Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pqiv craches viewing avif images #231

Open
noffsh opened this issue Feb 28, 2024 · 0 comments
Open

pqiv craches viewing avif images #231

noffsh opened this issue Feb 28, 2024 · 0 comments

Comments

@noffsh
Copy link

noffsh commented Feb 28, 2024

Hello,

when i view avif images or mixed image formats with avif included. pqiv crashes with segfaults.

for reference:

I get different segfaults depending on with which images i call pqiv and cycling through images with space

pqiv (master) $ gdb -ex=r --args ./pqiv hato/hato.profile0.* produces at the 3rd image:

GNU gdb (Gentoo 14.1 vanilla) 14.1
[...]

Reading symbols from ./pqiv...
Starting program: /tmp/pqiv/pqiv hato/hato.profile0.10bpc.yuv420.avif hato/hato.profile0.10bpc.yuv420.monochrome.avif hato/hato.profile0.8bpc.yuv420.avif hato/hato.profile0.8bpc.yuv420.monochrome.avif
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffefb0f6c0 (LWP 26789)]
[New Thread 0x7fffef30e6c0 (LWP 26790)]
[New Thread 0x7fffeeb0d6c0 (LWP 26791)]
[New Thread 0x7fffee30c6c0 (LWP 26792)]
[libdav1d @ 0x55555575ee80] libdav1d 1.3.0
[libdav1d @ 0x555555773dc0] libdav1d 1.3.0
[New Thread 0x7fffdffff6c0 (LWP 26793)]
[libdav1d @ 0x7fffd4001ac0] libdav1d 1.3.0
[libdav1d @ 0x7fffd4005ec0] libdav1d 1.3.0
[libdav1d @ 0x7fffd4007bc0] libdav1d 1.3.0
[libdav1d @ 0x7fffd4023300] libdav1d 1.3.0
[New Thread 0x7fffd3fff6c0 (LWP 26794)]
[Thread 0x7fffd3fff6c0 (LWP 26794) exited]
[New Thread 0x7fffd3fff6c0 (LWP 26795)]
[New Thread 0x7fffd37fe6c0 (LWP 26796)]
[Thread 0x7fffd3fff6c0 (LWP 26795) exited]
[New Thread 0x7fffd3fff6c0 (LWP 26797)]
[Thread 0x7fffd37fe6c0 (LWP 26796) exited]
[New Thread 0x7fffd37fe6c0 (LWP 26798)]
[Thread 0x7fffd3fff6c0 (LWP 26797) exited]
[Thread 0x7fffd37fe6c0 (LWP 26798) exited]
[libdav1d @ 0x7fffd4007bc0] libdav1d 1.3.0
[libdav1d @ 0x7fffd4023300] libdav1d 1.3.0
[libdav1d @ 0x55555575ee80] libdav1d 1.3.0
[libdav1d @ 0x555555773dc0] libdav1d 1.3.0
[libdav1d @ 0x7fffd4001ac0] libdav1d 1.3.0
[libdav1d @ 0x7fffd4005ec0] libdav1d 1.3.0
free(): invalid next size (normal)

Thread 6 "image-loader" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffdffff6c0 (LWP 26793)]
0x00007ffff4891e0c in ?? () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff4891e0c in ??? () at /lib64/libc.so.6
#1  0x00007ffff4842226 in raise () at /lib64/libc.so.6
#2  0x00007ffff482a8b7 in abort () at /lib64/libc.so.6
#3  0x00007ffff482b92a in ??? () at /lib64/libc.so.6
#4  0x00007ffff489bb47 in ??? () at /lib64/libc.so.6
#5  0x00007ffff489da6c in ??? () at /lib64/libc.so.6
#6  0x00007ffff489dda9 in ??? () at /lib64/libc.so.6
#7  0x00007ffff48a0593 in free () at /lib64/libc.so.6
#8  0x000055555557c9d5 in file_type_libav_unload (file=0x5555555cd190) at /tmp/pqiv/backends/libav.c:186
#9  0x00005555555677c6 in unload_image (node=0x555555838ab0) at /tmp/pqiv/pqiv.c:2918
#10 0x000055555556712e in image_loader_thread (user_data=0x0) at /tmp/pqiv/pqiv.c:2787
#11 0x00007ffff74ec151 in ??? () at /usr/lib64/libglib-2.0.so.0
#12 0x00007ffff48900c1 in ??? () at /lib64/libc.so.6
#13 0x00007ffff4902a1c in ??? () at /lib64/libc.so.6

pqiv (master) $ gdb -ex=r --args ./pqiv hato/*jpg hato/hato.profile0.* produces at the 3rd image:

GNU gdb (Gentoo 14.1 vanilla) 14.1
[...]
Reading symbols from ./pqiv...
Starting program: /tmp/pqiv/pqiv hato/hato.jpg hato/hato.profile0.10bpc.yuv420.avif hato/hato.profile0.10bpc.yuv420.monochrome.avif hato/hato.profile0.8bpc.yuv420.avif hato/hato.profile0.8bpc.yuv420.monochrome.avif
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffefb0f6c0 (LWP 26872)]
[New Thread 0x7fffef30e6c0 (LWP 26873)]
[New Thread 0x7fffeeb0d6c0 (LWP 26874)]
[New Thread 0x7fffee30c6c0 (LWP 26875)]
[New Thread 0x7fffed9626c0 (LWP 26876)]
[libdav1d @ 0x7fffd4001b40] libdav1d 1.3.0
[libdav1d @ 0x7fffd4005f40] libdav1d 1.3.0
[New Thread 0x7fffecf366c0 (LWP 26877)]
[libdav1d @ 0x7fffd4007c40] libdav1d 1.3.0
[Thread 0x7fffecf366c0 (LWP 26877) exited]
[New Thread 0x7fffecf366c0 (LWP 26878)]
[New Thread 0x7fffde7ea6c0 (LWP 26879)]
[Thread 0x7fffecf366c0 (LWP 26878) exited]
[New Thread 0x7fffecf366c0 (LWP 26880)]
[New Thread 0x7fffddfe96c0 (LWP 26881)]
[Thread 0x7fffde7ea6c0 (LWP 26879) exited]
[Thread 0x7fffecf366c0 (LWP 26880) exited]
[Thread 0x7fffddfe96c0 (LWP 26881) exited]
[libdav1d @ 0x7fffd4023380] libdav1d 1.3.0
[libdav1d @ 0x7fffd4007c40] libdav1d 1.3.0
[libdav1d @ 0x7fffd4023380] libdav1d 1.3.0
[libdav1d @ 0x7fffd4025040] libdav1d 1.3.0
[libdav1d @ 0x7fffd4058800] libdav1d 1.3.0
[libdav1d @ 0x7fffd4001b40] libdav1d 1.3.0
[libdav1d @ 0x7fffd4005f40] libdav1d 1.3.0
munmap_chunk(): invalid pointer

Thread 1 "pqiv" received signal SIGABRT, Aborted.
0x00007ffff4891e0c in ?? () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff4891e0c in ??? () at /lib64/libc.so.6
#1  0x00007ffff4842226 in raise () at /lib64/libc.so.6
#2  0x00007ffff482a8b7 in abort () at /lib64/libc.so.6
#3  0x00007ffff482b92a in ??? () at /lib64/libc.so.6
#4  0x00007ffff489bb47 in ??? () at /lib64/libc.so.6
#5  0x00007ffff489bd2c in ??? () at /lib64/libc.so.6
#6  0x00007ffff48a05d8 in free () at /lib64/libc.so.6
#7  0x00007ffff43ea822 in ??? () at /usr/lib64/libpixman-1.so.0
#8  0x00007ffff43ea779 in pixman_image_unref () at /usr/lib64/libpixman-1.so.0
#9  0x00007ffff7381f89 in ??? () at /usr/lib64/libcairo.so.2
#10 0x00007ffff73be632 in ??? () at /usr/lib64/libcairo.so.2
#11 0x00007ffff73bf1d0 in cairo_surface_destroy () at /usr/lib64/libcairo.so.2
#12 0x000055555556eeca in window_draw_callback (widget=0x555555825a30, cr_arg=0x5555556977b0, user_data=0x0) at /tmp/pqiv/pqiv.c:5259
#13 0x00007ffff786c0aa in ??? () at /usr/lib64/libgtk-3.so.0
#14 0x00007ffff7b22803 in ??? () at /usr/lib64/libgtk-3.so.0
#15 0x00007ffff7293de0 in g_closure_invoke () at /usr/lib64/libgobject-2.0.so.0
#16 0x00007ffff72a74ce in ??? () at /usr/lib64/libgobject-2.0.so.0
#17 0x00007ffff72a8949 in ??? () at /usr/lib64/libgobject-2.0.so.0
#18 0x00007ffff72ae946 in g_signal_emit_valist () at /usr/lib64/libgobject-2.0.so.0
#19 0x00007ffff72aea0b in g_signal_emit () at /usr/lib64/libgobject-2.0.so.0
#20 0x00007ffff7b2a34a in ??? () at /usr/lib64/libgtk-3.so.0
#21 0x00007ffff7b38a74 in ??? () at /usr/lib64/libgtk-3.so.0
#22 0x00007ffff79d9530 in gtk_main_do_event () at /usr/lib64/libgtk-3.so.0
#23 0x00007ffff75e03a9 in ??? () at /usr/lib64/libgdk-3.so.0
#24 0x00007ffff75eee11 in ??? () at /usr/lib64/libgdk-3.so.0
#25 0x00007ffff75f0a86 in ??? () at /usr/lib64/libgdk-3.so.0
#26 0x00007ffff75f0c84 in ??? () at /usr/lib64/libgdk-3.so.0
#27 0x00007ffff7293fe9 in ??? () at /usr/lib64/libgobject-2.0.so.0
#28 0x00007ffff72a8fe0 in ??? () at /usr/lib64/libgobject-2.0.so.0
#29 0x00007ffff72ae946 in g_signal_emit_valist () at /usr/lib64/libgobject-2.0.so.0
#30 0x00007ffff72aea0b in g_signal_emit () at /usr/lib64/libgobject-2.0.so.0
#31 0x00007ffff75e8f76 in ??? () at /usr/lib64/libgdk-3.so.0
#32 0x00007ffff75d54db in ??? () at /usr/lib64/libgdk-3.so.0
#33 0x00007ffff74bf54e in ??? () at /usr/lib64/libglib-2.0.so.0
#34 0x00007ffff74bb5d4 in ??? () at /usr/lib64/libglib-2.0.so.0
#35 0x00007ffff74be847 in ??? () at /usr/lib64/libglib-2.0.so.0
#36 0x00007ffff74bf13f in g_main_loop_run () at /usr/lib64/libglib-2.0.so.0
#37 0x00007ffff79d8625 in gtk_main () at /usr/lib64/libgtk-3.so.0
#38 0x000055555557792c in main (argc=6, argv=0x7fffffffd8f8) at /tmp/pqiv/pqiv.c:8295

pqiv (master) $ gdb -ex=r --args ./pqiv hato/hato.profile2.12bpc.yuv422.* hato/*png hato/hato.profile2.8bpc.yuv422.* produces:

GNU gdb (Gentoo 14.1 vanilla) 14.1
[...]
Reading symbols from ./pqiv...
Starting program: /tmp/pqiv/pqiv hato/hato.profile2.12bpc.yuv422.avif hato/hato.profile2.12bpc.yuv422.monochrome.avif hato/hato.16bpc.png hato/hato.png hato/hato.profile2.8bpc.yuv422.avif hato/hato.profile2.8bpc.yuv422.monochrome.avif
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffefb0f6c0 (LWP 27359)]
[New Thread 0x7fffef30e6c0 (LWP 27360)]
[New Thread 0x7fffeeb0d6c0 (LWP 27361)]
[New Thread 0x7fffee30c6c0 (LWP 27362)]
[libdav1d @ 0x55555577e880] libdav1d 1.3.0
[libdav1d @ 0x5555556a7580] libdav1d 1.3.0
[New Thread 0x7fffed8ec6c0 (LWP 27363)]
[libdav1d @ 0x7fffdc001b00] libdav1d 1.3.0
[libdav1d @ 0x7fffdc005f00] libdav1d 1.3.0
[libdav1d @ 0x7fffdc007c00] libdav1d 1.3.0
[libdav1d @ 0x7fffdc0233c0] libdav1d 1.3.0
[New Thread 0x7fffecec16c0 (LWP 27364)]
[Thread 0x7fffecec16c0 (LWP 27364) exited]
[New Thread 0x7fffecec16c0 (LWP 27365)]
[New Thread 0x7fffd7fff6c0 (LWP 27366)]
[Thread 0x7fffecec16c0 (LWP 27365) exited]
[New Thread 0x7fffecec16c0 (LWP 27367)]
[Thread 0x7fffd7fff6c0 (LWP 27366) exited]
[New Thread 0x7fffd7fff6c0 (LWP 27368)]
[Thread 0x7fffecec16c0 (LWP 27367) exited]
[Thread 0x7fffd7fff6c0 (LWP 27368) exited]
[libdav1d @ 0x7fffdc001b00] libdav1d 1.3.0
[libdav1d @ 0x7fffdc005f00] libdav1d 1.3.0
[libdav1d @ 0x55555577e880] libdav1d 1.3.0
[libdav1d @ 0x5555556a7580] libdav1d 1.3.0
corrupted size vs. prev_size

Thread 6 "image-loader" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffed8ec6c0 (LWP 27363)]
0x00007ffff4891e0c in ?? () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff4891e0c in ??? () at /lib64/libc.so.6
#1  0x00007ffff4842226 in raise () at /lib64/libc.so.6
#2  0x00007ffff482a8b7 in abort () at /lib64/libc.so.6
#3  0x00007ffff482b92a in ??? () at /lib64/libc.so.6
#4  0x00007ffff489bb47 in ??? () at /lib64/libc.so.6
#5  0x00007ffff489c4ae in ??? () at /lib64/libc.so.6
#6  0x00007ffff489c6fd in ??? () at /lib64/libc.so.6
#7  0x00007ffff489da38 in ??? () at /lib64/libc.so.6
#8  0x00007ffff489dda9 in ??? () at /lib64/libc.so.6
#9  0x00007ffff48a0593 in free () at /lib64/libc.so.6
#10 0x00007ffff43ea822 in ??? () at /usr/lib64/libpixman-1.so.0
#11 0x00007ffff43ea779 in pixman_image_unref () at /usr/lib64/libpixman-1.so.0
#12 0x00007ffff7381f89 in ??? () at /usr/lib64/libcairo.so.2
#13 0x00007ffff73be632 in ??? () at /usr/lib64/libcairo.so.2
#14 0x00007ffff73bf1d0 in cairo_surface_destroy () at /usr/lib64/libcairo.so.2
#15 0x00005555555677e3 in unload_image (node=0x55555581b3e0) at /tmp/pqiv/pqiv.c:2921
#16 0x000055555556712e in image_loader_thread (user_data=0x0) at /tmp/pqiv/pqiv.c:2787
#17 0x00007ffff74ec151 in ??? () at /usr/lib64/libglib-2.0.so.0
#18 0x00007ffff48900c1 in ??? () at /lib64/libc.so.6
#19 0x00007ffff4902a1c in ??? () at /lib64/libc.so.6

I can't reproduce this, but it happened once only with avif:
pqiv (master) $ gdb -ex=r --args ./pqiv hato/*avif produces

