Bug 194760 – app-cdr/cdrdao-1.2.2 reproducible segfault

• Product: Gentoo Linux
• Status: RESOLVED TEST-REQUEST

[Description Shevek 2007-10-05 00:11:14 UTC]

I tried to mail this to the apparent author, but the mail bounced.


(gdb) run copy --paranoia-mode 3 --device 1,0,0 --driver generic-mmc:0x0
--buffe
rs 64 -v 2 --eject
Starting program: /usr/bin/cdrdao copy --paranoia-mode 3 --device 1,0,0
--driver
 generic-mmc:0x0 --buffers 64 -v 2 --eject
Failed to read a valid object file image from memory.
[Thread debugging using libthread_db enabled]
[New Thread -1210967680 (LWP 15739)]
Cdrdao version 1.2.1 - (C) Andreas Mueller <[e-mail]>
  SCSI interface library - (C) Joerg Schilling
  Paranoia DAE library - (C) Monty

Check http://cdrdao.sourceforge.net/drives.html#dt for current driver
tables.

Using libscg version 'schily-0.8'

1,0,0: HL-DT-ST RW/DVD GCC-4242N        Rev: 0J04
Using driver: Generic SCSI-3/MMC - Version 2.0 (options 0x0000)

WARNING: Unit not ready, still trying...
Starting CD copy at speed 24...

Track   Mode    Flags  Start                Length
------------------------------------------------------------
 1      AUDIO   0      00:00:33(    33)     21:03:12( 94737)
 2      AUDIO   0      21:03:45( 94770)     07:17:50( 32825)
 3      AUDIO   0      28:21:20(127595)     07:05:13( 31888)
 4      AUDIO   0      35:26:33(159483)     06:10:40( 27790)
 5      AUDIO   0      41:36:73(187273)     12:01:07( 54082)
 6      AUDIO   0      53:38:05(241355)     06:24:28( 28828)
Leadout AUDIO   0      60:02:33(270183)

PQ sub-channel reading (audio track) is supported, data format is BCD.
Copying audio tracks 1-6: start 00:00:00, length 60:02:33 to
"cddata15739.bin"..
.
Track 1...
Found ISRC code.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1210967680 (LWP 15739)]
0xb7d8adb4 in *__GI___libc_free (mem=0x83edbd0) at malloc.c:3539
3539    malloc.c: No such file or directory.
        in malloc.c
Current language:  auto; currently c
(gdb) bt
#0  0xb7d8adb4 in *__GI___libc_free (mem=0x83edbd0) at malloc.c:3539
#1  0x0807b298 in i_cblock_destructor (c=0x82140d0) at p_block.c:88
#2  0x0807b17e in free_elem (e=0x82140f0, free_ptr=1) at p_block.c:42
#3  0x0807b3a8 in free_c_block (c=0x82140d0) at p_block.c:113
#4  0x0807b540 in recover_cache (p=0x80f02d0) at p_block.c:201
#5  0x0807a9a8 in i_read_c_block (p=0x80f02d0, beginword=220348296, 
    endword=220349472, 
    callback=0x805adc0 <CdrDriver::paranoiaCallback(long, int)>)
    at paranoia.c:1104
#6  0x0807ada5 in paranoia_read_limited (p=0x80f02d0, 
    callback=0x805adc0 <CdrDriver::paranoiaCallback(long, int)>, 
    max_retries=20) at paranoia.c:1240
#7  0x0807b031 in paranoia_read (p=0x0, callback=0) at paranoia.c:1193
#8  0x0805ac7c in CdrDriver::readAudioRangeParanoia (this=0x80dd5a0,
info=0x0, 
    fd=7, start=82812, end=270183, startTrack=0, endTrack=5, 
    trackInfo=0x80f03c0) at CdrDriver.cc:4310
#9  0x08064606 in GenericMMC::readAudioRange (this=0x80dd5a0, 
    rinfo=0xbfc49480, fd=7, start=0, end=270183, startTrack=0,
endTrack=5, 
    info=0x80f03c0) at GenericMMC.cc:2342
#10 0x08059eed in CdrDriver::readDisk (this=0x80dd5a0, session=1, 
    dataFilename=0xbfc49520 "cddata15739.bin") at CdrDriver.cc:3423
#11 0x0804efc4 in copyCd (src=0x80dd5a0, dst=0x80dd5a0, session=1, 
    dataFilename=0xbfc49520 "cddata15739.bin", fifoBuffers=0, swap=0,
eject=1, 
    force=0, keepimage=0) at main.cc:1888
#12 0x0805127a in main (argc=13, argv=0x0) at main.cc:2766

