vlc vumeter crashes in vuMeter_run()

[James Plate]

Release of Ubuntu:
Description: Ubuntu precise (development branch)
Release: 12.04

Package Version:
vlc:
  Installed: 2.0.0-4
  Candidate: 2.0.0-4
  Version table:
 *** 2.0.0-4 0
        500 http://ca.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages
        100 /var/lib/dpkg/status

#0 0x00007fe1bdeab46f in vuMeter_Run (p_effect=<optimized out>, p_aout=<optimized out>, p_buffer=<optimized out>, p_picture=0x7fe1c8260ee0) at effects.c:962
        i = 142
        k = <optimized out>
        j = <optimized out>
        i_value_l = <optimized out>
        i_value_r = <optimized out>
        i_value = <optimized out>
        x = 143
        y = <optimized out>
        teta = <optimized out>
        teta_grad = <optimized out>
        start_x = <optimized out>
#1 0x00007fe1bdea741c in DoWork (p_filter=0x7fe1cc027b28, p_in_buf=0x7fe1cc0a7f00) at visual.c:347
        i = <optimized out>
        p_sys = 0x7fe1cc016140
        p_outpic = 0x7fe1c8260ee0

Expected Results: That the enabled audio visualization would work as expected.
Actual Results: VLC crashed.

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: vlc-nox 2.0.0-4
ProcVersionSignature: Ubuntu 3.2.0-19.31-generic 3.2.12
Uname: Linux 3.2.0-19-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 1.94.1-0ubuntu2
Architecture: amd64
Date: Thu Mar 22 19:38:47 2012
ExecutablePath: /usr/bin/vlc
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120309)
ProcCmdline: /usr/bin/vlc
ProcEnviron:
 LANGUAGE=en_CA:en
 LANG=en_CA.UTF-8
 SHELL=/bin/bash
SegvAnalysis:
 Segfault happened at: 0x7fe1bdeab46f: movb $0xac,0x0(%rbp,%rax,1)
 PC (0x7fe1bdeab46f) ok
 source "$0xac" ok
 destination "0x0(%rbp,%rax,1)" (0x7fe1bb207167) in non-writable VMA region: 0x7fe1bb207000-0x7fe1bb209000 r-xp /usr/lib/vlc/plugins/misc/libxdg_screensaver_plugin.so
 Stack memory exhausted (SP below stack segment)
SegvReason: writing VMA /usr/lib/vlc/plugins/misc/libxdg_screensaver_plugin.so
Signal: 11
SourcePackage: vlc
StacktraceTop:
 ?? () from /usr/lib/vlc/plugins/visualization/libvisual_plugin.so
 ?? () from /usr/lib/vlc/plugins/visualization/libvisual_plugin.so
 ?? () from /usr/lib/libvlccore.so.5
 ?? () from /usr/lib/libvlccore.so.5
 ?? () from /usr/lib/libvlccore.so.5
Title: vlc crashed with SIGSEGV
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 vuMeter_Run (p_effect=<optimized out>, p_aout=<optimized out>, p_buffer=<optimized out>, p_picture=0x7fe1c8260ee0) at effects.c:962
 DoWork (p_filter=0x7fe1cc027b28, p_in_buf=0x7fe1cc0a7f00) at visual.c:347
 aout_FiltersPlay (pp_filters=0x7fe1cc007a18, i_nb_filters=4, pp_block=0x7fe1f8502c68) at audio_output/filters.c:217
 aout_InputPlay (p_aout=0x7fe1cc002b68, p_input=0x7fe1cc007a10, p_buffer=0x7fe1cc01c0e0, i_input_rate=1000, date=<optimized out>) at audio_output/input.c:450
 aout_DecPlay (p_aout=0x7fe1cc002b68, p_buffer=0x7fe1cc01c0e0, i_input_rate=1000) at audio_output/dec.c:305

[Bryce Harrington (bryce)]

        for ( int i = 0; i <= 150; i++ )
        {
            y = i * cos(teta) + 20;
            x = i * sin(teta) + start_x + 240 * j;
            *(p_picture->p[0].p_pixels +
                    (p_picture->p[0].i_lines - y - 1 ) * p_picture->p[0].i_pitch
                    + x ) = 0xAD;
            *(p_picture->p[1].p_pixels +
                    (p_picture->p[1].i_lines - y / 2 - 1 ) * p_picture->p[1].i_pitch
                    + x / 2 ) = 0xFC;
            *(p_picture->p[2].p_pixels +
                    (p_picture->p[2].i_lines - y / 2 - 1 ) * p_picture->p[2].i_pitch
                    + x / 2 ) = 0xAC; /* <-- crashes here */
        }

Unfortunately most of the variables are optimized out of the backtrace, but presumably the calculated pointer value there is incorrect.

This crash was reported against 2.0.0, but the effects.c code file has not changed in Precise's 2.0.1, and is the same with current upstream head.

Are you able to reproduce this bug easily? If so, can you describe the steps needed to reproduce it?

[Rémi Denis-Courmont (rdenis)]

What's the picture chroma? The code seems to assume triplanar YUV 4:2:0. I wouldn't be surprised if it crashes due to a chroma mismatch.

[Rémi Denis-Courmont (rdenis)]

Nevermind, vumeter can decide on the chroma anyway.

[Rémi Denis-Courmont (rdenis)]

Please provide the verbose VLC logs. We are unable to reproduce and investigate the problem out of the blue.

[Rémi Denis-Courmont (rdenis)]

Ping...