<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "http://bugs.gentoo.org/bugzilla.dtd">

<bugzilla version="2.22.7"
          urlbase="http://bugs.gentoo.org/"
          maintainer="bugzilla@gentoo.org"
>

    <bug>
          <bug_id>189467</bug_id>
          
          <creation_ts>2007-08-19 13:39 0000</creation_ts>
          <short_desc>media-libs/libpng-1.2.19 causes frequent segfaults on amd64 due to mmx code</short_desc>
          <delta_ts>2007-09-20 05:34:11 0000</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>Gentoo Linux</product>
          <component>Library</component>
          <version>unspecified</version>
          <rep_platform>AMD64</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          
          <priority>P2</priority>
          <bug_severity>critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          
          <everconfirmed>1</everconfirmed>
          <reporter>Roguelazer@gmail.com</reporter>
          <assigned_to>base-system@gentoo.org</assigned_to>
          <cc>amd64@gentoo.org</cc>
    
    <cc>angelos@gentoo.org</cc>
    
    <cc>martijn.berger@gmail.com</cc>
    
    <cc>mbartoszkiewicz@gmail.com</cc>
    
    <cc>plaes@plaes.org</cc>
    
    <cc>rickard.narstrom@gmail.com</cc>

      

      
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-19 13:39:16 0000</bug_when>
            <thetext>After upgrading from libpng 1.2.18 to libpng 1.2.19, every application on my system that loaded a png segfaulted. I&apos;ve included a sample backtrace in the below. Recompiling with CFLAGS=&quot;&quot; and LDFLAGS=&quot;&quot; makes no difference. Downgrading to 1.2.18-r1 fixes the problem.

Reproducible: Always

Steps to Reproduce:
1. Install libpng 1.2.19 on amd64 with LDFLAGS=&quot;-Wl,-O1&quot;
2. Attempt to run any program that loads a PNG
Actual Results:  
Program segfaults. There are two different types of segfaults; both will be included as attachments.

Expected Results:  
Program should -not- segfault. :-)

