BPM-detection(?) segfault

[Nick]

On svn r2690, Ubuntu8.10 I'm seeing the following crash when I load the attached file:

kousu@zilliah:~/mixxx/svn$ gdb ./mixxx
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) r
Starting program: /home/kousu/mixxx/svn/mixxx
[Thread debugging using libthread_db enabled]
[New Thread 0xb64f16c0 (LWP 13583)]
Debug: [Main]: Setting up plugin paths...
Debug: [Main]: ...done.
Debug: [Main]: Mixxx 1.6.2 "(svn 2690M; built on: Mar 1 2009 @ 19:14:22; flags: hifieq ladspa vinylcontrol midiscript optimize=1) " is starting...
[New Thread 0xb3e87b90 (LWP 13587)]
[New Thread 0xb3167b90 (LWP 13588)]
Debug: [Main]: ControlObject::getControl returning NULL for ( "[Mixer Profile]" , "LoEQFrequency" )
[New Thread 0xb2188b90 (LWP 13589)]
Debug: [Main]: SampleRate 44100
Debug: [Main]: Latency 64
[New Thread 0xb1594b90 (LWP 13590)]
[Thread 0xb1594b90 (LWP 13590) exited]
[New Thread 0xb1594b90 (LWP 13591)]
[Thread 0xb1594b90 (LWP 13591) exited]
[New Thread 0xb1594b90 (LWP 13592)]
[Thread 0xb1594b90 (LWP 13592) exited]
[New Thread 0xb1594b90 (LWP 13593)]
[Thread 0xb1594b90 (LWP 13593) exited]
Debug: [Main]: createWaveformViewer()
Debug: [Main]: WaveformViewerFactory :: Creating new visual waveform
Debug: [Main]: WaveformViewerFactory :: Making new GL context.
Debug: [Main]: WaveformRenderer::setupControlObjects - VisualResample: 400
Debug: [Main]: Got bgColor QColor(ARGB 1, 0.0980392, 0.0980392, 0.0980392)
Debug: [Main]: Got signalColor QColor(ARGB 1, 0, 0.803922, 0)
Debug: [Main]: createWaveformViewer()
Debug: [Main]: WaveformViewerFactory :: Creating new visual waveform
Debug: [Main]: WaveformViewerFactory :: Sharing existing GL context.
Debug: [Main]: WaveformRenderer::setupControlObjects - VisualResample: 400
Debug: [Main]: Got bgColor QColor(ARGB 1, 0.0980392, 0.0980392, 0.0980392)
Debug: [Main]: Got signalColor QColor(ARGB 1, 0, 0.803922, 0)
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/."
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/.."
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/compressor.xml"
Debug: [Main]: LADSPA: Plugin "Compress" not found (required by preset "Compressor" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/delay5s.xml"
Debug: [Main]: LADSPA: Plugin "delay_5s" not found (required by preset "Delay5s" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/djflanger.xml"
Debug: [Main]: LADSPA: Plugin "djFlanger" not found (required by preset "DJFlanger" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/karaoke.xml"
Debug: [Main]: LADSPA: Plugin "karaoke" not found (required by preset "Karaoke" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/null.xml"
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/plate.xml"
Debug: [Main]: LADSPA: Plugin "Plate2x2" not found (required by preset "PlateReverb" )
Debug: [Main]: Setting up LADSPA EnableEffect "0"
Debug: [Main]: Key string: "EnableEffect0"
Debug: [Main]: Setting up LADSPA EnableEffect "1"
Debug: [Main]: Key string: "EnableEffect1"
Debug: [Main]: Setting up LADSPA EnableEffect "2"
Debug: [Main]: Key string: "EnableEffect2"
[New Thread 0xb1594b90 (LWP 13596)]
Debug: [Main]: Loading playlists and library tracks from XML...
Debug: [Main]: Track::readXML "/home/kousu/.mixxxtrack.xml"
Debug: [Main]: Promo track directory does not exist: "res/promo"
Debug: [Main]: Constructed LibraryScanner!!!
Debug: [Main]: No playlists, returning
Debug: [Main]: FIXME: Need to tell the m_pPlaylistListModel to refresh in src/track.cpp on line: 1363
Debug: [Main]: Trying to add 1 songs to the library playlist
Debug: [Main]: Adjusting column widths: tracktable width = 640 1% of that is: 6.4 FIXME: this should be done when initalizing the skin.
Debug: [Main]: Shrinking Title/Comment for small screen...
Debug: [Main]: FIXME: repaintEverything switches table model and shouldn't do that when viewing the playlist model in src/wtracktableview.cpp: 227
