Segfault inside Vorbis encoder

[valdikss]

Mixxx 2.3.0-0.15.beta.20201211git18f698d.fc33 (Fedora 33 rpmfusion-free-updates repository) crashes after several hours of broadcasting to Icecast in Vorbis.

Here's a backtrace of one of crash dumps. Unfortunately, it's truncated, and debuginfo doesn't add any useful information. I'll try to create another dump, untruncated this time.

Core was generated by `mixxx'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f88b47f3563 in ?? ()
[Current thread is 1 (LWP 99361)]
(gdb) bt
#0 0x00007f88b47f3563 in ?? ()
#1 0x0000557dda461e5f in EncoderVorbis::writePage (this=0x7f87c0008630) at ../src/encoder/encodervorbis.cpp:121
#2 0x0000557dda35b1ee in ShoutConnection::process (this=0x557ddcf886e0, pBuffer=0x7f8880c16b20, iBufferSize=16384)
    at ../src/engine/sidechain/shoutconnection.cpp:716
#3 0x0000557dda360d67 in ShoutConnection::run (this=0x557ddcf886e0) at ../src/engine/sidechain/shoutconnection.cpp:1020
#4 0x00007f88b0912df0 in ?? ()
#5 0x00007f88b0b70260 in ?? ()
#6 0x0000557ddd1b3f68 in ?? ()
#7 0x00007f88b0912260 in ?? ()
#8 0x0000557ddcf886e0 in ?? ()
#9 0x0000000000000001 in ?? ()
#10 0xc46062994a0afe00 in ?? ()
#11 0x0000000000000000 in ?? ()

[Daniel Schürmann (daschuer)]

Do we have debug symbols available on RPM Fusion?`

[valdikss (valdikss1)]

Yes, and symbols are installed, but for some reason the output didn't change a bit before and after installing. I guess that's due to truncated coredump. I'll updated the coredumpd configuration not to truncate anything under 8GB and broadcasting with mixxx again, to trigger the bug and record full core dump.

[Uwe Klotz (uklotzde-deactivatedaccount)]

I can confirm that with the debug symbols installed you should get meaningful stack traces.

[valdikss (valdikss1)]

Crash upon disconnecting/reconnecting to Icecast server.

Core was generated by `mixxx'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007fb981575563 in ogg_page_eos () from /lib64/libogg.so.0
[Current thread is 1 (Thread 0x7fb804a6f640 (LWP 162144))]
(gdb) bt
#0 0x00007fb981575563 in ogg_page_eos () at /lib64/libogg.so.0
#1 0x000056158a937e5f in EncoderVorbis::writePage() (this=0x7fb884009630) at ../src/encoder/encodervorbis.cpp:121
#2 0x000056158a8311ee in ShoutConnection::process(float const*, int) (this=0x56158cca3bc0, pBuffer=0x7fb9499a7820, iBufferSize=16384)
    at ../src/engine/sidechain/shoutconnection.cpp:716
#3 0x000056158a836d67 in ShoutConnection::run() (this=0x56158cca3bc0) at ../src/engine/sidechain/shoutconnection.cpp:1020
#4 0x00007fb97d694df0 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#5 0x00007fb97d1c93f9 in start_thread () at /lib64/libpthread.so.0
#6 0x00007fb97d0f6903 in clone () at /lib64/libc.so.6

[valdikss (valdikss1)]

With libogg debuginfo:

Core was generated by `mixxx'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007fb981575563 in ogg_page_eos (og=0x7fb8840097d8) at framing.c:46
46 return((int)(og->header[5]&0x04));
[Current thread is 1 (Thread 0x7fb804a6f640 (LWP 162144))]
(gdb) bt
#0 0x00007fb981575563 in ogg_page_eos (og=0x7fb8840097d8) at framing.c:46
#1 0x000056158a937e5f in EncoderVorbis::writePage() (this=0x7fb884009630) at ../src/encoder/encodervorbis.cpp:121
#2 0x000056158a8311ee in ShoutConnection::process(float const*, int) (this=0x56158cca3bc0, pBuffer=0x7fb9499a7820, iBufferSize=16384)
    at ../src/engine/sidechain/shoutconnection.cpp:716
#3 0x000056158a836d67 in ShoutConnection::run() (this=0x56158cca3bc0) at ../src/engine/sidechain/shoutconnection.cpp:1020
#4 0x00007fb97d694df0 in QThreadPrivate::start(void*) () at /lib64/libQt5Core.so.5
#5 0x00007fb97d1c93f9 in start_thread () at /lib64/libpthread.so.0
#6 0x00007fb97d0f6903 in clone () at /lib64/libc.so.6

[Be (be.ing)]

What version of libogg are you using? It seems the bug is in libogg rather than Mixxx.

[valdikss (valdikss1)]

libogg 2:1.3.4-3.fc33

I won't be so sure that it's not mixxx bug, since it could be just an address argument corruption.

[Be (be.ing)]

It could be that Mixxx passes a nullptr to libogg. But if that's the case, it's also a bug in libogg if it doesn't check for a nullptr.

[Uwe Klotz (uklotzde-deactivatedaccount)]

Could also be a race condition. At first sight access to m_encoder is not thread-safe, i.e. the pointer could be reset between checking and dereferencing it.

I don't see any clear thread boundaries in this object. Probably much more bugs than only this one.

[Uwe Klotz (uklotzde-deactivatedaccount)]

https://github.com/mixxxdj/mixxx/pull/3580

[Uwe Klotz (uklotzde-deactivatedaccount)]

Hopefully the issue is fixed. I will release a new version on RPMFusion soon.

Are you able to reproduce the issue reliably and build Mixxx locally? Then a quick test with fixed 2.3 branch would be helpful.

[valdikss (valdikss1)]

I'll be able to do that not earlier than on Monday.

[Uwe Klotz (uklotzde-deactivatedaccount)]

Don't mind. I have set the status to "Fix Committed" for now. Please reopen if the crash occurs again.

[Swiftb0y (swiftb0y)]

Mixxx now uses GitHub for bug tracking. This bug has been migrated to:
https://github.com/mixxxdj/mixxx/issues/10298