Segfault playing faad m4a file

[Daniel Schürmann]

Mixxx crashes, trying to play
https://github.com/Excito/libaudio-scan-perl/blob/master/t/mp4/array-keys-int.m4a

Debug [Main]: Auto DJ enabled
Read: "/home/daniel/workspace/t/libaudio-scan-perl-master/t/mp4/array-keys-int.m4a": stsd inconsistency with number of entries
ReadAtom: "/home/daniel/workspace/t/libaudio-scan-perl-master/t/mp4/array-keys-int.m4a": invalid atom size, extends outside parent atom - skipping to end of "" "mdat" 5848240 vs 135015
GetTrackMediaDataName: "/home/daniel/workspace/t/libaudio-scan-perl-master/t/mp4/array-keys-int.m4a": track 1 has more than 1 child atoms in stsd

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb68ee700 (LWP 13856)]
__strcasecmp_l_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:209
209 ../sysdeps/x86_64/multiarch/../strcmp.S: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0 __strcasecmp_l_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:209
#1 0x00007fffd1b1c14c in findFirstAudioTrackId (hFile=0x7fffb0002ce0)
    at plugins/soundsourcem4a/soundsourcem4a.cpp:72
#2 Mixxx::SoundSourceM4A::tryOpen (this=0x7fffb0002b00, audioSrcCfg=...)
    at plugins/soundsourcem4a/soundsourcem4a.cpp:123
#3 0x0000000000ac630e in Mixxx::SoundSource::open (this=0x7fffb0002b00,
    audioSrcCfg=...) at src/sources/soundsource.cpp:28
#4 0x0000000000ac4745 in SoundSourceProxy::openAudioSource (
    this=this@entry=0x7fffb68edd00, audioSrcCfg=...)
    at src/soundsourceproxy.cpp:152
#5 0x00000000004df97b in openAudioSourceForReading (audioSrcCfg=...,
    pTrack=...) at src/cachingreaderworker.cpp:154
#6 CachingReaderWorker::loadTrack (this=this@entry=0x1e76ef0, pTrack=...)
    at src/cachingreaderworker.cpp:189
#7 0x00000000004e0c5b in CachingReaderWorker::run (this=0x1e76ef0)
    at src/cachingreaderworker.cpp:137
#8 0x00007ffff540032f in ?? () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#9 0x00007ffff31e6182 in start_thread (arg=0x7fffb68ee700)
    at pthread_create.c:312
#10 0x00007ffff189247d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb)

[Uwe Klotz (uklotzde-deactivatedaccount)]

No crash on Fedora 22/x86_64 on master + all my open PRs. Both FAAD2 and FFmpeg refuse to open the file. I see the following log messages:

Debug [Main]: Obtained SoundSource for "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" from provider "Nero FAAD2"
Debug [Main]: Reading tags from file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" of type "mp4"
Warning [Main]: Failed to read track metadata from file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Warning [Main]: Failed to parse track metadata from file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Debug [Main]: WCoverArt::slotCoverFound WCoverArt(0x5193460) "CoverInfo(NONE,GUESSED,,0,/home/uk/Music/Corrupt Tracks (Link)/array-keys-int.m4a)" QSize(0, 0)
Debug [CachingReaderWorker 1]: Obtained SoundSource for "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" from provider "Nero FAAD2"
ReadAtom: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a": invalid atom size, extends outside parent atom - skipping to end of "" "!DOC" 168430140 vs 40983
ReadAtom: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a": atom type !DOC is suspect
ReadChildAtoms: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a": In atom missing child atom moov
FindIntegerProperty: no such property - moov.mvhd.modificationTime (src/mp4file.cpp,746)
Warning [CachingReaderWorker 1]: Failed to open file for reading: "file:///home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Warning [CachingReaderWorker 1]: Failed to open AudioSource for file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" with provider "Nero FAAD2"
Debug [CachingReaderWorker 1]: Obtained SoundSource for "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" from provider "FFmpeg"
Debug [CachingReaderWorker 1]: New SoundSourceFFmpeg : "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f99d0003620] Format mov,mp4,m4a,3gp,3g2,mj2 detected only with low score of 1, misdetection possible!
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f99d0003620] moov atom not found
Debug [CachingReaderWorker 1]: av_open_input_file: cannot open "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Warning [CachingReaderWorker 1]: Failed to open AudioSource for file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" with provider "FFmpeg"
Warning [CachingReaderWorker 1]: Failed to obtain SoundSource for file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Warning [CachingReaderWorker 1]: Failed to open AudioSource for file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Warning [CachingReaderWorker 1]: Failed to open file: "/home/uk/Music/Corrupt Tracks (Link)/array-keys-int.m4a"
Debug [CachingReaderWorker 1]: "[Channel1]" CachingReaderWorker::loadTrack() load failed for" "/home/uk/Music/Corrupt Tracks (Link)/array-keys-int.m4a" ", file invalid, unlocked reader lock
Debug [Main]: Failed to load track "/home/uk/Music/Corrupt Tracks (Link)/array-keys-int.m4a" "The file '/home/uk/Music/Corrupt Tracks (Link)/array-keys-int.m4a' could not be loaded."

Later I will repeat this test on plain master...

[Uwe Klotz (uklotzde-deactivatedaccount)]

I'm not able to reproduce this crash on the current master branch. The file simply fails to load:

Debug [Main]: Reading tags from file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" of type "mp4"
Warning [Main]: Failed to read track metadata from file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Debug [Main]: TrackInfoObject::parse() error at file "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Debug [Main]: WCoverArt::slotCoverFound WCoverArt(0x4dcc5d0) "CoverInfo(NONE,GUESSED,,0,/home/uk/Music/Corrupt Tracks/array-keys-int.m4a)" QSize(0, 0)
ReadAtom: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a": invalid atom size, extends outside parent atom - skipping to end of "" "!DOC" 168430140 vs 40983
ReadAtom: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a": atom type !DOC is suspect
ReadChildAtoms: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a": In atom missing child atom moov
FindIntegerProperty: no such property - moov.mvhd.modificationTime (src/mp4file.cpp,746)
Warning [CachingReaderWorker 1]: Failed to open file for reading: "file:///home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Warning [CachingReaderWorker 1]: Failed to open SoundSource
Warning [CachingReaderWorker 1]: Failed to open file: "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a"
Debug [CachingReaderWorker 1]: "[Channel1]" CachingReaderWorker::loadTrack() load failed for" "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" ", file invalid, unlocked reader lock
Debug [Main]: Failed to load track "/home/uk/Music/Corrupt Tracks/array-keys-int.m4a" "The file '/home/uk/Music/Corrupt Tracks/array-keys-int.m4a' could not be loaded."

[Uwe Klotz (uklotzde-deactivatedaccount)]

But a nullptr/NULL check was definitely missing before the invocation of strcasecmp(). I've pushed additional commits for the following PR that might fix this crash:
https://github.com/mixxxdj/mixxx/pull/626

[Uwe Klotz (uklotzde-deactivatedaccount)]

There was a problem with the download. After cloning the whole repository and copying the file I am able to reproduce the crash ;)

[Uwe Klotz (uklotzde-deactivatedaccount)]

Done. Crash is fixed with https://github.com/mixxxdj/mixxx/pull/626

[Swiftb0y (swiftb0y)]

Mixxx now uses GitHub for bug tracking. This bug has been migrated to:
https://github.com/mixxxdj/mixxx/issues/8134