Portage 2.1.3.6 (default-linux/amd64/2006.1/desktop, gcc-4.2.0, glibc-2.6.1-r0, 2.6.22-gentoo-r1 x86_64)
=================================================================
System uname: 2.6.22-gentoo-r1 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 3800+
Gentoo Base System release 1.12.10
Timestamp of tree: Sun, 19 Aug 2007 12:20:01 +0000
ccache version 2.4 [enabled]
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.3.6-r2, 2.4.4-r4
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/sandbox:    1.2.18.1
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17.50.0.18
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.3.5, 1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS=&quot;amd64 ~amd64&quot;
AUTOCLEAN=&quot;yes&quot;
CBUILD=&quot;x86_64-pc-linux-gnu&quot;
CFLAGS=&quot;-march=athlon64 -mtune=athlon64 -mmmx -msse2 -msse3 -m3dnow -Os -pipe -ggdb&quot;
CHOST=&quot;x86_64-pc-linux-gnu&quot;
CONFIG_PROTECT=&quot;/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /var/bind&quot;
CONFIG_PROTECT_MASK=&quot;/etc/env.d /etc/env.d/java/ /etc/gconf /etc/php/apache2-php4/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php4/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php4/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c&quot;
CXXFLAGS=&quot;-march=athlon64 -mtune=athlon64 -mmmx -msse2 -msse3 -m3dnow -O2 -pipe -ggdb&quot;
DISTDIR=&quot;/usr/portage/distfiles&quot;
FEATURES=&quot;ccache distlocks maketest metadata-transfer parallel-fetch sandbox sfperms splitdebug strict unmerge-orphans userfetch userpriv usersandbox&quot;
GENTOO_MIRRORS=&quot;http://mirror.espri.arizona.edu/gentoo/ http://mirror.utdlug.org/linux/distributions/gentoo/ http://gentoo.mirrors.tera-byte.com/ http://gentoo.osuosl.org/ http://gentoo.arcticnetwork.ca/&quot;
LANG=&quot;en_US.UTF-8&quot;
LDFLAGS=&quot;-Wl,-O1&quot;
LINGUAS=&quot;en&quot;
MAKEOPTS=&quot;-j2&quot;
PKGDIR=&quot;/usr/portage/packages&quot;
PORTAGE_RSYNC_OPTS=&quot;--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*&quot;
PORTAGE_TMPDIR=&quot;/var/tmp&quot;
PORTDIR=&quot;/usr/portage&quot;
PORTDIR_OVERLAY=&quot;/usr/portage/local/layman/voip /usr/portage/local/layman/sunrise /usr/portage/local/layman/xeffects /usr/local/portage&quot;
SYNC=&quot;rsync://rsync.namerica.gentoo.org/gentoo-portage&quot;
USE=&quot;64bit 7zip X X509 aac aalib acl acpi aiglx aim alsa amd64 apache2 apm applet artswrappersuid artworkextra automount avahi backtrace bash-completion beagle berkdb binfilter bitmap-fonts bittorrent blender-game bonjour bonobo bookmarks browserplugin bzip2 cairo ccache cdda cddb cdparanoia cdr cdrom cg cgi cli console cpudetection cracklib crypt cscope css csv cups cursors d daap dbus devhelp dhcp directfb divx dnd dvd dvdnav dvdr dvdread dvi ecc eds effects emacs emboss emerald emul-linux-x86 encode epiphany erandom ethereal evince evo evolution examples exif exo extensions fam fbcon fbdev fbsplash ffi ffmpeg fftw firefox flac flash floppyd fltk fontconfig foomaticdb fortran fortran95 freetype ftp fuse gaim galago gcc-libffi gcj gd gdb gdbm gdm gedit geoip gif gimp gimpprint glade glib glitz glut glx gmail gmailtimestamps gnome gnome-print gnuplot gnustep gnutella gnutls gpgme gphoto2 gpm gs gsf gstreamer gstreamer010 gtalk gtk gtk2 gtkspell guile gzip h323 hal hardenedphp hash hbci hddtemp hfs howl-compat hpn html http ical icecast icons iconv icq id3 ilbc imlib imlib2 inkjar innodb ipod ipv6 isdnlog jabber java java-external java5 javascript jikes jingle joystick jpeg jpeg2k kcal kdehiddenvisibility kerberos keyring keyscrub kqemu krb4 latex latin1 ldap libnotify libsexy lm_sensors logitech-mouse lua lucene lzo lzw mad math maya-shaderlibrary mbrola md5sum mdnsresponder-compat midi mikmod ming mmap mng mod_python mono mouse mozbranding mozcalendar mozdevelop mozdom moznoroaming mozsvg mozxmlterm mp3 mp4 mp4live mpeg mpeg2 mplayer mppe-mppc mschap msn mudflap music musicbrainz mysql mysqli nautilus ncurses network networking neural nforce2 nfs nls nptl nptlonly nsplugin ntfs numarray numeric nvidia nvtv objc objc++ objc-gc octave odbc offensive ofx ogg oggvorbis ole on-the-fly-crypt openal openbabel openexr opengl openmp openssl optimisememory ortp oscar pam pam_chroot pango pcntl pcre pda pdf perl php plotutils png pnp pop pop3d posix ppds pppd print python qt3 qt3support qt4 quicktime quotes rar rdesktop readline realmedia reflection regex reiser4 reiserfs rhythmbox rss rsvg ruby samba sasl scanner screen sdl sdl-sound seamonkey sensord server session sftp shout silc smp smtp sockets socks5 softmmu sound sourceview speex spell spl spreadsheet sql sqlite sqlite3 sse-filters ssl startup-notification stencil-buffer stream subtitles subversion svg svgz swig sysfs syslog t1lib tabs tagwriting tcl tcltk tcpd tetex textures tga theora threads threadsafe thumbnail thumbnailing thunar-vfs thunderbird tidy tiff timidity tk tools totem tracker transcode transparency trayicon truetype truetype-fonts type1 type1-fonts unac unicode unzip upnp ups urandom usb v4l v4l2 valgrind vfat vhosts videos vim vim-syntax vnc vncviewer voice vorbis webdav wireshark wma wma123 wnck wordperfect x264 xattr xcb xcf xchat xcomposite xext xforms xft xhtml xinerama xml xml2 xmlrpc xmp xorg xosd xplanet xpm xprint xrandr xscreensaver xv xvid yahoo zip zlib zvbi&quot; ALSA_CARDS=&quot;ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci&quot; ALSA_PCM_PLUGINS=&quot;adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol&quot; CAMERAS=&quot;canon casio fuji kodak&quot; ELIBC=&quot;glibc&quot; INPUT_DEVICES=&quot;evdev keyboard mouse&quot; KERNEL=&quot;linux&quot; LCD_DEVICES=&quot;bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text&quot; LINGUAS=&quot;en&quot; USERLAND=&quot;GNU&quot; VIDEO_CARDS=&quot;nv nvidia vesa&quot;
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-19 13:39:53 0000</bug_when>
            <thetext>Created an attachment (id=128587)
Backtrace of first segfault

