Player crashes when adding a certain audio CD

[Missingmew]

Steps to reproduce the problem

Launch deadbeef, file->add audio-cd

What's going on? Describe the problem in as much detail as possible.

When adding a specific audio-cd, deadbeef crashes (this is currently the only disc that does this, out of about 30 which i have played so far)
I tried disabling freeDB in the cdplayer plugin (to check if its interfering) but crashes still occur
Playing the disc using VLC and ripping with cdparanoia work fine

Information about the software:

Deadbeef version: latest git (pulled and built on 10.03.18)
OS: linux
Backtrace produced by gdb as per wiki page:

Thread 1 "deadbeef-gtkui" received signal SIGSEGV, Segmentation fault.
0x00007ffff7331cc0 in _IO_vfprintf_internal (s=s@entry=0x7fffffffafd0, format=<optimized out>, format@entry=0x7fffee4484a5 "%s", ap=ap@entry=0x7fffffffb108) at vfprintf.c:1632
1632	vfprintf.c: Datei oder Verzeichnis nicht gefunden.
(gdb) thread apply all backtrace

Thread 11 (Thread 0x7fffd35c2700 (LWP 14785)):
#0  0x00007ffff73de74d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff4fc938c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007ffff4fc9712 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff438a9d6 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#4  0x00007ffff4fefbb5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007ffff76b46ba in start_thread (arg=0x7fffd35c2700) at pthread_create.c:333
#6  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 10 (Thread 0x7fffd3dc3700 (LWP 14784)):
#0  0x00007ffff73de74d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff4fc938c in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007ffff4fc949c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff4fc94d9 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007ffff4fefbb5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007ffff76b46ba in start_thread (arg=0x7fffd3dc3700) at pthread_create.c:333
#6  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 9 (Thread 0x7fffeb1f5700 (LWP 14783)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007ffff6a23d6b in loading_thread (none=<optimized out>) at coverart.c:405
#2  0x00007ffff76b46ba in start_thread (arg=0x7fffeb1f5700) at pthread_create.c:333
#3  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 8 (Thread 0x7fffed5f9700 (LWP 14782)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x0000000000419b01 in cond_wait (c=7341168, m=7341120) at threading_pthread.c:218
#2  0x0000000000418727 in messagepump_wait () at messagepump.c:129
#3  0x00000000004054b0 in player_mainloop () at main.c:709
#4  0x0000000000405639 in mainloop_thread (ctx=<optimized out>) at main.c:830
#5  0x00007ffff76b46ba in start_thread (arg=0x7fffed5f9700) at pthread_create.c:333
#6  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 7 (Thread 0x7fffeddfa700 (LWP 14781)):
#0  0x00007ffff73e05d3 in select () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000405197 in server_loop (ctx=<optimized out>) at main.c:586
#2  0x00007ffff76b46ba in start_thread (arg=0x7fffeddfa700) at pthread_create.c:333
#3  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 6 (Thread 0x7fffd89a6700 (LWP 14780)):
#0  0x00007ffff73af30d in nanosleep () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff73e0d94 in usleep (useconds=useconds@entry=50000) at ../sysdeps/posix/usleep.c:32
#2  0x0000000000415224 in streamer_thread (ctx=<optimized out>) at streamer.c:1470
#3  0x00007ffff76b46ba in start_thread (arg=0x7fffd89a6700) at pthread_create.c:333
#4  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 5 (Thread 0x7fffd91a7700 (LWP 14779)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x0000000000419b01 in cond_wait (c=7955680, m=7955632) at threading_pthread.c:218
#2  0x00007fffe5756bb8 in lfm_thread (ctx=<optimized out>) at lastfm.c:734
#3  0x00007ffff76b46ba in start_thread (arg=0x7fffd91a7700) at pthread_create.c:333
#4  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 4 (Thread 0x7fffd99a8700 (LWP 14778)):
#0  0x00007ffff73af30d in nanosleep () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff73e0d94 in usleep (useconds=useconds@entry=200000) at ../sysdeps/posix/usleep.c:32
#2  0x00007fffe5c3111f in hotkeys_event_loop (unused=<optimized out>) at hotkeys.c:498
#3  0x00007ffff76b46ba in start_thread (arg=0x7fffd99a8700) at pthread_create.c:333
#4  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 3 (Thread 0x7fffda1a9700 (LWP 14777)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
#1  0x00007fffeef3dbee in cache_cleaner_thread (none=<optimized out>) at cache.c:182
#2  0x00007ffff76b46ba in start_thread (arg=0x7fffda1a9700) at pthread_create.c:333
#3  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 2 (Thread 0x7fffda9aa700 (LWP 14776)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007fffeef3d461 in fetcher_thread (none=<optimized out>) at artwork.c:1838
#2  0x00007ffff76b46ba in start_thread (arg=0x7fffda9aa700) at pthread_create.c:333
#3  0x00007ffff73ea41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

