Rhythmbox crashed with SIGSEGV importing PLS file exported by Rhythmbox

[fleegix]

Binary package hint: rhythmbox

Binary package hint: rhythmbox

Export a playlist as a PLS file, import it, Rhythmbox segfaults with this error in /var/log/messages:

kernel: [ 376.914560] rhythmbox[9050]: segfault at 080c45fd eip 08410b68 esp bfbf06ac error 7

This is Rhythmbox 0.11.5 (Hardy)

Files are on an NFS mount that *is already mounted* when Rhythmbox is launched. Playlists populated by dragging in files from the NFS mount play just fine.

It makes no difference whether the filepaths in the PLS file use symlinks or not. It crashes Rhythmbox either way.

ProblemType: Crash
Architecture: i386
CrashCounter: 1
Date: Thu May 29 13:41:31 2008
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/bin/rhythmbox
NonfreeKernelModules: nvidia
Package: rhythmbox 0.11.5-0ubuntu6
PackageArchitecture: i386
ProcCmdline: rhythmbox
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: rhythmbox
Stacktrace: #0 0x08410b68 in ?? ()
StacktraceTop: ?? ()
ThreadStacktrace:

Title: rhythmbox crashed with SIGSEGV
Uname: Linux 2.6.24-17-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy fuse lpadmin plugdev video

[fleegix (mde)]

Asking novice/naive users to edit a file in /etc is a horrible barrier to entry for reporting bugs.

If you're going to unilaterally/automatically invalidate perfectly good bug reports because they don't have this extra data, you need to enable a GUI way for people to turn apport on.

Seriously, bad call, guys.

[Apport retracing service (apport)]

StacktraceTop:?? ()

[Pedro Villavicencio (pedro)]

Thanks for your bug report. Please try to obtain a backtrace http://wiki.ubuntu.com/DebuggingProgramCrash and attach the file to the bug report. This will greatly help us in tracking down your problem.

[Sebastien Bacher (seb128)]

We are closing this bug report as it lacks the information, described in the previous comments, we need to investigate the problem further. However, please reopen it if you can give us the missing information and don't hesitate to submit bug reports in the future.

[fleegix (mde)]

Here's the stacktrace. I went through the steps to create it manually, as the link specified. Does this mean the built-in crash reporting tools aren't even giving you what you need?

Please let me know if there's more info I can provide. Importing playlists seems like a pretty fundamental feature for a music player. :)

[Kees Cook (kees)]

This is due to a mismatch between the signal definition and the signal arguments passed by rhythmbox:

rhythmbox-0.11.5/shell/rb-playlist-manager.c:

playlist_load_ended_cb (TotemPlParser *parser, const char *uri, GHashTable *metadata, RBPlaylistManager *mgr)

...
                g_signal_connect_object (parser, "playlist-ended",

                                         G_CALLBACK (playlist_load_ended_cb),

                                         mgr, 0);

totem-pl-parser-2.22.3/plparse/totem-pl-parser.c:

        totem_pl_parser_table_signals[PLAYLIST_ENDED] =

                g_signal_new ("playlist-ended",

                              G_TYPE_FROM_CLASS (klass),

                              G_SIGNAL_RUN_LAST,

                              G_STRUCT_OFFSET (TotemPlParserClass, playlist_ended),

                              NULL, NULL,

                              g_cclosure_marshal_VOID__STRING,

                              G_TYPE_NONE, 1, G_TYPE_STRING);

"metadata" is not valid, and will crash when opening _any_ playlist.

[Kees Cook (kees)]

Attaching my retraced backtrace...

[Pedro Villavicencio (pedro)]

trace matches http://bugzilla.gnome.org/show_bug.cgi?id=525901 ; which is fixed upstream now, thanks.

[Sebastien Bacher (seb128)]

the new 0.11.5.90 version uploaded to intrepid fixes the issue, closing the bug

[Till Ulen (tillulen)]

On Fri, Jun 27, 2008 at 23:08, Kees Cook wrote:
>
> Thanks for the bug report. This is actually not a security problem, but
> rather an unusual looking crash in the heap, and has already been
> reported. I am marking this as a duplicate. Please feel free to report
> any other issues you might find.

Kees, thanks for your comment.

Do you mean it is not exploitable so that arbitrary code execution is
impossible?

If a user opens a malicious playlist file, the worst that can happen
is that her Rhythmbox would just crash. Is that correct?

References:
https://bugs.launchpad.net/ubuntu/+source/rhythmbox/+bug/243488 (duplicate)
https://bugs.launchpad.net/ubuntu/+source/rhythmbox/+bug/235829

[Kees Cook (kees)]

That's correct. I see no evidence of the dereference being 3rd party controllable.