</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-19 13:40:10 0000</bug_when>
            <thetext>Created an attachment (id=128588)
Backtrace of second segfault

</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-19 13:41:41 0000</bug_when>
            <thetext>Err... Ignore the LDFLAGS=&quot;-Wl,-O1&quot; part... For a second, I thought it was an
LDFLAGS-induced problem, but it didn&apos;t turn out to be.</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>vapier@gentoo.org</who>
            <bug_when>2007-08-20 00:37:47 0000</bug_when>
            <thetext>so rebuild it with simple CFLAGS: -O0 -pipe</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-20 14:55:39 0000</bug_when>
            <thetext>Okay, more information:

CFLAGS=&quot;-O0 -pipe&quot; also does not work.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47484115313040 (LWP 31697)]
0x00002b2fc00981fa in H�U�H�M�L�E�H�}� () from /usr/lib/libpng12.so.0
(gdb) bt
#0  0x00002b2fc00981fa in H�U�H�M�L�E�H�}� () from /usr/lib/libpng12.so.0
Cannot access memory at address 0x11

Is this something to do with the NX bit on amd64 processors? That&apos;s just a stab in the dark, of course, but there is definitely something weird going on with memory access...</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>angelos@gentoo.org</who>
            <bug_when>2007-08-20 15:40:00 0000</bug_when>
            <thetext>I&apos;ve tried several combinations of CFLAGS now, some seem to work, some don&apos;t, however this are the CFLAGS that do work (add -march=native -pipe everywhere):
-O3
-O2
-O1
-O0 -fomit-frame-pointer
-Os -falign-functions
whereas the following do not work:
-O0
-Os
-Os -fomit-frame-pointer</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>angelos@gentoo.org</who>
            <bug_when>2007-08-20 15:45:50 0000</bug_when>
            <thetext>uhm, small correction, -Os -fomit-frame-pointer seems to work now, even though I&apos;m pretty sure it didn&apos;t work on my first attempt - may be my broken brain though</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-20 16:09:57 0000</bug_when>
            <thetext>Created an attachment (id=128698)
Backtrace of segfault with -Os -falign-functions

The -Os -falign-functions version did not work for me. Nor did -Os with all of the -fblah flags that the gcc manpage said -Os removed from -O2. Which is sort of... odd... I&apos;m attaching another backtrace (with gqview as the invoking program, if it matters), in case it is useful to anybody.</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-20 16:13:00 0000</bug_when>
            <thetext>Hmm. Could this be related to bug #189433 ? It&apos;s interesting that there&apos;s another bug filed against the same version of libpng and with problems in the same file (pnggccrd.c)...</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>angelos@gentoo.org</who>
            <bug_when>2007-08-20 17:12:56 0000</bug_when>
            <thetext>Well yeah, my libpng compiled with -Os -fomit-frame-pointer stopped working a few minutes after I posted this too, so anything with -Os seems complete random, whereas -O2 seemed pretty stable over the last hour</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>fmccor@gentoo.org</who>
            <bug_when>2007-08-20 18:04:58 0000</bug_when>
            <thetext>With -O2 it is stable enough for me, but in some cases, colors are messed up (perhaps related to libsdl?).  Video driver is x11-drivers/nvidia-drivers-100.14.09  (as a base line, libpng-1.1.18-r1 is fine).
(As a very quick check, compare the table in the foobillard game.)</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>vapier@gentoo.org</who>
            <bug_when>2007-08-20 19:12:05 0000</bug_when>
            <thetext>backtraces on optimized code is useless

either build it with -g -ggdb -O0 w/out stripping or dont bother</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-20 19:21:31 0000</bug_when>
            <thetext>Created an attachment (id=128708)
Backtrace of segfault with -O0

