Bug#679826: zsnes: segfaults on start in testing i386

[Goswin von Brederlow]

On Mon, 2 Jul 2012 07:35:57 +0930, Ron wrote:
> FWIW severity 'grave' for #679826 looks just a tad hysterical.

grave: makes the package in question unusable by most or all users,
       or causes data loss, or introduces a security hole allowing
       access to the accounts of users who use the package.

zsnes works without sound cards but segfaults if you have one. I would think
most users do have a soundcard so zsnes becomes unusable to most => grave.

Anyway, to see whats wrong I compiled zsnes -with -g and run it in valgrind:

/znes/zsnes-1.510+bz2# file ./src/zsnes
./src/zsnes: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x174839ca4599d5b32320cd48b76992ee336f13ad, not stripped

/znes/zsnes-1.510+bz2# valgrind ./src/zsnes
==11091== Memcheck, a memory error detector
==11091== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==11091== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==11091== Command: ./src/zsnes
==11091== 
--11091-- WARNING: Serious error when reading debug info
--11091-- When reading debug info from /usr/lib/i386-linux-gnu/libGL.so.1.2:
--11091-- Can't make sense of .got section mapping
--11091-- WARNING: Serious error when reading debug info
--11091-- When reading debug info from /usr/lib/i386-linux-gnu/libglapi.so.0.0.0:
--11091-- Can't make sense of .got section mapping
ZSNES v1.51, (c) 1997-2007, ZSNES Team
Be sure to check http://www.zsnes.com/ for the latest version.

ZSNES is written by the ZSNES Team (See AUTHORS.TXT)
ZSNES comes with ABSOLUTELY NO WARRANTY.  This is free software,
and you are welcome to redistribute it under certain conditions;
please read 'LICENSE.TXT' thoroughly before doing so.

Use ZSNES -? for command line definitions.

Starting Mouse detection.
/dev/input does not exist or is inaccessable
ManyMouse: -1 mice detected.
==11091== Syscall param writev(vector[...]) points to uninitialised byte(s)
==11091==    at 0x742DCDC: writev (writev.c:56)
==11091==    by 0x7A167C5: ??? (in /usr/lib/i386-linux-gnu/libxcb.so.1.1.0)
==11091==    by 0x391: ???
==11091==  Address 0xa24ee13 is 19 bytes inside a block of size 16,384 alloc'd
==11091==    at 0x4A4BA68: calloc (vg_replace_malloc.c:566)
==11091==    by 0x7900AE9: XOpenDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==11091==    by 0x736F686B: ???
==11091== 
==11091== Conditional jump or move depends on uninitialised value(s)
==11091==    at 0x4D4D774: _open_device (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x82FA8FE: InitSound (audio.c:197)
==11091==    by 0x82FDE1E: initwinvideo (sdllink.c:1088)
==11091==    by 0x82FB363: ??? (in /znes/zsnes-1.510+bz2/src/zsnes)
==11091== 
==11091== Conditional jump or move depends on uninitialised value(s)
==11091==    at 0x4D4B62C: _sanitize_matrix.isra.2 (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x4D4D78A: _open_device (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x82FA8FE: InitSound (audio.c:197)
==11091==    by 0x82FDE1E: initwinvideo (sdllink.c:1088)
==11091==    by 0x82FB363: ??? (in /znes/zsnes-1.510+bz2/src/zsnes)
==11091== 
==11091== Use of uninitialised value of size 4
==11091==    at 0x4A4DA48: strlen (mc_replace_strmem.c:390)
==11091==    by 0x4D4B639: _sanitize_matrix.isra.2 (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x4D4D78A: _open_device (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x82FA8FE: InitSound (audio.c:197)
==11091==    by 0x82FDE1E: initwinvideo (sdllink.c:1088)
==11091==    by 0x82FB363: ??? (in /znes/zsnes-1.510+bz2/src/zsnes)
==11091== 
==11091== Invalid read of size 1
==11091==    at 0x4A4DA48: strlen (mc_replace_strmem.c:390)
==11091==    by 0x4D4B639: _sanitize_matrix.isra.2 (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x4D4D78A: _open_device (in /usr/lib/libao.so.4.0.0)
==11091==    by 0x82FA8FE: InitSound (audio.c:197)
==11091==    by 0x82FDE1E: initwinvideo (sdllink.c:1088)
==11091==    by 0x82FB363: ??? (in /znes/zsnes-1.510+bz2/src/zsnes)
==11091==  Address 0x5 is not stack'd, malloc'd or (recently) free'd
==11091== 
==11091== 
==11091== HEAP SUMMARY:
==11091==     in use at exit: 11,913,398 bytes in 490 blocks
==11091==   total heap usage: 4,694 allocs, 4,204 frees, 13,720,241 bytes allocated
==11091== 
==11091== LEAK SUMMARY:
==11091==    definitely lost: 12 bytes in 2 blocks
==11091==    indirectly lost: 0 bytes in 0 blocks
==11091==      possibly lost: 336 bytes in 2 blocks
==11091==    still reachable: 11,913,050 bytes in 486 blocks
==11091==         suppressed: 0 bytes in 0 blocks
==11091== Rerun with --leak-check=full to see details of leaked memory
==11091== 
==11091== For counts of detected and suppressed errors, rerun with: -v
==11091== Use --track-origins=yes to see where uninitialised values come from
==11091== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 167 from 12)
Killed

The first one looks like a problem in libxcb and I would start with the other
errors.So look at InitSound (audio.c:197) and initwinvideo (sdllink.c:1088).
Maybe add some printfs in there or set breakpoints in gdb.

MfG
	Goswin