Albumart segfault

[skidoo23]

Bug report

Describe the bug

MPD crashes when accessing albumart.

Expected Behavior

Play music without crashing.

Actual Behavior

MPD crashes when accessing albumart.

Version

Music Player Daemon 0.23~git (v0.22.10-470-ga2387210b)
Copyright 2003-2007 Warren Dukes warren.dukes@gmail.com
Copyright 2008-2021 Max Kellermann max.kellermann@gmail.com
This is free software; see the source for copying conditions. There is NO
warranty; not even MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Database plugins:
simple proxy

Storage plugins:
local udisks

Decoders plugins:
[mad] mp3 mp2
[mpg123] mp3
[vorbis] ogg oga
[oggflac] ogg oga
[flac] flac
[opus] opus ogg oga
[sndfile] wav aiff aif au snd paf iff svx sf voc w64 pvf xi htk caf sd2
[dsdiff] dff
[dsf] dsf
[hybrid_dsd] m4a
[faad] aac
[mpcdec] mpc
[wavpack] wv
[ffmpeg] 16sv 3g2 3gp 4xm 8svx aa3 aac ac3 adx afc aif aifc aiff al alaw amr anim apc ape asf atrac au aud avi avm2 avs bap bfi c93 cak cin cmv cpk daud dct divx dts dv dvd dxa eac3 film flac flc fli fll flx flv g726 gsm gxf iss m1v m2v m2t m2ts m4a m4b m4v mad mj2 mjpeg mjpg mka mkv mlp mm mmf mov mp+ mp1 mp2 mp3 mp4 mpc mpeg mpg mpga mpp mpu mve mvi mxf nc nsv nut nuv oga ogm ogv ogx oma ogg omg opus psp pva qcp qt r3d ra ram rl2 rm rmvb roq rpl rvc shn smk snd sol son spx str swf tak tgi tgq tgv thp ts tsp tta xa xvid uv uv2 vb vid vob voc vp6 vmd wav webm wma wmv wsaud wsvga wv wve rtp:// rtsp:// rtsps://
[pcm]

Filters:
libsamplerate soxr

Tag plugins:
id3tag

Output plugins:
shout null fifo pipe alsa httpd snapcast recorder

Encoder plugins:
null vorbis opus lame wave flac

Archive plugins:
[bz2] bz2
[zzip] zip
[iso] iso

Input plugins:
file io_uring archive alsa curl ffmpeg mms

Playlist plugins:
extm3u m3u pls xspf asx rss flac cue embcue

Protocols:
file:// alsa:// ftp:// ftps:// gopher:// hls+http:// hls+https:// http:// https:// mms:// mmsh:// mmst:// mmsu:// rtmp:// rtmps:// rtmpt:// rtmpts:// rtp:// rtsp:// rtsps:// scp:// sftp:// smb:// srtp://

Other features:
avahi dbus udisks epoll icu inotify ipv6 systemd tcp un

Log

client: [1] process command "albumart "S/Lloyd Stellar - Forsaken Emotions EP/Lloyd Stellar - Forsaken Emotions EP - 04 Night Stalker.mp3" 0"
Speicherzugriffsfehler

Segmentation fault for our international readers.

[skidoo23]

client: [5] process command "albumart "S/Lloyd Stellar - Forsaken Emotions EP/Lloyd Stellar - Forsaken Emotions EP - 04 Night Stalker.mp3" "0""

Thread 1 "mpd" received signal SIGSEGV, Segmentation fault.
__strncmp_ia32 (s1=0x0, s2=0x59e9f4 "../", n=3) at ../string/strncmp.c:64
64 ../string/strncmp.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0 __strncmp_ia32 (s1=0x0, s2=0x59e9f4 "../", n=3) at ../string/strncmp.c:64
#1 0x004275c0 in StringIsEqual(char const*, char const*, size_t)
(a=0x0, b=0x59e9f4 "../", length=3) at ../src/util/StringAPI.hxx:182
#2 0x004275f0 in StringStartsWith(char const*, StringView)
(haystack=0x0, needle=...) at ../src/util/StringCompare.hxx:70
#3 0x00427616 in StringAfterPrefix(char const*, StringView)
(haystack=0x0, needle=...) at ../src/util/StringCompare.hxx:90
#4 0x00428077 in RealDirectoryOfSong(Client&, char const*, std::string_view)
(client=..., song_uri=0x898205 "S/Lloyd Stellar - Forsaken Emotions EP/Lloyd Stellar - Forsaken Emotions EP - 04 Night Stalker.mp3", directory_uri="/data/music/S/Lloyd Stellar - Forsaken Emotions EP")
at ../src/command/FileCommands.cxx:258
#5 0x004281c0 in read_db_art(Client&, Response&, char const*, uint64_t)
(client=..., r=..., uri=0x898205 "S/Lloyd Stellar - Forsaken Emotions EP/Lloyd Stellar - Forsaken Emotions EP - 04 Night Stalker.mp3", offset=0)
at ../src/command/FileCommands.cxx:280
#6 0x004282cf in handle_album_art(Client&, Request, Response&)
(client=..., args=..., r=...) at ../src/command/FileCommands.cxx:309
#7 0x004207d7 in command_process(Client&, unsigned int, char*)
(client=..., num=0, line=0x8981fc "albumart")
at ../src/command/AllCommands.cxx:432
#8 0x00449a53 in Client::ProcessLine(char*)
(this=0x8981f0, line=0x8981fc "albumart") at ../src/client/Process.cxx:138
--Type for more, q to quit, c to continue without paging--c
#9 0x0044a97d in Client::OnSocketInput(void*, unsigned int) (this=0x8981f0, data=0x8981fc, length=114) at ../src/client/Read.cxx:49
#10 0x0049dbc3 in BufferedSocket::ResumeInput() (this=0x8981f0) at ../src/event/BufferedSocket.cxx:76
#11 0x0049dd2d in BufferedSocket::OnSocketReady(unsigned int) (this=0x8981f0, flags=1) at ../src/event/BufferedSocket.cxx:113
#12 0x0049e52a in FullyBufferedSocket::OnSocketReady(unsigned int) (this=0x8981f0, flags=1) at ../src/event/FullyBufferedSocket.cxx:106
#13 0x0044949d in BindMethodDetail::BindMethodWrapperGenerator2<BufferedSocket, true, void (BufferedSocket::)(unsigned int) noexcept, &BufferedSocket::OnSocketReady, void, unsigned int>::Invoke(void, unsigned int) (_instance=0x8981f0, args#0=1) at ../src/util/BindMethod.hxx:152
#14 0x0049d668 in BoundMethod<void (unsigned int) noexcept>::operator()(unsigned int) const (this=0x89a208, args#0=1) at ../src/util/BindMethod.hxx:79
#15 0x0049d8ff in SocketEvent::Dispatch() (this=0x89a1fc) at ../src/event/SocketEvent.cxx:121
#16 0x004a2f0f in EventLoop::Run() (this=0xbfffed1c) at ../src/event/Loop.cxx:349
#17 0x00418cfc in MainConfigured(options const&, ConfigData const&) (options=..., raw_config=...) at ../src/Main.cxx:549
#18 0x0041902c in MainOrThrow(int, char**) (argc=4, argv=0xbffffda4) at ../src/Main.cxx:634
#19 0x004190c3 in mpd_main(int, char**) (argc=4, argv=0xbffffda4) at ../src/Main.cxx:642
#20 0x0041915d in main(int, char**) (argc=4, argv=0xbffffda4) at ../src/Main.cxx:656

[sevmonster]

It seems we had the same idea :) #1224

[MaxKellermann]

cfe024e