GNU gdb (Gentoo 14.1 vanilla) 14.1
[...]
Reading symbols from ./pqiv...
Starting program: /tmp/pqiv/pqiv hato/hato.profile0.10bpc.yuv420.avif hato/hato.profile0.10bpc.yuv420.monochrome.avif hato/hato.profile0.8bpc.yuv420.avif hato/hato.profile0.8bpc.yuv420.monochrome.avif hato/hato.profile2.10bpc.yuv422.avif hato/hato.profile2.10bpc.yuv422.monochrome.avif hato/hato.profile2.12bpc.yuv422.avif hato/hato.profile2.12bpc.yuv422.monochrome.avif hato/hato.profile2.8bpc.yuv422.avif hato/hato.profile2.8bpc.yuv422.monochrome.avif
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffefb0f6c0 (LWP 27582)]
[New Thread 0x7fffef30e6c0 (LWP 27583)]
[New Thread 0x7fffeeb0d6c0 (LWP 27584)]
[New Thread 0x7fffee30c6c0 (LWP 27585)]
[libdav1d @ 0x555555607c00] libdav1d 1.3.0
[libdav1d @ 0x555555775500] libdav1d 1.3.0
[New Thread 0x7fffdffff6c0 (LWP 27586)]
[libdav1d @ 0x7fffd4001b00] libdav1d 1.3.0
[libdav1d @ 0x7fffd4005f00] libdav1d 1.3.0
[libdav1d @ 0x7fffd4007c00] libdav1d 1.3.0
[libdav1d @ 0x7fffd4023340] libdav1d 1.3.0
[New Thread 0x7fffd3fff6c0 (LWP 27588)]
[Thread 0x7fffd3fff6c0 (LWP 27588) exited]
[New Thread 0x7fffd3fff6c0 (LWP 27589)]
[New Thread 0x7fffd37fe6c0 (LWP 27590)]
[Thread 0x7fffd3fff6c0 (LWP 27589) exited]
[New Thread 0x7fffd3fff6c0 (LWP 27591)]
[New Thread 0x7fffd2ffd6c0 (LWP 27592)]
[Thread 0x7fffd37fe6c0 (LWP 27590) exited]
[Thread 0x7fffd3fff6c0 (LWP 27591) exited]
[Thread 0x7fffd2ffd6c0 (LWP 27592) exited]
[libdav1d @ 0x7fffd4007c00] libdav1d 1.3.0
[libdav1d @ 0x7fffd4023340] libdav1d 1.3.0
[libdav1d @ 0x555555607c00] libdav1d 1.3.0
[libdav1d @ 0x555555775500] libdav1d 1.3.0
corrupted size vs. prev_size while consolidating

Thread 6 "image-loader" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffece286c0 (LWP 27464)]
0x00007ffff4891e0c in ?? () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff4891e0c in ??? () at /lib64/libc.so.6
#1  0x00007ffff4842226 in raise () at /lib64/libc.so.6
#2  0x00007ffff482a8b7 in abort () at /lib64/libc.so.6
#3  0x00007ffff482b92a in ??? () at /lib64/libc.so.6
#4  0x00007ffff489bb47 in ??? () at /lib64/libc.so.6
#5  0x00007ffff489dad4 in ??? () at /lib64/libc.so.6
#6  0x00007ffff489dda9 in ??? () at /lib64/libc.so.6
#7  0x00007ffff48a0593 in free () at /lib64/libc.so.6
#8  0x00007ffff3e2338b in ??? () at /usr/lib64/libdav1d.so.7
#9  0x00007ffff5cb93c5 in ??? () at /usr/lib64/libavcodec.so.60
#10 0x00007ffff5c9e23c in avcodec_close () at /usr/lib64/libavcodec.so.60
#11 0x00007ffff6ebfe00 in avformat_find_stream_info () at /usr/lib64/libavformat.so.60
#12 0x000055555557cba7 in file_type_libav_load (file=0x5555555cd000, data=0x7fffd0006bc0, error_pointer=0x7fffece27bc8) at /tmp/pqiv/backends/libav.c:221
#13 0x0000555555566175 in image_loader_load_single (node=0x555555778c70, called_from_main=0) at /tmp/pqiv/pqiv.c:2497
#14 0x0000555555566f8c in image_loader_thread (user_data=0x0) at /tmp/pqiv/pqiv.c:2753
#15 0x00007ffff74ec151 in ??? () at /usr/lib64/libglib-2.0.so.0
#16 0x00007ffff48900c1 in ??? () at /lib64/libc.so.6
#17 0x00007ffff4902a1c in ??? () at /lib64/libc.so.6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant