Double free or corruption loading unusual WAV files

[lordmauve]

I see hard crashes with a freshly built pygame 1.9.4 when attempting to load WAV sound files with unusual codecs.

Thread 1 "python" received signal SIGABRT, Aborted.
0x00007ffff7825428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff7825428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff782702a in __GI_abort () at abort.c:89
#2  0x00007ffff78677ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff7980ed8 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff787037a in malloc_printerr (ar_ptr=<optimised out>, ptr=<optimised out>, str=0x7ffff7981008 "double free or corruption (!prev)", action=3)
    at malloc.c:5006
#4  _int_free (av=<optimised out>, p=<optimised out>, have_lock=0) at malloc.c:3867
#5  0x00007ffff787453c in __GI___libc_free (mem=<optimised out>) at malloc.c:2968
#6  0x00007ffff785d363 in _IO_new_fclose (fp=0x14394e0) at iofclose.c:84
#7  0x00007ffff492c539 in stdio_close (context=0x1439710) at ./src/file/SDL_rwops.c:357
#8  0x00007ffff01bdda6 in Mix_LoadWAV_RW (src=src@entry=0x1439710, freesrc=freesrc@entry=1) at mixer.c:565
#9  0x00007fffed6b6626 in sound_init (self=0x7fffe180be68, arg=<optimised out>, kwarg=<optimised out>) at src/mixer.c:1578

The files I'm testing with are here:

https://github.com/lordmauve/pgzero/tree/master/test/sounds

I see this crash with wav22kgsm.wav, wav22kulaw.wav, wav8kmp316.wav and wav8kmp38.wav.

I'm building against

ii  libsdl-mixer1.2:amd64                1.2.12-11build1         amd64                   Mixer library for Simple DirectMedia Layer 1.2, libraries
ii  libsdl-mixer1.2-dev:amd64            1.2.12-11build1         amd64                   Mixer library for Simple DirectMedia Layer 1.2, development files

To Do to close this:

• See if these files also fail to load with C code in using latest SDL_mixer.
• If so report on SDL bugzilla and set this to Difficulty Waiting.
• Close if SDL_mixer is updated with fixes

Related docs: https://www.pygame.org/docs/ref/mixer.html#pygame.mixer.Sound

[illume]

Thanks. There's a number of people reporting wav issues on stackoverflow.

Here's the steps needed to proceed.

0. see if there are bugs already listed against sdl_mixer1/2 (see below).
1. check if it's failing with recent SDL2_mixer
2. a test case using just C sdl_mixer1/2 and the wav files.
3. perhaps add some code to detect these unsupported formats to include in pygame (if sdl doesn't fix things). So it can raise an exception.

Issue trackers:

• https://bugzilla.libsdl.org/
• https://packages.ubuntu.com/source/trusty/sdl-mixer1.2
• https://packages.ubuntu.com/source/trusty/libsdl2-mixer

More distro bug trackers are listed here:

• https://www.pygame.org/wiki/patchesandbugs#OS/Distribution%20bug%20trackers%20for%20pygame

It's most often the case that one distro can fix things, but not send the fix upstream. So it might already be fixed.

[Ale-XYX]

There is one alternate issue with wav files I've seen and its that pygame will flat-out reject wav files that do not have a 16-bit pcm bitrate. Lots of people go to stackoverflow after getting sounds from freesound.org or others that have an 8-bit or a 32-bit pcm bitrate and are confused about why it isn't working. I have no knowledge of C/C++/SDL so I cant help anywhere, just sharing my experiences.

[tonysimpson]

This is a bug in sdl mixer 1.2.12 the bug and a patch are here https://bugzilla.libsdl.org/show_bug.cgi?id=1418
The latest release of sdl mixer is 1.2.12 but this seems quite old (2013) most packages maintainers have added patches and pygame may need to do the same e.g. arch's patches https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/sdl_mixer
It should be possible to add the patch to the manylinux wheel build. I don't know what the best approach would be - I'd be happy to help though.

[illume]

@tonysimpson thanks for the offer :)

We build sdl_mixer for the wheels ourselves for windows, mac, and manylinux. It should be possible to fairly easily apply the patch on the mac and manylinux builds.

manylinux script: https://github.com/pygame/pygame/blob/master/manylinux-build/docker_base/sdl_libs/build-sdl-libs.sh (the patch can be applied here).

For mac we use the homebrew stuff. In the sdl_mixer.rb formula they do not apply any patches.
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-core/Formula/sdl_mixer.rb We already have a repo for a change to portmidi here: https://github.com/pygame/homebrew-portmidi So it's possible to copy that formula into our repo and apply patches to sdl_mixer. Also, you can submit a pr to homebrew sdl_mixer so that our mod won't be necessary in the future.

For windows, building the dependencies is... a challenge, and complicated.

[illume]

Well, I submitted some fixes for homebrew SDL. If the changes are made to the manylinux scripts too (download and apply the patches), then perhaps we can do another pygame bug fix release. I also added a patch for another wav issue reported in here: #459

For SDL.

  # BEXT wave files crash fix.
  # https://bugzilla.libsdl.org/show_bug.cgi?id=1673
  patch do
    url "https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3273"
    sha256 "2c6b6b0d4b5e62e1b4c4548c79a33b09619ff5a52cb7e56b7f6eff09228d9143"
  end 

For SDL_mixer

  # Fix for "crash on double free if loading WAV file failed"
  # https://bugzilla.libsdl.org/show_bug.cgi?id=1418
  patch do
    url "https://git.archlinux.org/svntogit/packages.git/plain/trunk/double-free-crash.patch?h=packages/sdl_mixer"
    sha256 "b707f5c8d1229d1612cc8a9f4e976f0a3b19ea40d7bd1d5bc1cbd5c9f8bca56d"
  end 

[MyreMylar]

Retesting the original sound files from the report in windows with 2.0.0.dev7

• wav22kulaw.wav - Now works, loads and plays.
• wav22kgsm.wav - Reports: pygame.error: Unable to open file 'data/wav22kgsm.wav'
• wav8kmp38.wav - Reports: pygame.error: Unable to open file 'data/wav8kmp38.wav'
• wav8kmp316.wav - Reports: pygame.error: Unable to open file 'data/wav8kmp316.wav'

So one out of four. An improvement, but not an absolute win.

Test Code:

import pygame


pygame.init()

window = pygame.display.set_mode((640, 480))

test_sound_1 = pygame.mixer.Sound('data/wav22kulaw.wav')

test_sound_2 = pygame.mixer.Sound('data/wav22kgsm.wav')

test_sound_3 = pygame.mixer.Sound('data/wav8kmp38.wav')

test_sound_4 = pygame.mixer.Sound('data/wav8kmp316.wav')

running = True
while running:
    for event in pygame.event.get():
        if event.type == pygame.QUIT:
            running = False
        if event.type == pygame.KEYDOWN and event.key == pygame.K_RETURN:
            test_sound_1.play()

    pygame.display.update()