Running espeak with mbrola voices results in error

[Amy Groshek]

1. RELEASE

amy@ThinkPad-T510:~$ lsb_release -rd
Description: Ubuntu 16.04.2 LTS
Release: 16.04

2. PACKAGE INFO

amy@ThinkPad-T510:~$ apt-cache policy espeak
espeak:
  Installed: 1.48.04+dfsg-2
  Candidate: 1.48.04+dfsg-2
  Version table:
 *** 1.48.04+dfsg-2 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 Packages
        100 /var/lib/dpkg/status
amy@ThinkPad-T510:~$ apt-cache policy mbrola
mbrola:
  Installed: 3.01h+1-3
  Candidate: 3.01h+1-3
  Version table:
 *** 3.01h+1-3 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse amd64 Packages
        100 /var/lib/dpkg/status
amy@ThinkPad-T510:~$ apt-cache policy mbrola-us1
mbrola-us1:
  Installed: 0.3-2
  Candidate: 0.3-2
  Version table:
 *** 0.3-2 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse amd64 Packages
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse i386 Packages
        100 /var/lib/dpkg/status
amy@ThinkPad-T510:~$ apt-cache policy mbrola-us2
mbrola-us2:
  Installed: 0.1-2
  Candidate: 0.1-2
  Version table:
 *** 0.1-2 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse amd64 Packages
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse i386 Packages
        100 /var/lib/dpkg/status
amy@ThinkPad-T510:~$ apt-cache policy mbrola-us3
mbrola-us3:
  Installed: 0.1-1
  Candidate: 0.1-1
  Version table:
 *** 0.1-1 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse amd64 Packages
        500 http://us.archive.ubuntu.com/ubuntu xenial/multiverse i386 Packages
        100 /var/lib/dpkg/status

3. EXPECTED

When running `espeak -v mb-us3 "Hello world"`, expected espeak to speak "Hello world" using designated mbrola voice without error.

4. ACTUAL

When running `espeak -v mb-us3 "Hello world"`, espeak speaks "Hello world" using designated mbrola voice, but terminal reports memory leak stacktrace. See below:

amy@ThinkPad-T510:/usr/share/mbrola/voices$ espeak -v mb-us3 "Hello world"
*** Error in `mbrola': free(): invalid pointer: 0x09472da0 ***
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(+0x67377)[0xf753b377]
/lib/i386-linux-gnu/libc.so.6(+0x6d2f7)[0xf75412f7]
/lib/i386-linux-gnu/libc.so.6(+0x6dbb1)[0xf7541bb1]
/lib/i386-linux-gnu/libc.so.6(_IO_wsetb+0x69)[0xf75360e9]
/lib/i386-linux-gnu/libc.so.6(+0x6bc02)[0xf753fc02]
/lib/i386-linux-gnu/libc.so.6(+0x2e93a)[0xf750293a]
/lib/i386-linux-gnu/libc.so.6(+0x2e9ef)[0xf75029ef]
mbrola(free+0x60)[0x8048c0c]
======= Memory map: ========
08048000-08050000 r-xp 00000000 08:01 23465356 /usr/bin/mbrola
08050000-08051000 rwxp 00007000 08:01 23465356 /usr/bin/mbrola
09437000-09479000 rwxp 00000000 00:00 0 [heap]
f7300000-f7321000 rwxp 00000000 00:00 0
f7321000-f7400000 ---p 00000000 00:00 0
f74d3000-f74d4000 rwxp 00000000 00:00 0
f74d4000-f7683000 r-xp 00000000 08:01 28321694 /lib/i386-linux-gnu/libc-2.23.so
f7683000-f7684000 ---p 001af000 08:01 28321694 /lib/i386-linux-gnu/libc-2.23.so
f7684000-f7686000 r-xp 001af000 08:01 28321694 /lib/i386-linux-gnu/libc-2.23.so
f7686000-f7687000 rwxp 001b1000 08:01 28321694 /lib/i386-linux-gnu/libc-2.23.so
f7687000-f768a000 rwxp 00000000 00:00 0
f768a000-f76dd000 r-xp 00000000 08:01 28321686 /lib/i386-linux-gnu/libm-2.23.so
f76dd000-f76de000 r-xp 00052000 08:01 28321686 /lib/i386-linux-gnu/libm-2.23.so
f76de000-f76df000 rwxp 00053000 08:01 28321686 /lib/i386-linux-gnu/libm-2.23.so
f76e9000-f7705000 r-xp 00000000 08:01 28319113 /lib/i386-linux-gnu/libgcc_s.so.1
f7705000-f7706000 rwxp 0001b000 08:01 28319113 /lib/i386-linux-gnu/libgcc_s.so.1
f7706000-f7709000 rwxp 00000000 00:00 0
f7709000-f770b000 r--p 00000000 00:00 0 [vvar]
f770b000-f770c000 r-xp 00000000 00:00 0 [vdso]
f770c000-f772e000 r-xp 00000000 08:01 28321698 /lib/i386-linux-gnu/ld-2.23.so
f772e000-f772f000 rwxp 00000000 00:00 0
f772f000-f7730000 r-xp 00022000 08:01 28321698 /lib/i386-linux-gnu/ld-2.23.so
f7730000-f7731000 rwxp 00023000 08:01 28321698 /lib/i386-linux-gnu/ld-2.23.so
ffeeb000-fff0d000 rwxp 00000000 00:00 0 [stack]

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: espeak 1.48.04+dfsg-2
ProcVersionSignature: Ubuntu 4.4.0-72.93-generic 4.4.49
Uname: Linux 4.4.0-72-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
CurrentDesktop: Unity
Date: Wed Apr 19 15:07:20 2017
InstallationDate: Installed on 2016-06-15 (308 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
SourcePackage: espeak
UpgradeStatus: No upgrade log present (probably fresh install)

[Paul Gevers (paul-climbing)]

For what it is worth it, I can't reproduce this in Debian Stretch,
neither with espeak, nor with espeak-ng.

paul@testavoira ~ $ /usr/bin/espeak -v mb-us3 "Hello world"
paul@testavoira ~ $ /usr/bin/espeak-ng -v mb-us3 "Hello world"
paul@testavoira ~ $

Note, espeak-ng doesn't actually speak the words, I'll file a bug about
that.

And shouldn't this bug be assigned to mbrola? The error is:
*** Error in `mbrola': free(): invalid pointer: 0x09472da0 ***

Paul

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Nikolai Försterling (thefoster)]

Same in Yakkety:
[00:54][nf@fox:~ ]$ apt-cache policy mbrola
mbrola:
  Installiert: 3.01h+1-3
  Installationskandidat: 3.01h+1-3
  Versionstabelle:
 *** 3.01h+1-3 500
        500 http://de.archive.ubuntu.com/ubuntu yakkety/multiverse amd64 Packages
        100 /var/lib/dpkg/status
[00:54][nf@fox:~ ]$ apt-cache policy espeak
espeak:
  Installiert: 1.48.04+dfsg-5
  Installationskandidat: 1.48.04+dfsg-5
  Versionstabelle:
 *** 1.48.04+dfsg-5 500
        500 http://de.archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
        100 /var/lib/dpkg/status
[00:54][nf@fox:~ ]$ lsb_release -rd
Description: Ubuntu 16.10
Release: 16.10

[Michael Noack (michael-noack-p)]

This is actually a bug in the mbrola package.

Download the test file alice.pho at https://github.com/numediart/MBROLA-voices/tree/master/data/us1/TEST and try to create a wav file using:

root@terminal:~/mbrola-test# mbrola /usr/share/mbrola/us1/us1 alice.pho test.wav
*** Error in `mbrola': double free or corruption (out): 0x08f9c9e0 ***
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(+0x67257)[0xb752a257]
/lib/i386-linux-gnu/libc.so.6(+0x6d577)[0xb7530577]
/lib/i386-linux-gnu/libc.so.6(+0x6dd31)[0xb7530d31]
/lib/i386-linux-gnu/libc.so.6(_IO_wsetb+0x69)[0xb7524fc9]
/lib/i386-linux-gnu/libc.so.6(+0x6baf2)[0xb752eaf2]
/lib/i386-linux-gnu/libc.so.6(+0x2e91a)[0xb74f191a]
/lib/i386-linux-gnu/libc.so.6(+0x2e9cf)[0xb74f19cf]
mbrola(free+0x60)[0x8048c0c]
======= Memory map: ========
08048000-08050000 r-xp 00000000 08:02 1188309 /usr/bin/mbrola
08050000-08051000 rwxp 00007000 08:02 1188309 /usr/bin/mbrola
08f6e000-08fac000 rwxp 00000000 00:00 0 [heap]
b7300000-b7321000 rwxp 00000000 00:00 0
b7321000-b7400000 ---p 00000000 00:00 0
b7490000-b74ac000 r-xp 00000000 08:02 4983464 /lib/i386-linux-gnu/libgcc_s.so.1
b74ac000-b74ad000 rwxp 0001b000 08:02 4983464 /lib/i386-linux-gnu/libgcc_s.so.1
b74c2000-b74c3000 rwxp 00000000 00:00 0
b74c3000-b7672000 r-xp 00000000 08:02 4983469 /lib/i386-linux-gnu/libc-2.23.so
b7672000-b7673000 ---p 001af000 08:02 4983469 /lib/i386-linux-gnu/libc-2.23.so
b7673000-b7675000 r-xp 001af000 08:02 4983469 /lib/i386-linux-gnu/libc-2.23.so
b7675000-b7676000 rwxp 001b1000 08:02 4983469 /lib/i386-linux-gnu/libc-2.23.so
b7676000-b7679000 rwxp 00000000 00:00 0
b7679000-b76cc000 r-xp 00000000 08:02 4983398 /lib/i386-linux-gnu/libm-2.23.so
b76cc000-b76cd000 r-xp 00052000 08:02 4983398 /lib/i386-linux-gnu/libm-2.23.so
b76cd000-b76ce000 rwxp 00053000 08:02 4983398 /lib/i386-linux-gnu/libm-2.23.so
b76e2000-b76e5000 rwxp 00000000 00:00 0
b76e5000-b76e7000 r--p 00000000 00:00 0 [vvar]
b76e7000-b76e8000 r-xp 00000000 00:00 0 [vdso]
b76e8000-b770a000 r-xp 00000000 08:02 4983282 /lib/i386-linux-gnu/ld-2.23.so
b770a000-b770b000 rwxp 00000000 00:00 0
b770b000-b770c000 r-xp 00022000 08:02 4983282 /lib/i386-linux-gnu/ld-2.23.so
b770c000-b770d000 rwxp 00023000 08:02 4983282 /lib/i386-linux-gnu/ld-2.23.so
bfc83000-bfca4000 rwxp 00000000 00:00 0 [stack]
Aborted (core dumped)

[Michael Noack (michael-noack-p)]

When cloning mbrola source and building it with gcc the result works just fine.