<html><head><style>pre,code,address {
margin: 0px;
}
h1,h2,h3,h4,h5,h6 {
margin-top: 0.2em;
margin-bottom: 0.2em;
}
ol,ul {
margin-top: 0em;
margin-bottom: 0em;
}
blockquote {
margin-top: 0em;
margin-bottom: 0em;
}
</style></head><body><div>On Mon, 19 Apr 2021 16:31:34 +0200 =?UTF-8?Q?Bernhard_=c3=9cbelacker?= <<a href="mailto:bernhardu@mailbox.org">bernhardu@mailbox.org</a>> wrote:<br></div><div>> Dear Maintainer,<br></div><div>> I tried to have a look and I could reproduce the crash [1].<br></div><div>> <br></div><div>> I think this is caused by a call to gtk_list_store_set<br></div><div>> in totem_playlist_steal_current_starttime [2].<br></div><div>> There a variadic argument list contains a plain 0,<br></div><div>> which might occupy just 32 bit, but gets later interpreted<br></div><div>> as gint64, therefore the terminating -1 gets overrun.<br></div><div>> <br></div><div>> A totem package rebuilt with attached patch does not show<br></div><div>> the crash inside the test VM.<br></div><div>> <br></div><div>> Kind regards,<br></div><div>> Bernhard<br></div><div><br></div><div><br></div><div>Could you submit a MR upstream for your 32 bits arch patch for totem (critical to armhf use)?</div><div><a href="https://gitlab.gnome.org/GNOME/totem/-/issues">https://gitlab.gnome.org/GNOME/totem/-/issues</a><a href="https://gitlab.gnome.org/GNOME/totem/-/issues/?sort=created_date&state=opened&search=g_strdup&first_page_size=20"></a></div><div><br></div><div>The issue is still there <a href="https://gitlab.gnome.org/GNOME/totem/-/blob/master/src/totem-playlist.c?ref_type=heads#L1734">https://gitlab.gnome.org/GNOME/totem/-/blob/master/src/totem-playlist.c?ref_type=heads#L1734</a></div><div><br></div><div>> <br></div><div>> [1]<br></div><div>> (gdb) bt<br></div><div>> #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:126<br></div><div>> #1 0xb6e82878 in g_strdup (str=0x63fca6aa <error: Cannot access memory at address 0x63fca6aa>) at ../../../glib/gstrfuncs.c:363<br></div><div>> #2 0xb6f47144 in value_collect_string (value=0xbeffee60, n_collect_values=<optimized out>, collect_values=<optimized out>, collect_flags=<optimized out>) at ../../../gobject/gvaluetypes.c:293<br></div><div>> #3 0xb680a3be in gtk_list_store_set_valist_internal (<a href="mailto:list_store=list_store@entry">list_store=list_store@entry</a>=0xa0b4c8, <a href="mailto:iter=iter@entry">iter=iter@entry</a>=0xbeffef44, <a href="mailto:emit_signal=emit_signal@entry">emit_signal=emit_signal@entry</a>=0xbeffeefc, <a href="mailto:maybe_need_sort=maybe_need_sort@entry">maybe_need_sort=maybe_need_sort@entry</a>=0xbeffef00, var_args=..., <a href="mailto:var_args@entry">var_args@entry</a>=...) at ../../../../gtk/gtkliststore.c:1033<br></div><div>> #4 0xb680ab52 in gtk_list_store_set_valist (list_store=0xa0b4c8, <a href="mailto:iter=iter@entry">iter=iter@entry</a>=0xbeffef44, var_args=..., <a href="mailto:var_args@entry">var_args@entry</a>=...) at ../../../../gtk/gtkliststore.c:1137<br></div><div>> #5 0xb680ac1a in gtk_list_store_set (list_store=<optimized out>, iter=0xbeffef44) at ../../../../gtk/gtkliststore.c:1179<br></div><div>> #6 0xb6f91c40 in totem_playlist_steal_current_starttime (playlist=0xa1e100) at ../src/totem-playlist.c:1790<br></div><div>> #7 0xb6f8b590 in update_seekable (totem=0x450140) at ../src/totem-object.c:2524<br></div><div>> #8 property_notify_cb_seekable (bvw=<optimized out>, spec=<optimized out>, totem=0x450140) at ../src/totem-object.c:2616<br></div><div>> #9 0xb6f2b252 in g_closure_invoke (closure=0x6e7048, <a href="mailto:return_value=return_value@entry">return_value=return_value@entry</a>=0x0, n_param_values=2, <a href="mailto:param_values=param_values@entry">param_values=param_values@entry</a>=0xbefff090, <a href="mailto:invocation_hint=invocation_hint@entry">invocation_hint=invocation_hint@entry</a>=0xbefff00c) at ../../../gobject/gclosure.c:810<br></div><div>> #10 0xb6f38768 in signal_emit_unlocked_R (<a href="mailto:node=node@entry">node=node@entry</a>=0x448800, detail=105, instance=0xa6e290, <a href="mailto:emission_return=emission_return@entry">emission_return=emission_return@entry</a>=0x0, <a href="mailto:instance_and_params=instance_and_params@entry">instance_and_params=instance_and_params@entry</a>=0xbefff090) at ../../../gobject/gsignal.c:3739<br></div><div>> #11 0xb6f3ce12 in g_signal_emit_valist (<a href="mailto:instance=instance@entry">instance=instance@entry</a>=0xa6e290, <a href="mailto:signal_id=signal_id@entry">signal_id=signal_id@entry</a>=1, <a