Shotwell SIGSEGV in LibRaw::sony_arw_load_raw()

[Timo Witte]

Binary package hint: shotwell

This seems to happen on some destroyed .ARW files (my SD-Card is corrupt).. Shotwell crashes with SIGSEGV, the Problem should be in libraw-dev i looked over the function but couldn´t find anything suspicious...

Couldn´t find a libraw-dbg package :(

here is a backtrace from GDB:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffcaffd700 (LWP 16940)]
0x000000000066ffb2 in LibRaw::sony_arw_load_raw() ()
(gdb) bt
#0 0x000000000066ffb2 in LibRaw::sony_arw_load_raw() ()
#1 0x0000000000665f26 in LibRaw::unpack() ()
#2 0x00000000005f1e44 in graw_processor_unpack ()
#3 0x00000000005f6bcd in ?? ()
#4 0x00000000005e97ab in photo_file_interrogator_interrogate ()
#5 0x00000000004d81bc in photo_prepare_for_import ()
#6 0x0000000000501cc1 in ?? ()
#7 0x000000000057ff8a in ?? ()
#8 0x00007ffff2723db6 in g_thread_pool_thread_proxy (data=<value optimised out>) at /build/buildd/glib2.0-2.27.90/glib/gthreadpool.c:319
#9 0x00007ffff2721684 in g_thread_create_proxy (data=0x3c31f20) at /build/buildd/glib2.0-2.27.90/glib/gthread.c:1897
#10 0x00007ffff1f83d8c in start_thread (arg=0x7fffcaffd700) at pthread_create.c:304
#11 0x00007ffff1cda61d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#12 0x0000000000000000 in ?? ()

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: shotwell 0.8.0-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.37-12.26-generic 2.6.37
Uname: Linux 2.6.37-12-generic x86_64
NonfreeKernelModules: fglrx
Architecture: amd64
CheckboxSubmission: f27e0f64e4c4a50e8fcdb1738914010b
CheckboxSystem: 4ed15c40009aa6f7770f606350a390a2
Date: Wed Jan 12 01:39:13 2011
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64 (20100429)
ProcEnviron:
 LANGUAGE=de_DE:de:en_GB:en
 PATH=(custom, user)
 LANG=de_DE.UTF-8
 LC_MESSAGES=de_DE.utf8
 SHELL=/bin/bash
SourcePackage: shotwell

[Timo Witte (spacefish)]

hmpf how could i link this to the libraw package?

[Jim Nelson (yorba-jim)]

Could you attach a sample ARW file to this ticket that causes this problem?

[Timo Witte (spacefish)]

I will try to find the file, because this happens when i use the "autoimport" feature shotwell goes over a few thousand files.. maybe i can do a strace to find the file. I will do it this evening because i am at the university right now learning ;)

[Jim Nelson (yorba-jim)]

So, this doesn't happen on any .ARW file, just a particular one?

One way you can find the file is to do this:

Run Shotwell from the console like this:

$ SHOTWELL_LOG=1 shotwell

Import all the photos you did before. When it crashes, upload the following file to this ticket:

~/.cache/shotwell/shotwell.log

If you open this file, you should see all the file names as they're imported. It's probably the last one or the second-to-last one that caused the problem.

[Timo Witte (spacefish)]

i have attached the problematic ARW file, but it´s pretty large!!

[Timo Witte (spacefish)]

i have started shotwell with SHOTWELL_LOG=1 but nothing interesting in the logfile.. things the error happens before shotwell writes the log.. the 2 files in the last lines are 0 byte .jpg files.

[Jim Nelson (yorba-jim)]

Hi Timo,

I'm unable to reproduce this at all. Both the ARW file you sent me and attempting to import 2 zero-byte files works fine. (Obviously Shotwell doesn't import the zero-byte files, but it doesn't crash either.)

Are you still seeing this problem? Also, 0.8.1 is now available on our PPA. It would be wise to upgrade to that (if you haven't already).

[Timo Witte (spacefish)]

hm problem still happens on my box.. Maybe this is a problem with localisation? apport catched the crash after i updated my box to the newest packages.. in the section SegvAnalysis it says something about the file "/usr/share/locale-langpack/de/LC_MESSAGES/libexif-12.mo" i have uploaded the apport report in bug 706138 you can see it there..

[Timo Witte (spacefish)]

SegvAnalysis:
 Segfault happened at: 0x6703a2 <_ZN6LibRaw17sony_arw_load_rawEv+562>: mov %r14w,(%rdx,%rsi,1)
 PC (0x006703a2) ok
 source "%r14w" ok
 destination "(%rdx,%rsi,1)" (0x7f8d231a5acc) in non-writable VMA region: 0x7f8d231a4000-0x7f8d231c0000 r--p /usr/share/locale-langpack/de/LC_MESSAGES/libexif-12.mo
 Stack memory exhausted (SP below stack segment)
SegvReason: writing VMA /usr/share/locale-langpack/de/LC_MESSAGES/libexif-12.mo
Signal: 11

[Adam Dingle (adam-yorba)]

Timo,

to be clear, if you start Shotwell with an empty library (e.g. 'shotwell -d ~/foo') and then import the single ARW file you attached to this ticket, does the SIGSEGV still occur?

adam

[Timo Witte (spacefish)]

ok i attached the wrong ARW file.. it happens with the file DSC04825.ARW not DSC04823.ARW shotwell crashes when i open DSC04823.ARW because it preloads DSC04825.ARW. I attached the right .ARW file to this Comment and uploaded it here: http://files.spacefish.biz/DSC04825.ARW aswell

[Timo Witte (spacefish)]

as i understand the code, the sony_arw_load_raw() function uses the BAYER(row,col) macro to write to a VMA region and the calculated offset is out of range.. I think this happens because the size given in the header of the arw file isn´t right because some part of the arw file is missing.. because libraw/dcraw uses the header information it tries to write / read to a area which is outside the mmaped area. But i just guessed the later.

I can´t find a specification of the sony .arw file format / header format on the net, to check the damaged file for possible differences in header / content information...

[Adam Dingle (adam-yorba)]

Timo,

thanks for this latest ARW file. With this file, I can reproduce your crash when Shotwell is built with libraw 0.9 (the version currently in Ubuntu 11.04). When I build Shotwell with libraw 0.13 (the latest release), however, your photo imports without a problem. So I believe this bug has been fixed in libraw.

We have an upstream ticket (http://trac.yorba.org/ticket/2583) for updating the Shotwell build in the Yorba PPA to use the latest libraw. We will also ask Ubuntu to update their libraw version as well.

[Timo Witte (spacefish)]

Thanks for testing it. Hope Yorba will update their libraw as soon as possible. They could also update to 0.13.1 which is currently stable (the ticket says 0.12). I have compiled shotwell with 0.13.1 and it works for me now!

[Timo Witte (spacefish)]

sry.. the ticket say 0.13 ;) just missed the title

[Timo Witte (spacefish)]

http://git.debian.org/?p=collab-maint/libraw.git;a=commit;h=772aec4ba41d9adc4cc013c0ed1899946bd11884 Luca Falavigna added the 0.13.1 version to debian 15 hours ago. Think we just have to import that package and change the build-deps for shotwell?!

[Adam Dingle (adam-yorba)]

Yesterday I asked Robert Ancell from Canonical to update libraw to 0.13 in natty and he went ahead and did that. (I'm not sure whether the Debian update you mentioned is related to that.) Because libraw is statically linked into Shotwell, Ubuntu will also need to rebuild Shotwell for Natty now that libraw has been updated. So I've asked them to rebuild Shotwell as well. Once that happens we should be able to close this bug.

[Omer Akram (om26er)]

shotwell (0.8.1-0ubuntu3) natty; urgency=low

  * Rebuild against libraw 0.13.1
 -- Robert Ancell <email address hidden> Wed, 09 Feb 2011 16:04:57 +1100