---Type <return> to continue, or q <return> to quit---
Thread 1 (Thread 0x7ffff7fbc700 (LWP 14772)):
#0  0x00007ffff7331cc0 in _IO_vfprintf_internal (s=s@entry=0x7fffffffafd0, format=<optimized out>, format@entry=0x7fffee4484a5 "%s", ap=ap@entry=0x7fffffffb108) at vfprintf.c:1632
#1  0x00007ffff73f9754 in ___vsprintf_chk (s=0x7fffffffb250 "Childrens Music", flags=1, slen=256, format=0x7fffee4484a5 "%s", args=args@entry=0x7fffffffb108) at vsprintf_chk.c:82
#2  0x00007ffff73f96ad in ___sprintf_chk (s=<optimized out>, flags=<optimized out>, slen=<optimized out>, format=<optimized out>) at sprintf_chk.c:31
#3  0x00007fffee4395da in ?? () from /usr/lib/x86_64-linux-gnu/libcdio.so.13
#4  0x00007fffee4447fa in ?? () from /usr/lib/x86_64-linux-gnu/libcdio.so.13
#5  0x00007fffee437fa6 in ?? () from /usr/lib/x86_64-linux-gnu/libcdio.so.13
#6  0x00007fffee65a763 in read_disc_cdtext (tracks=25 '\031', items=0xb4f920, cdio=0xb4e140) at cdda.c:621
#7  insert_disc (plt=plt@entry=0x796740, after=0xb536e0, after@entry=0x7ab670, path=path@entry=0xb493d0 "/dev/cdrom", single_track=<optimized out>, cdio=cdio@entry=0xb4e140) at cdda.c:700
#8  0x00007fffee65add2 in cda_insert (plt=0x796740, after=0x7ab670, path=0x7fffffffca00 "/dev/cdrom/all.cda") at cdda.c:788
#9  0x000000000040b5fa in plt_insert_file_int (visibility=0, playlist=0x796740, after=0x7ab670, fname=0x7fffffffca00 "/dev/cdrom/all.cda", pabort=pabort@entry=0x7fffffffc9e4, cb=0x0, user_data=0x0) at playlist.c:991
#10 0x0000000000410ba2 in plt_add_file_int (user_data=<optimized out>, cb=<optimized out>, fname=<optimized out>, plt=<optimized out>, visibility=<optimized out>) at playlist.c:1247
#11 plt_add_file2 (visibility=<optimized out>, plt=<optimized out>, fname=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at playlist.c:3640
#12 0x00007fffee659838 in cda_action_add_cd (act=<optimized out>, ctx=<optimized out>) at cdda.c:878
#13 0x00007ffff6a2ea7d in menu_action_cb (ctx=<optimized out>) at actions.c:47
#14 0x00007ffff60b4d57 in gdk_threads_dispatch (data=0xa09b20) at /build/gtk+2.0-jJZIsQ/gtk+2.0-2.24.30/gdk/gdk.c:534
#15 0x00007ffff4fc904a in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007ffff4fc93f0 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007ffff4fc9712 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007ffff647c697 in IA__gtk_main () at /build/gtk+2.0-jJZIsQ/gtk+2.0-2.24.30/gtk/gtkmain.c:1282
#19 0x00007ffff69f4bd6 in gtkui_thread (ctx=ctx@entry=0x0) at gtkui.c:1404
#20 0x00007ffff69f4c72 in gtkui_start () at gtkui.c:1527
#21 0x0000000000403d1c in main (argc=<optimized out>, argv=<optimized out>) at main.c:1207

[Lithopsian]

So its reading cdtext, which is probably why it only happens very rarely. Very few CDs have this. The most likely cause here is that the CD has an unexpected genre field in its CD-text, or possibly more than one genre field. Looks like the valid genre "Childrens Music" has already been filled in, but it is still trying to read another genre. libcdio doesn't have much in the way of internal checks, it just assumes the cdtext data is all good.

The version of cdtext.c that I downloaded to look at does appear to have a bug. The array of genre text strings is one shorter than the one in the specification. "Soundtrack" is missing, which I think means that the code 0x001a for "Spoken Word" will result in the string "World Music" and the code 0x001b for "World Music" will result in an undefined pointer. Surely someone would have spotted that if it really is a problem?

[Oleksiy-Yakovenko]

Out of date / needs to be re-tested.