...As you wish, SpanKY. As you can see, -O0 provides no more useful information, and the problem is with optimizations. But whatever, here it is...</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>martijn.berger@gmail.com</who>
            <bug_when>2007-08-22 19:53:45 0000</bug_when>
            <thetext>I got the same problem although i cant reproduce it with compiles made with -O0 or -O2 for me it only segfaults with -Os. That is with gcc 4.1.2 and gcc 4.2.0.
libpng versions prior to 1.2.19 are fine when compiles with -Os on my system

</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>Roguelazer@gmail.com</who>
            <bug_when>2007-08-22 20:15:06 0000</bug_when>
            <thetext>Just out of curiosity, what binutils version are you using?</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>martijn.berger@gmail.com</who>
            <bug_when>2007-08-22 20:17:30 0000</bug_when>
            <thetext>binutils 2.17.50.0.18</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>vapier@gentoo.org</who>
            <bug_when>2007-08-25 15:26:10 0000</bug_when>
            <thetext>someone post a .png that is causing a crash ... 1.2.19 + pngviewing works on my amd64 machine

also, try doing:
CPPFLAGS=&quot;-DPNG_NO_MMX_CODE&quot; emerge libpng

if that fails, you could also try 1.2.20rc1 posted here:
http://sourceforge.net/project/showfiles.php?group_id=5624</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>rickard.narstrom@gmail.com</who>
            <bug_when>2007-08-25 16:21:33 0000</bug_when>
            <thetext>How about images in libpng&apos;s self tests:
----
/bin/sh ./libtool --mode=link --tag=CC x86_64-pc-linux-gnu-gcc  -Os -fomit-frame-pointer -march=native -pipe  -Wl,-O1 -Wl,--as-needed -o pngtest  pngtest.o libpng12.la -lz -lm
x86_64-pc-linux-gnu-gcc -Os -fomit-frame-pointer -march=native -pipe -Wl,-O1 -Wl,--as-needed -o .libs/pngtest pngtest.o  ./.libs/libpng12.so -lz -lm
creating pngtest
make[1]: Leaving directory `/var/tmp/paludis/media-libs/libpng-1.2.19/work/libpng-1.2.19&apos;
make  check-TESTS
make[1]: Entering directory `/var/tmp/paludis/media-libs/libpng-1.2.19/work/libpng-1.2.19&apos;
Testing libpng version 1.2.19
   with zlib   version 1.2.3

 libpng version 1.2.19 - August 18, 2007
   Copyright (c) 1998-2007 Glenn Randers-Pehrson
   Copyright (c) 1996-1997 Andreas Dilger
   Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
 library (10219): libpng version 1.2.19 - August 18, 2007
     (PNGGCRD x86_64, PIC)
 pngtest (10219): libpng version 1.2.19 - August 18, 2007
 png_sizeof(png_struct)=1240, png_sizeof(png_info)=464
./test-pngtest.sh: line 3:  9826 Segmentation fault      ./pngtest ${srcdir}/pngtest.png
FAIL: test-pngtest.sh
========================================================
1 of 1 tests failed
Please report to png-mng-implement@lists.sourceforge.net
========================================================
make[1]: *** [check-TESTS] Error 1
make[1]: Leaving directory `/var/tmp/paludis/media-libs/libpng-1.2.19/work/libpng-1.2.19&apos;
make: *** [check-am] Error 2
----</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>vapier@gentoo.org</who>
            <bug_when>2007-08-25 16:33:22 0000</bug_when>
            <thetext>passed tests on my machine

ive added USE=mmx to the build which will do the CPPFLAGS=&quot;-DPNG_NO_MMX_CODE&quot; automatically so people can work around this with USE=-mmx</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>mbartoszkiewicz@gmail.com</who>
            <bug_when>2007-08-25 23:39:45 0000</bug_when>
            <thetext>It crashes for me at:
(gdb) bt
#0  0x00002aaaaabf63f3 in sub_go () at pnggccrd.c:5137
Cannot access memory at address 0x13