[New Thread 0xaffffb90 (LWP 13597)]
Debug: [MidiScriptEngine 1]: MidiScriptEngine::run() m_pEngine->parent() is QObject(0x0)
Debug: [MidiScriptEngine 1]: MidiScriptEngine::run() m_pEngine->thread() is MidiScriptEngine(0x9b0dc70, name = "MidiScriptEngine 1")
Debug: [Main]: MidiMapping: Loading MIDI XML from "/home/kousu/.MixxxMIDIBindings.xml"
Debug: [Main]: Could not open xml file: "/home/kousu/.MixxxMIDIBindings.xml"
[New Thread 0xaf7feb90 (LWP 13598)]
Debug: [MidiObjectALSASeq 1]: "MidiObjectAlsaSeq: Thread ID=af7feb90"
Debug: [Main]: selectedAPI is: "OSS"
Debug: [Main]: loadSettings: 1 0 "SlowFade"
Debug: [Main]: slotApply crossfader: 1 "SlowFade"
Debug: [Main]: BpmSchemes::readXML "/home/kousu/.mixxxbpmscheme.xml"
Debug: [Main]: getting midi device list, size 0 and: ""
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/."
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/.."
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/compressor.xml"
Debug: [Main]: LADSPA: Plugin "Compress" not found (required by preset "Compressor" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/delay5s.xml"
Debug: [Main]: LADSPA: Plugin "delay_5s" not found (required by preset "Delay5s" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/djflanger.xml"
Debug: [Main]: LADSPA: Plugin "djFlanger" not found (required by preset "DJFlanger" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/karaoke.xml"
Debug: [Main]: LADSPA: Plugin "karaoke" not found (required by preset "Karaoke" )
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/null.xml"
Debug: [Main]: LADSPA: file "res/skins/outlineNetbook/../../ladspa_presets/plate.xml"
Debug: [Main]: LADSPA: Plugin "Plate2x2" not found (required by preset "PlateReverb" )
Debug: [Main]: Setting up LADSPA EnableEffect "0"
Debug: [Main]: Key string: "EnableEffect0"
Debug: [Main]: Setting up LADSPA EnableEffect "1"
Debug: [Main]: Key string: "EnableEffect1"
Debug: [Main]: Setting up LADSPA EnableEffect "2"
Debug: [Main]: Key string: "EnableEffect2"
Debug: [Main]: SoundManager::setupDevices()
Debug: [Main]: Building timecode lookup tables...
Allocating 2097152 slots (8192Kb) for 20 bit timecode (Serato 2nd Ed., side A)
[New Thread 0xae7fcb90 (LWP 13599)]
Debug: [Main]: Building timecode lookup tables...
Allocating 2097152 slots (8192Kb) for 20 bit timecode (Serato 2nd Ed., side A)
[New Thread 0xad7fab90 (LWP 13600)]
Debug: [Main]: SoundDevicePortAudio::open() "0, /dev/dsp"
Debug: [Main]: m_dSampleRate 44100
Debug: [Main]: iLatencyMSec: 64
Debug: [Main]: output channels: 2 | input channels: 0
Debug: [Main]: iLatencySamples: 5648
Debug: [Main]: iFramesPerBuffer 4096
Debug: [Main]: iLatencyMSec: 64
Debug: [Main]: Opening stream with id 0
Debug: [Main]: Opened PortAudio stream successfully... starting
Debug: [Main]: Dynamically loaded PortAudio library!
[New Thread 0xacff9b90 (LWP 13601)]
Debug: [Main]: PortAudio: Started stream successfully
Debug: [Main]: iNumDevicesOpenedForOutput: 1
Debug: [Main]: iNumDevicesOpenedForInput: 0
Debug: [Main]: Displaying mixxx
Debug: [Main]: Running Mixxx
Debug: [Main]: SSMP3::ParseHeader - frames read: 15 bitrate 96
Debug: [Main]: SSMP3::ParseHeader - samplerate 22050 channels 2
Debug: [Main]: SSMP3::ParseHeader - CBR bytes per frame 314 Estimated duration 251
Debug: [Main]: Load to player2: "/home/kerry/Desktop/Hands Up Squad - Coin Operated Boy RMX.mp3"
Debug: [Reader 2]: SSMP3() :: Setting SRATE to 22050 from 0
Debug: [Reader 2]: file length 11104128 i
Debug: [Reader 2]: MAD: Recoverable frame level ERR ( bad main_data_begin pointer )
Debug: [AnalyserQueue 1]: SSMP3() :: Setting SRATE to 22050 from 0
Debug: [AnalyserQueue 1]: AnalyserWaveform: f 22050 samplesPerDownsample: 55 downsamples 201894 from 11104128
Debug: [AnalyserQueue 1]: MAD: Recoverable frame level ERR ( bad main_data_begin pointer )
Debug: [Main]: WGLWaveformViewer() << slotNewTrack()