href="mailto:detail=detail@entry">detail=detail@entry</a>=3204444612, var_args=..., <a href="mailto:var_args@entry">var_args@entry</a>=...) at ../../../gobject/gsignal.c:3495<br></div><div>> #12 0xb6f3d0a2 in g_signal_emit (<a href="mailto:instance=instance@entry">instance=instance@entry</a>=0xa6e290, <a href="mailto:signal_id=signal_id@entry">signal_id=signal_id@entry</a>=1, detail=105) at ../../../gobject/gsignal.c:3551<br></div><div>> #13 0xb6f2e33e in g_object_dispatch_properties_changed (object=0xa6e290, n_pspecs=1, pspecs=<optimized out>) at ../../../gobject/gobject.c:1206<br></div><div>> #14 0xb6f2faac in g_object_notify_by_spec_internal (pspec=<optimized out>, object=0xa6e290) at ../../../gobject/gobject.c:1299<br></div><div>> #15 g_object_notify (object=0xa6e290, property_name=<optimized out>) at ../../../gobject/gobject.c:1347<br></div><div>> #16 0xb6f9b9ec in got_time_tick (time_nanos=<optimized out>, <a href="mailto:bvw=bvw@entry">bvw=bvw@entry</a>=0xa6e290, play=<optimized out>) at ../src/backend/bacon-video-widget.c:2614<br></div><div>> #17 0xb6f9ca02 in bvw_query_timeout (<a href="mailto:bvw=bvw@entry">bvw=bvw@entry</a>=0xa6e290) at ../src/backend/bacon-video-widget.c:2830<br></div><div>> #18 0xb6fa0792 in bvw_bus_message_cb (bus=<optimized out>, message=<optimized out>, bvw=0xa6e290) at ../src/backend/bacon-video-widget.c:2485<br></div><div>> #19 0xb6f2d2e8 in g_cclosure_marshal_VOID__BOXEDv (closure=0xaaf750, return_value=<optimized out>, instance=0x9f8bf0, args=..., marshal_data=0x0, n_params=1, param_types=0x7d1118) at ../../../gobject/gmarshal.c:1686<br></div><div>> #20 0xb6f2b3d8 in _g_closure_invoke_va (<a href="mailto:closure=closure@entry">closure=closure@entry</a>=0xaaf750, return_value=0x0, instance=0x9f8bf0, <a href="mailto:instance@entry">instance@entry</a>=0x0, args=..., <a href="mailto:args@entry">args@entry</a>=..., <a href="mailto:n_params=n_params@entry">n_params=n_params@entry</a>=1, param_types=0x7d1118) at ../../../gobject/gclosure.c:873<br></div><div>> #21 0xb6f3cef6 in g_signal_emit_valist (instance=0x0, <a href="mailto:instance@entry">instance@entry</a>=0x9f8bf0, signal_id=<optimized out>, detail=0, <a href="mailto:detail@entry">detail@entry</a>=3204445364, var_args=..., <a href="mailto:var_args@entry">var_args@entry</a>=...) at ../../../gobject/gsignal.c:3404<br></div><div>> #22 0xb6f3d0a2 in g_signal_emit (<a href="mailto:instance=instance@entry">instance=instance@entry</a>=0x9f8bf0, signal_id=<optimized out>, detail=289) at ../../../gobject/gsignal.c:3551<br></div><div>> #23 0xb64b1420 in gst_bus_async_signal_func (bus=0x9f8bf0, message=0xa5405068, data=<optimized out>) at ../gst/gstbus.c:1295<br></div><div>> #24 0xb64b2008 in gst_bus_source_dispatch (source=0xa8a388, callback=0xb64b13e5 <gst_bus_async_signal_func>, user_data=0x0) at ../gst/gstbus.c:851<br></div><div>> #25 0xb6e6bf4c in g_main_dispatch (context=0x46e678) at ../../../glib/gmain.c:3325<br></div><div>> #26 g_main_context_dispatch (<a href="mailto:context=context@entry">context=context@entry</a>=0x46e678) at ../../../glib/gmain.c:4043<br></div><div>> #27 0xb6e6c1e0 in g_main_context_iterate (<a href="mailto:context=context@entry">context=context@entry</a>=0x46e678, <a href="mailto:block=block@entry">block=block@entry</a>=1, <a href="mailto:dispatch=dispatch@entry">dispatch=dispatch@entry</a>=1, self=<optimized out>) at ../../../glib/gmain.c:4119<br></div><div>> #28 0xb6e6c25a in g_main_context_iteration (<a href="mailto:context=context@entry">context=context@entry</a>=0x46e678, <a href="mailto:may_block=may_block@entry">may_block=may_block@entry</a>=1) at ../../../glib/gmain.c:4184<br></div><div>> #29 0xb6d990a6 in g_application_run (application=0x450140, argc=<optimized out>, argv=0xbefff754) at ../../../gio/gapplication.c:2559<br></div><div>> #30 0x00401160 in main (argc=<optimized out>, argv=<optimized out>) at ../src/totem.c:83<br></div><div>> <br></div><div>> <br></div><div>> [2]<br></div><div>> <a href="https://sources.debian.org/src/totem/3.38.0-2/src/totem-playlist.c/#L1790">https://sources.debian.org/src/totem/3.38.0-2/src/totem-playlist.c/#L1790</a><br></div><div>> <a href="https://gitlab.gnome.org/GNOME/totem/-/commit/159e5ae4e884d85d149bd06866a156935eb43d74.patch">https://gitlab.gnome.org/GNOME/totem/-/commit/159e5ae4e884d85d149bd06866a156935eb43d74.patch</a><br></div><div>> 1790 gtk_list_store_set (GTK_LIST_STORE (playlist->priv->model),<br></div><div>> 1791 &iter,<br></div><div>> 1792 STARTTIME_COL, 0,<br></div><div>> 1793 -1);<br></div><div><br></div><div><span></span></div></body></html>