Code around 0x00002aaaaabf63f3 is:
0x00002aaaaabf63ef &lt;sub_go+10&gt;: sub    %edx,%ecx
0x00002aaaaabf63f1 &lt;sub_go+12&gt;: mov    %ebp,%eax
0x00002aaaaabf63f3 &lt;sub_go+14&gt;: mov    %ecx,0xffffffffffffffd4(%rbp)
0x00002aaaaabf63f6 &lt;sub_go+17&gt;: mov    %rdi,0xffffffffffffffe8(%rbp)

&quot;mov %ebp,%eax&quot; is the last line of the asm block in pnggccrd.c:5137-5187.
The asm block clobbers the value of the %ebp register, which causes a segfault when gcc tries to load a variable from stack using it. The block contains _CLOBBER_ebp (which expands to ,&quot;%ebp&quot;) in the clobber list, but gcc seems to ignore it. The solution would be to define SAVE_ebp and RESTORE_ebp on x86-64 (like it is used on x86).
</thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>plaes@plaes.org</who>
            <bug_when>2007-09-19 14:00:29 0000</bug_when>
            <thetext>The MMX code has been removed from 1.2.20 version (due to the problems like these..)
So this can be marked as a depending on bug 192119 </thetext>
          </long_desc>
          <long_desc isprivate="0">
            <who>vapier@gentoo.org</who>
            <bug_when>2007-09-20 05:34:11 0000</bug_when>
            <thetext>should be fixed with libpng-1.2.20</thetext>
          </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>128587</attachid>
            <date>2007-08-19 13:39 0000</date>
            <desc>Backtrace of first segfault</desc>
            <filename>libpng_induced_segfault_backtrace.txt</filename>
            <type>text/plain</type>
            <data encoding="base64">UHJvZ3JhbSByZWNlaXZlZCBzaWduYWwgU0lHU0VHViwgU2VnbWVudGF0aW9uIGZhdWx0LgoweDAw
MDAyYjUzZWJiMWFhMzYgaW4gc3ViXzNscCAoKSBhdCBwbmdnY2NyZC5jOjUyNjIKNTI2MiAgICBw
bmdnY2NyZC5jOiBObyBzdWNoIGZpbGUgb3IgZGlyZWN0b3J5LgogICAgICAgIGluIHBuZ2djY3Jk
LmMKKGdkYikgYnQKIzAgIDB4MDAwMDJiNTNlYmIxYWEzNiBpbiBzdWJfM2xwICgpIGF0IHBuZ2dj
Y3JkLmM6NTI2MgojMSAgMHgwMDAwMmI1M2ViYjEwYWYxIGluIHBuZ19yZWFkX3JvdyAocG5nX3B0
cj0weDg4ZGU0MCwgcm93PTB4ODkyZTgwICIiLCAKICAgIGRzcF9yb3c9MHgwKSBhdCBwbmdyZWFk
LmM6NzUxCiMyICAweDAwMDAyYjUzZWJiMTBjNTggaW4gcG5nX3JlYWRfaW1hZ2UgKHBuZ19wdHI9
MHg4OGRlNDAsIGltYWdlPTB4ODk0ZjkwKQogICAgYXQgcG5ncmVhZC5jOjkwOAojMyAgMHgwMDAw
MmFhYWFiNmI4MGY3IGluIGdka19waXhidWZfX3BuZ19pbWFnZV9sb2FkIChmPTB4ODhkYzAwLCAK
ICAgIGVycm9yPTB4ODdlZDc4KSBhdCBpby1wbmcuYzozMjQKIzQgIDB4MDAwMDJiNTNlOWI4ODYy
NyBpbiBfZ2RrX3BpeGJ1Zl9nZW5lcmljX2ltYWdlX2xvYWQgKG1vZHVsZT0weDY5NzdmMCwgCiAg
ICBmPTB4ODhkYzAwLCBlcnJvcj0weDg3ZWQ3OCkgYXQgZ2RrLXBpeGJ1Zi1pby5jOjc4NgojNSAg
MHgwMDAwMmI1M2U5Yjg5NTQwIGluIElBX19nZGtfcGl4YnVmX25ld19mcm9tX2ZpbGUgKAogICAg
ZmlsZW5hbWU9PHZhbHVlIG9wdGltaXplZCBvdXQ+LCBlcnJvcj0weDg3ZWQ3OCkgYXQgZ2RrLXBp
eGJ1Zi1pby5jOjg5OQojNiAgMHgwMDAwMmI1M2U5MjlhMzRkIGluIGljb25faW5mb19lbnN1cmVf
c2NhbGVfYW5kX3BpeGJ1ZiAoCiAgICBpY29uX2luZm89MHg4N2VkNDAsIHNjYWxlX29ubHk9MCkg
YXQgZ3RraWNvbnRoZW1lLmM6MjY4MQojNyAgMHgwMDAwMmI1M2U5MjlhNmEzIGluIElBX19ndGtf
aWNvbl9pbmZvX2xvYWRfaWNvbiAoaWNvbl9pbmZvPTB4ZiwgCiAgICBlcnJvcj0weDApIGF0IGd0
a2ljb250aGVtZS5jOjI3NTYKIzggIDB4MDAwMDJiNTNlOTI5YmNkOCBpbiBJQV9fZ3RrX2ljb25f
dGhlbWVfbG9hZF9pY29uIChpY29uX3RoZW1lPTB4NjU5NDIwLCAKICAgIGljb25fbmFtZT0weDgz
MWJhMCAiZ2NvbmYtZWRpdG9yIiwgc2l6ZT00OCwgZmxhZ3M9PHZhbHVlIG9wdGltaXplZCBvdXQ+
LCAKICAgIGVycm9yPTB4MCkgYXQgZ3RraWNvbnRoZW1lLmM6MTQxNAojOSAgMHgwMDAwMmI1M2U5
MzljNWNhIGluIGljb25fbGlzdF9mcm9tX3RoZW1lICh3aWRnZXQ9PHZhbHVlIG9wdGltaXplZCBv
dXQ+LCAKICAgIG5hbWU9MHg4MzFiYTAgImdjb25mLWVkaXRvciIpIGF0IGd0a3dpbmRvdy5jOjI3
ODEKIzEwIDB4MDAwMDJiNTNlOTM5YzcyZiBpbiBndGtfd2luZG93X3JlYWxpemVfaWNvbiAod2lu
ZG93PTB4NjdlMDMwKQogICAgYXQgZ3Rrd2luZG93LmM6Mjg1MQojMTEgMHgwMDAwMmI1M2U5M2Ey
NzdmIGluIGd0a193aW5kb3dfcmVhbGl6ZSAod2lkZ2V0PTx2YWx1ZSBvcHRpbWl6ZWQgb3V0Pik=
</data>        