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb1594b90 (LWP 13596)]
0x0816171f in BpmDetect::calcEnvelope (this=0x3be2dbf5, samples=0xb1533e7c, numsamples=372) at src/bpm/bpmdetect.cpp:248
248 RMSVolumeAccu *= avgdecay;
(gdb) bt
#0 0x0816171f in BpmDetect::calcEnvelope (this=0x3be2dbf5, samples=0xb1533e7c, numsamples=372) at src/bpm/bpmdetect.cpp:248
#1 0x081618ba in BpmDetect::inputSamples (this=0x3be2dbf5, samples=0x3c1c5e50, numSamples=372) at src/bpm/bpmdetect.cpp:291
#2 0xbc0f19d9 in ?? ()
Cannot access memory at address 0xbbf107b8
(gdb)

[Nick (kousu)]

This one kills it too.

[Nick (kousu)]

I did some bug hunting this afternoon. The problem is in bpm/bpmdetect.cpp::decimate(). It doesn't bounds-check the dest array (fixed at 256 bytes) as it's writing into it. The problem only shows up on these files because they have a sample rate of 22050 wheras the common rate is double that.

I don't know how to fix it, though. I don't know if I should make the size of the dest array (DECIMATED_BLOCK_SAMPLES) to depend on the sample rate, or if I should change BPM_NUM_SAMPLES to depend on the sample rate, or if I should do a mix of both or neither. I'm not familiar with this code at all, and I'm half-guessing at the math it's using and I don't want to break it.

[Albert Santoni (gamegod)]

Thanks Nick. Adam or myself will take a look at this code before the release.

On Mon, Mar 2, 2009 at 4:12 PM, Nick <email address hidden> wrote:
> I did some bug hunting this afternoon. The problem is in
> bpm/bpmdetect.cpp::decimate(). It doesn't bounds-check the dest array
> (fixed at 256 bytes) as it's writing into it. The problem only shows up
> on these files because they have a sample rate of 22050 wheras the
> common rate is double that.
>
> I don't know how to fix it, though. I don't know if I should make the
> size of the dest array (DECIMATED_BLOCK_SAMPLES) to depend on the sample
> rate, or if I should change BPM_NUM_SAMPLES to depend on the sample
> rate, or if I should do a mix of both or neither. I'm not familiar with
> this code at all, and I'm half-guessing at the math it's using and I
> don't want to break it.
>
> --
> BPM-detection(?) segfault
> https://bugs.launchpad.net/bugs/336476
> You received this bug notification because you are a member of Mixxx
> Development Team, which is subscribed to Mixxx.
>

[RJ Skerry-Ryan (rryan)]

Not sure, but I can't reproduce this after moving to SoundTouch 1.4.1. Nick, can you test this on the release branch?

[Nick (kousu)]

Well, as of bzr2328 this doesn't cause a crash on either of these tracks. It doesn't figure out their BPM either which is funny for the first one, but I suspect that's a different issue.

[Swiftb0y (swiftb0y)]

Mixxx now uses GitHub for bug tracking. This bug has been migrated to:
https://github.com/mixxxdj/mixxx/issues/5105