Skip to content

Segfault on group quit, free of invalid audio_decoder #1114

@anthonybilinski

Description

@anthonybilinski

Running toxcore 76f4ae6

either exiting a group or closing while in a group causes:

#0  0x00007fffeffdf98d in __GI___libc_free (mem=0x19) at malloc.c:3103
#1  0x00007ffff4532e47 in group_av_peer_delete (object=0x55555670c290, groupnumber=0, peer_object=0x7fffa6a2cdd8) at /home/abilinski/builds/toxcore/toxav/groupav.c:285
#2  0x00007ffff45287c3 in del_groupchat (g_c=0x555556272830, groupnumber=0) at /home/abilinski/builds/toxcore/toxcore/group.c:837
#3  0x00007ffff452caf7 in kill_groupchats (g_c=0x555556272830) at /home/abilinski/builds/toxcore/toxcore/group.c:2605
#4  0x00007ffff452e227 in tox_kill (tox=0x5555562a9ff0) at /home/abilinski/builds/toxcore/toxcore/tox.c:533
(gdb) frame 1
#1  0x00007ffff4532e47 in group_av_peer_delete (object=0x55555670c290, groupnumber=0, peer_object=0x7fffa6a2cdd8) at /home/abilinski/builds/toxcore/toxav/groupav.c:285
285             opus_decoder_destroy(peer_av->audio_decoder);
(gdb) p peer_av
$14 = (Group_Peer_AV *) 0x7fffa6a2cdd8
(gdb) p peer_av->audio_decoder
$15 = (OpusDecoder *) 0x19
(gdb) 

interesting i in group.c:837 is 16 after being incremented after the last iteration of the loop, possibly the root cause? I can repro this very reliably on two computers, if you have problems I can grab more info. Going to leave it to the experts for now, qTox has enough bugs of its own :)

Metadata

Metadata

Assignees

No one assigned

    Labels

    P3Low priority

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions