffff7f2c12f in open_internal
    (stream=stream@entry=0x5555558a77b0, mrl=mrl@entry=0x55555568e940 "Videos/newmouse.wmv", input=input@entry=0x0) at xine.c:1779
#7  0x00007ffff7f2c76a in xine_open
    (s=0x5555558a77b0, mrl=0x55555568e940 "Videos/newmouse.wmv") at xine.c:2131
#8  0x0000555555568760 in  ()
#9  0x0000555555569217 in  ()
--Type <RET> for more, q to quit, c to continue without paging--c
#10 0x000055555556e624 in  ()
#11 0x000055555556eaed in  ()
#12 0x00005555555cf676 in  ()
#13 0x0000555555570073 in  ()
#14 0x0000555555563972 in  ()
#15 0x00007ffff7a1336a in __libc_start_call_main (main=main@entry=0x555555561c40, argc=argc@entry=2, argv=argv@entry=0x7fffffffde38) at ../sysdeps/nptl/libc_start_call_main.h:58
#16 0x00007ffff7a1341c in __libc_start_main_impl (main=0x555555561c40, argc=2, argv=0x7fffffffde38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffde28) at ../csu/libc-start.c:392
#17 0x0000555555564d9a in  ()

xine-lib-1.2.12 causes the issue but xine-lib-1.2.11 is fine. Please let me know if you need any furhter information.

[Sam James]

Andy Figueroa has kindly given a more full backtrace:

(gdb) bt
#0  __memmove_sse2_unaligned_erms ()
    at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:524
#1  0x00007ffff7f6539c in memcpy
    (__len=2047, __src=<optimized out>, __dest=0x7fffffff7180)
    at /usr/include/bits/string_fortified.h:29
#2  file_input_read
    (this_gen=0x5555559ccbe0, buf=0x7fffffff7180, len=<optimized out>)
    at ../input/input_file.c:186
#3  0x00007ffff7f53085 in _x_demux_read_header
    (input=0x5555559ccbe0, buffer=0x7fffffff7180, size=2047) at demux.c:667
#4  0x00007ffff401b5be in mpd_input_get_instance (cls_gen=
    0x555555907d10, stream=0x55555582df50, mrl=0x5555559697d0 "/usr/share/xine/skins/xine-ui_logo.mpg") at input_mpegdash.c:1371
#5  0x00007ffff7f39515 in _x_find_input_plugin
    (stream=stream@entry=0x55555582df50, mrl=mrl@entry=0x5555559697d0 "/usr/share/xine/skins/xine-ui_logo.mpg") at load_plugins.c:2006
#6  0x00007ffff7f2c12f in open_internal
    (stream=stream@entry=0x55555582df50, mrl=mrl@entry=0x5555558ae500 "/usr/share/xine/skins/xine-ui_logo.mpg", input=input@entry=0x0) at xine.c:1779
#7  0x00007ffff7f2c76a in xine_open
    (s=0x55555582df50, mrl=mrl@entry=0x5555558ae500 "/usr/share/xine/skins/xine-ui_logo.mpg") at xine.c:2131
#8  0x00005555555688a9 in gui_xine_open_and_play
--Type <RET> for more, q to quit, c to continue without paging--c
    (_mrl=<optimized out>, _sub=_sub@entry=0x0, start_pos=start_pos@entry=0, start_time=start_time@entry=0, av_offset=av_offset@entry=0, spu_offset=spu_offset@entry=0, report_error=1) at actions.c:629
#9  0x0000555555568f1e in gui_display_logo () at actions.c:260
#10 0x000055555556eec5 in on_start (data=data@entry=0x7fffffff95d0) at event.c:2019
#11 0x00005555555d1de8 in xitk_run (cb=cb@entry=0x55555556ee00 <on_start>, data=data@entry=0x7fffffff95d0) at xitk.c:2155
#12 0x0000555555570433 in gui_run (session_opts=session_opts@entry=0x0) at event.c:2190
#13 0x000055555556390a in main (argc=<optimized out>, argv=<optimized out>) at main.c:2333

This is with xine-ui-0.99.12.

[Petri Hintukainen]

Based on the backtrace the problem is most likely with mmap. In gentoo this can be enabled/disabled with "mmap" USE flag - maybe this why only some people are seeing this ?

[Sam James]

Ah, good spot! This explains why I couldn't hit it myself.

A user ("aloe") has posted this patch which works for them and another person:

--- a/src/input/input_file.c    2022-03-06 17:31:23.000000000 +0100
+++ b/src/input/input_file.c    2022-04-07 16:02:41.049088452 +0200
@@ -449,7 +449,7 @@
 #ifdef HAVE_MMAP
   this->mmap_base = NULL;
   do {

-    uint8_t mmap_base;
+    uint8_t *mmap_base;
     size_t tmp_size;
     /* may cause truncation - if it does, DON'T mmap! */
     tmp_size = (size_t)sbuf.st_size;

... which lines up.

[Petri Hintukainen]

Yes, it even generates multiple compiler warnings.

Committed as 15119:f56d70b45346. Thanks!

[Sam James]

Thank you!