(gdb) frame 0
#0  0xb7d8adb4 in *__GI___libc_free (mem=0x83edbd0) at malloc.c:3539
3539    malloc.c: No such file or directory.
        in malloc.c
(gdb) info locals
ignore1 = 0
ignore2 = 1
ar_ptr = (mstate) 0x44b0473
p = (mchunkptr) 0x8300000
hook = (void (*)(void *, const void *)) 0x8300000

(gdb) frame 1
#1  0x0807b298 in i_cblock_destructor (c=0x82140d0) at p_block.c:88
88      p_block.c: No such file or directory.
        in p_block.c
(gdb) info locals
No locals.
(gdb) print *c
$5 = {vector = 0x83edbd0, begin = 220338912, size = 176400, 
  flags = 0x83c2ab8 "", lastsector = 0, p = 0x80f02d0, e = 0x82140f0}

(gdb) frame 2
#2  0x0807b17e in free_elem (e=0x82140f0, free_ptr=1) at p_block.c:42
42      in p_block.c
(gdb) info locals
l = (linked_list *) 0x80dd418
(gdb) print *e
$3 = {ptr = 0x82140d0, prev = 0x8214160, next = 0x0, list = 0x80dd418, 
  stamp = 2643}
(gdb) print *l
$4 = {head = 0x8214048, tail = 0x82140f0, 
  new_poly = 0x807b240 <i_cblock_constructor>, 
  free_poly = 0x807b260 <i_cblock_destructor>, current = 2659, active =
16}

(gdb) frame 3
#3  0x0807b3a8 in free_c_block (c=0x82140d0) at p_block.c:113
113     in p_block.c
(gdb) info locals
next = (v_fragment *) 0x0
v = (v_fragment *) 0x1

(gdb) frame 4
#4  0x0807b540 in recover_cache (p=0x80f02d0) at p_block.c:201
201     in p_block.c
(gdb) info locals
l = (linked_list *) 0x80dd418

(gdb) frame 5
#5  0x0807a9a8 in i_read_c_block (p=0x80f02d0, beginword=220348296, 
    endword=220349472, 
    callback=0x805adc0 <CdrDriver::paranoiaCallback(long, int)>)
    at paranoia.c:1104
1104    paranoia.c: No such file or directory.
        in paranoia.c
(gdb) info locals
target = 1
readat = 187396
firstread = 0
totaltoread = 150
sectatonce = 26
driftcomp = 1
new = (c_block *) 0x8214028
root = (root_block *) 0xd22d539
buffer = (int16_t *) 0xd255a58
flags = 0x81e8f10 ""
sofar = 136220376
dynoverlap = 187396
anyflag = 0

(gdb) frame 6
#6  0x0807ada5 in paranoia_read_limited (p=0x80f02d0, 
    callback=0x805adc0 <CdrDriver::paranoiaCallback(long, int)>, 
    max_retries=20) at paranoia.c:1240
1240    in paranoia.c
(gdb) info locals
new = (c_block *) 0x81e8ed8
beginword = 220348296
endword = 220349472
retry_count = 18
lastend = 220386617
root = (root_block *) 0x80f02d4





root@blue ~ # ldd /usr/bin/cdrdao 
        linux-gate.so.1 =>  (0xffffe000)
        libpthread.so.0 => /lib/libpthread.so.0 (0xb7f16000)
        libmad.so.0 => /usr/lib/libmad.so.0 (0xb7f00000)
        libvorbisfile.so.3 => /usr/lib/libvorbisfile.so.3 (0xb7ef9000)
        libvorbis.so.0 => /usr/lib/libvorbis.so.0 (0xb7ed2000)
        libm.so.6 => /lib/libm.so.6 (0xb7eac000)
        libogg.so.0 => /usr/lib/libogg.so.0 (0xb7ea7000)
        libao.so.2 => /usr/lib/libao.so.2 (0xb7ea3000)
        libnsl.so.1 => /lib/libnsl.so.1 (0xb7e8d000)
        libstdc++.so.6 => /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/libstdc
++.so.6 (0xb7dbd000)
        libgcc_s.so.1
=> /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/libgcc_s.so.1 (0xb7db4000)
        libc.so.6 => /lib/libc.so.6 (0xb7c8a000)
        /lib/ld-linux.so.2 (0xb7f49000)
        libdl.so.2 => /lib/libdl.so.2 (0xb7c86000)

[Comment 1 Jakub Moc (RETIRED) 2007-10-05 05:45:34 UTC]

Try w/ 1.2.2 please. Also, post emerge --info when filing bugs next time.

[Comment 2 Shevek 2007-10-05 15:50:39 UTC]

New version segfaults in exactly the same way.

Portage 2.1.3.9 (default-linux/x86/2007.0/desktop, gcc-3.4.4, glibc-2.5-r2, 2.6.22-gentoo-r5 i686)
=================================================================
System uname: 2.6.22-gentoo-r5 i686 Intel(R) Pentium(R) M processor 1.86GHz
Timestamp of tree: Fri, 05 Oct 2007 10:50:01 +0000
app-shells/bash:     3.1_p17
dev-java/java-config: 2.0.33-r1
dev-lang/python:     2.4.2
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.9
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1, 1.10
sys-devel/binutils:  2.17-r1
sys-devel/gcc-config: 1.3.12-r6
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-g -O2 -march=i686 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/terminfo /etc/texmf/web2c"
CXXFLAGS="-g -O2 -march=i686 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="distlocks metadata-transfer nostrip sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="7zip X a52 aac aalib acl acpi activefilter adplug alsa apic atm berkdb bidi bitmap-fonts blender-game bonobo bzip2 cairo cdda cddb cdparanoia cdr cdrom cle266 cli cpudetection cracklib crypt cups curl daap dbus dga dhcp directfb divx divx4linux dmx dri dts dv dvd dvdnav dvdr dvdread eap-tls eds effects emboss enca encode evo evolution excel exif expat fam fbcon ffmpeg fftw firefox flac flash fortran fpx freetype ftp fxsr gcj gd gdbm gif gimp gimpprint glib glx gnome gnutls gpm graphviz gs gsm gstreamer gtk gtkhtml hal iconv imagemagick imlib inkjar ipv6 isdnlog jack java java5 javascript jbig jpeg jpeg2k kde kerberos ladspa lash lcms ldap libcaca live lzo mad matroska midi mikmod mixer mjpeg mmap mmx mng mod modplug mp2 mp3 mpeg mpeg4 mplayer mudflap musepack ncurses netjack nls nntp nptl nptlonly nsplugin objc objc++ offensive ogg openal openexr opengl openmp openssl pam pcre pdf perl plugin png pnm posix postgres pppd python qt3support qt4 quicktime radius randr rar readline real reflection rtc rtsp samba sasl scanner sdl sdl-image server session shout sid sms sndfile snmp soap sockets speedo speex spell spl srt sse sse2 ssl stream subtitles subversion svg tcpd tga theora threads tiff tm tm2 truetype truetype-fonts type1 type1-fonts unicode upnp usb vcd vdr vidix vlm vorbis wav wavpack webdav win32codecs wma wmf x264 x86 xanim xine xml xmlrpc xorg xosd xscreensaver xv xvid xvmc zeroconf zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="fglrx radeon dummy"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, MAKEOPTS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 3 Samuli Suominen (RETIRED) 2008-06-12 15:31:43 UTC]

- Has this been reported upstream? Because they are best to review your trace.

- This bug is a bit old, and just about every library cdrdao uses has been upgraded in tree & toolchain too. So requesting to retest with up to date system.

[Comment 4 Shevek 2008-06-14 00:24:51 UTC]

Dear Samuli. The first line of my first post answers your first question. As for the rest, the bug is clearly in paranoia, which is included with cdrdao, and hence is not in a dependency, so the package itself needs fixing.

This bug was reported over 8 months ago, the system I was using has long since gone away. The bug, presumably, remains. Perhaps someone could actually look into the code, rather than just asking the original reporter once every 4 months whether the bug has "gone away yet?" On the strongest balance of probabilities, no, it's still there.

[Comment 5 Steve Dibb (RETIRED) 2008-06-14 01:28:22 UTC]

(In reply to comment #4)

> This bug was reported over 8 months ago, the system I was using has long since
> gone away. The bug, presumably, remains. Perhaps someone could actually look
> into the code, rather than just asking the original reporter once every 4
> months whether the bug has "gone away yet?" On the strongest balance of
> probabilities, no, it's still there.

Shevek,

Since there are so many bugs to go through, and we can't get to all of them in a timely manner, it's a very common occurrence that most go away simply with time.

Please bear with us and do some testing -- it greatly helps us out.  The more legwork a bug has for a developer to do, the longer it will probably take to get to it.

[Comment 6 Samuli Suominen (RETIRED) 2009-05-07 21:41:56 UTC]

(In reply to comment #4)
> This bug was reported over 8 months ago, the system I was using has long since
> gone away. The bug, presumably, remains. Perhaps someone could actually look
> into the code, rather than just asking the original reporter once every 4
> months whether the bug has "gone away yet?" On the strongest balance of
> probabilities, no, it's still there.

1.2.2-r3 has quite a set of new fixes.., you have to remember we are not the cdrdao upstream.

[Comment 7 Samuli Suominen (RETIRED) 2009-05-28 05:03:50 UTC]

test cdrdao-1.2.3_rc2