gnome-control-center crashes when choosing sound effects

[Roland Mueller]

while i clicked between the different sound effects it suddenly crashed.

i could reproduce it, after 4 times selecting another sound effect it crashes, also when the alert volume was "off".

ProblemType: Crash
DistroRelease: Ubuntu 13.10
Package: gnome-control-center 1:3.6.3-0ubuntu41
ProcVersionSignature: Ubuntu 3.11.0-8.15-generic 3.11.1
Uname: Linux 3.11.0-8-generic x86_64
ApportVersion: 2.12.5-0ubuntu1
Architecture: amd64
AssertionMessage: *** Error in `gnome-control-center': munmap_chunk(): invalid pointer: 0x00000000034a2050 ***
Date: Mon Oct 7 23:55:09 2013
ExecutablePath: /usr/bin/gnome-control-center
InstallationDate: Installed on 2013-10-07 (0 days ago)
InstallationMedia: Ubuntu-GNOME 13.10 "Saucy Salamander" - Beta amd64 (20130926)
MarkForUpload: True
ProcCmdline: gnome-control-center --overview
Signal: 6
SourcePackage: gnome-control-center
StacktraceTop:
 __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f5138936740 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
 malloc_printerr (action=3, str=0x7f5138936ab8 "munmap_chunk(): invalid pointer", ptr=<optimized out>) at malloc.c:4923
 ?? () from /usr/lib/x86_64-linux-gnu/control-center-1/panels/libsound.so
 g_cclosure_marshal_VOID__STRINGv () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
Title: [sound]: gnome-control-center assert failure: *** Error in `gnome-control-center': munmap_chunk(): invalid pointer: 0x00000000034a2050 ***
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip libvirtd lpadmin plugdev sambashare sudo
usr_lib_gnome-control-center: deja-dup 27.3.1-0ubuntu1

[Impact]

 * When user change the sound effect from Default to others and then change it back the gnome-control-center will crash.

[Test Case]

 * open gnome-control-center
 * enter Sound item
 * choose Sound Effects tab
 * choose Default
 * choose Bark
 * choose Default
 * see the crash

[Regression Potential]

 * The fix simply NULL a pointer to avoid memory corruption. So I think it's safe enough.

[Apport retracing service (apport)]

StacktraceTop:
 __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f5138936740 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
 malloc_printerr (action=3, str=0x7f5138936ab8 "munmap_chunk(): invalid pointer", ptr=<optimized out>) at malloc.c:4923
 update_theme (chooser=0x3384db0) at gvc-sound-theme-chooser.c:674
 g_cclosure_marshal_VOID__STRINGv (closure=0x33991f0, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x3307560) at /build/buildd/glib2.0-2.38.0/./gobject/gmarshal.c:1004
 _g_closure_invoke_va (closure=0x33991f0, return_value=0x0, instance=0x32f4f00, args=0x7fff487c6438, n_params=1, param_types=0x3307560) at /build/buildd/glib2.0-2.38.0/./gobject/gclosure.c:840

[Madper Xie (bbboson)]

Upstream fix works well for me: https://bug697555.bugzilla-attachments.gnome.org/attachment.cgi?id=240948

[Ara Pulido (ara)]

Is this happening in Trusty?

[Sebastien Bacher (seb128)]

The code change doesn't seem to be in unity-control-center, do you think you could submit a merge request with it? (note that we currently have 1 sound listed only so it's not likely an issue in practice for most users)

The upstream commit to backport is
https://git.gnome.org/browse/gnome-control-center/commit/?h=gnome-3-8&id=ff00679b0972f649014aa42e85755fdd8a21cd95

[Madper Xie (bbboson)]

I pushed the fix. And I received the email tell me it is approved.
"the vcs to use is lp:~ubuntu-desktop/gnome-control-center/precise (see debian/control), I've merged there and uploaded for you"

[Nidal R (nidalr)]

So is this bug still unfixed or is someone gonna close it?

[Madper Xie (bbboson)]

The issue can be only found in gnome-control-center. Unity-control-center won't load extra sound themes by some reason. (by design or a bug? not sure.) So user won't trigger the crash in trusty.
However seems Ara think the behavior of unity-control-center is a bug and plan to fix it in future. I'm glad to push the fix to trusty and Utopic.

[Chris Halse Rogers (raof)]

Hello Roland, or anyone else affected,

Accepted gnome-control-center into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/gnome-control-center/1:3.4.2-0ubuntu0.13.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris Halse Rogers (raof)]

Normally we'd want the bug to contain the information found in https://wiki.ubuntu.com/StableReleaseUpdates#SRU_Bug_Template , but since the code change here is simple and clearly not incorrect, I've accepted anyway.

[Madper Xie (bbboson)]

In precise:
with old version of gnome-control-center the bug will be trigger every time.
with gnome-control-center 1:3.4.2-0ubuntu0.13.2 I tested more than 50 times and no crash happen.
In trust:
Tested more than 20 times and can't reproduce it. (my version is 1:3.6.3-0ubuntu56.1 ).

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for gnome-control-center has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnome-control-center - 1:3.4.2-0ubuntu0.13.3

---------------
gnome-control-center (1:3.4.2-0ubuntu0.13.3) precise; urgency=medium

  * sound: fix potential memory corruption (LP: #1236612)
 -- Madper Xie <email address hidden> Mon, 07 Jul 2014 13:41:57 +0800