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>128588</attachid>
            <date>2007-08-19 13:40 0000</date>
            <desc>Backtrace of second segfault</desc>
            <filename>libpng_induced_segfault_backtrace_2.txt</filename>
            <type>text/plain</type>
            <data encoding="base64">UHJvZ3JhbSByZWNlaXZlZCBzaWduYWwgU0lHU0VHViwgU2VnbWVudGF0aW9uIGZhdWx0LgoweDAw
MDAyYjNkNjUyOTExZmEgaW4gc3ViX2dvICgpIGF0IHBuZ2djY3JkLmM6NTEzNwo1MTM3ICAgIHBu
Z2djY3JkLmM6IE5vIHN1Y2ggZmlsZSBvciBkaXJlY3RvcnkuCiAgICAgICAgaW4gcG5nZ2NjcmQu
YwooZ2RiKSBidAoJIzAgIDB4MDAwMDJiM2Q2NTI5MTFmYSBpbiBzdWJfZ28gKCkgYXQgcG5nZ2Nj
cmQuYzo1MTM3CglDYW5ub3QgYWNjZXNzIG1lbW9yeSBhdCBhZGRyZXNzIDB4MTMKCg==
</data>        

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>128698</attachid>
            <date>2007-08-20 16:09 0000</date>
            <desc>Backtrace of segfault with -Os -falign-functions</desc>
            <filename>Backtrace of segfault with -Os -falign-functions.txt</filename>
            <type>text/plain</type>
            <data encoding="base64">UHJvZ3JhbSByZWNlaXZlZCBzaWduYWwgU0lHU0VHViwgU2VnbWVudGF0aW9uIGZhdWx0LgpbU3dp
dGNoaW5nIHRvIFRocmVhZCA0Nzc5MTcxNDE4NTYxNiAoTFdQIDgzMjApXQoweDAwMDAyYjc3NWU1
YmI1MmUgaW4gc3ViXzJscCAoKSBhdCBwbmdnY2NyZC5jOjU0MjAKNTQyMCAgICBwbmdnY2NyZC5j
OiBObyBzdWNoIGZpbGUgb3IgZGlyZWN0b3J5LgogICAgICAgIGluIHBuZ2djY3JkLmMKKGdkYikg
YnQKIzAgIDB4MDAwMDJiNzc1ZTViYjUyZSBpbiBzdWJfMmxwICgpIGF0IHBuZ2djY3JkLmM6NTQy
MAojMSAgMHgwMDAwMmI3NzVlNWI5ZGZkIGluIHBuZ19wdXNoX3Byb2Nlc3Nfcm93IChwbmdfcHRy
PTB4ZikgYXQgcG5ncHJlYWQuYzo4MTkKIzIgIDB4MDAwMDJiNzc1ZTViYTI3MyBpbiBwbmdfcHJv
Y2Vzc19JREFUX2RhdGEgKHBuZ19wdHI9MHg3ODIzNDAsIAogICAgYnVmZmVyPTB4N2ZmZjUwYTQw
Y2YwICJcMjE277+977+9XDIxNkRcMDE2XDIyMjTvv71cMDI377+977+9NO+/vVwyMDJ4XDIxMO+/
vVwyMzBcMjExVe+/vVhcMjMySGPvv71cMjA377+9eFwyMTJcMDI0SFwyMDFcMDI0JiIsIGJ1ZmZl
cl9sZW5ndGg9PHZhbHVlIG9wdGltaXplZCBvdXQ+KQogICAgYXQgcG5ncHJlYWQuYzo3OTgKIzMg
IDB4MDAwMDJiNzc1ZTViYTQxOCBpbiBwbmdfcHVzaF9yZWFkX0lEQVQgKHBuZ19wdHI9MHg3ODIz
NDApCiAgICBhdCBwbmdwcmVhZC5jOjcyOQojNCAgMHgwMDAwMmI3NzVlNWJiMjY5IGluIHBuZ19w
cm9jZXNzX2RhdGEgKHBuZ19wdHI9MHg3ODIzNDAsIAogICAgaW5mb19wdHI9MHg3ODZkOTAsIGJ1
ZmZlcj08dmFsdWUgb3B0aW1pemVkIG91dD4sIAogICAgYnVmZmVyX3NpemU9PHZhbHVlIG9wdGlt
aXplZCBvdXQ+KSBhdCBwbmdwcmVhZC5jOjM2CiM1ICAweDAwMDAyYWFhYWM2YTM2ZDEgaW4gZ2Rr
X3BpeGJ1Zl9fcG5nX2ltYWdlX2xvYWRfaW5jcmVtZW50ICgKICAgIGNvbnRleHQ9PHZhbHVlIG9w
dGltaXplZCBvdXQ+LCAKICAgIGJ1Zj0weDdmZmY1MGE0MGNmMCAiXDIxNu+/ve+/vVwyMTZEXDAx
NlwyMjI077+9XDAyN++/ve+/vTTvv71cMjAyeFwyMTDvv71cMjMwXDIxMVXvv71YXDIzMkhj77+9
XDIwN++/vXhcMjEyXDAyNEhcMjAxXDAyNCYiLCBzaXplPTYsIGVycm9yPTx2YWx1ZSBvcHRpbWl6
ZWQgb3V0PikKICAgIGF0IGlvLXBuZy5jOjUyMgojNiAgMHgwMDAwMmI3NzVhYzU4MDhiIGluIElB
X19nZGtfcGl4YnVmX2xvYWRlcl93cml0ZSAobG9hZGVyPTB4NzdiNDgwLCAKICAgIGJ1Zj0weDdm
ZmY1MGE0MGNmMCAiXDIxNu+/ve+/vVwyMTZEXDAxNlwyMjI077+9XDAyN++/ve+/vTTvv71cMjAy
eFwyMTDvv71cMjMwXDIxMVXvv71YXDIzMkhj77+9XDIwN++/vXhcMjEyXDAyNEhcMjAxXDAyNCYi
LCBjb3VudD01MTIsIGVycm9yPTB4MCkgYXQgZ2RrLXBpeGJ1Zi1sb2FkZXIuYzo0NjYKIzcgIDB4
MDAwMDAwMDAwMDQ0MTc5MyBpbiA/PyAoKQojOCAgMHgwMDAwMmI3NzViZTQ0ZTVkIGluIElBX19n
X21haW5fY29udGV4dF9kaXNwYXRjaCAoY29udGV4dD0weDYyMmFkMCkKICAgIGF0IGdtYWluLmM6
MjA0NQojOSAgMHgwMDAwMmI3NzViZTQ2OWFiIGluIGdfbWFpbl9jb250ZXh0X2l0ZXJhdGUgKGNv
bnRleHQ9MHg2MjJhZDAsIGJsb2NrPTEsIAogICAgZGlzcGF0Y2g9MSwgc2VsZj08dmFsdWUgb3B0
aW1pemVkIG91dD4pIGF0IGdtYWluLmM6MjY3NwojMTAgMHgwMDAwMmI3NzViZTQ3NjBlIGluIElB
X19nX21haW5fbG9vcF9ydW4gKGxvb3A9MHg1ZmIxNTApIGF0IGdtYWluLmM6Mjg4MQojMTEgMHgw
MDAwMmI3NzVhMzhkY2UxIGluIElBX19ndGtfbWFpbiAoKSBhdCBndGttYWluLmM6MTE1NAojMTIg
MHgwMDAwMDAwMDAwNDUxMTM5IGluID8/ICgpCiMxMyAweDAwMDAyYjc3NWMwY2FiNzQgaW4gX19s
aWJjX3N0YXJ0X21haW4gKAogICAgbWFpbj0weDQ1MGM2MCA8Z3RrX3dpZGdldF9ncmFiX2ZvY3Vz
QHBsdCsyNTkyODg+LCBhcmdjPTIsIAogICAgdWJwX2F2PTB4N2ZmZjUwYTQxMWM4LCBpbml0PTx2
YWx1ZSBvcHRpbWl6ZWQgb3V0PiwgCiAgICBmaW5pPTx2YWx1ZSBvcHRpbWl6ZWQgb3V0PiwgcnRs
ZF9maW5pPTx2YWx1ZSBvcHRpbWl6ZWQgb3V0PiwgCiAgICBzdGFja19lbmQ9MHg3ZmZmNTBhNDEx
YjgpIGF0IGxpYmMtc3RhcnQuYzoyMjkKIzE0IDB4MDAwMDAwMDAwMDQxMTdjOSBpbiA/PyAoKQoj
MTUgMHgwMDAwN2ZmZjUwYTQxMWI4IGluID8/ICgpCiMxNiAweDAwMDAwMDAwMDAwMDAwMDAgaW4g
Pz8gKCkK
</data>        

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>128708</attachid>
            <date>2007-08-20 19:21 0000</date>
            <desc>Backtrace of segfault with -O0</desc>
            <filename>Backtrace of segfault with -O0.txt</filename>
            <type>text/plain</type>
            <data encoding="base64">UHJvZ3JhbSByZWNlaXZlZCBzaWduYWwgU0lHU0VHViwgU2VnbWVudGF0aW9uIGZhdWx0LgpbU3dp
dGNoaW5nIHRvIFRocmVhZCA0NzgzMjQyMTczMjc1MiAoTFdQIDE0NTA5KV0KMHgwMDAwMmI4MGQ4
YjdhZGEwIGluIHN1Yl9nbyAoKSBhdCBwbmdnY2NyZC5jOjUxMzcKNTEzNyAgICBwbmdnY2NyZC5j
OiBObyBzdWNoIGZpbGUgb3IgZGlyZWN0b3J5LgogICAgICAgIGluIHBuZ2djY3JkLmMKKGdkYikg
YnQKIzAgIDB4MDAwMDJiODBkOGI3YWRhMCBpbiBzdWJfZ28gKCkgYXQgcG5nZ2NjcmQuYzo1MTM3
CkNhbm5vdCBhY2Nlc3MgbWVtb3J5IGF0IGFkZHJlc3MgMHgxMQo=
</data>        

          </attachment>
    </bug>

</bugzilla>