Bug#788708: Bug#799632: iceweasel: SIGSEGV when playing videos via gstreamer

[Sebastian Dröge]

On Do, 2015-11-12 at 15:35 +0100, Soeren D. Schulze wrote:
> Am 12.11.2015 um 15:02 schrieb Sebastian Dröge:
> > On Do, 2015-11-12 at 14:41 +0100, Soeren D. Schulze wrote:
> > > Hello,
> > > 
> > > the problem does not seem to occur any more with
> > > gstreamer1.0-plugins-bad 1.6.1-1+b1 and iceweasel 38.4.0esr-1.
> > > 
> > > Do you have any specific packages for me to test?
> > 
> > Just a normal jessie installation without installing things from
> > other
> > sources, including sid :) It is definitely fixed since gst-plugins-
> > bad
> > 1.5.X, it's just not clear if the actual bug also exists in jessie
> > or
> > not (and if it doesn't, the fix will also have no effect for people
> > who
> > mix their packages with ones from other sources).
> 
> I believe so.  I have had symptomatically similar crashes on two 
> different jessie systems, but I had not installed debugging symbols,
> and it's hard to reproduce those crashes at command.

It should crash always more or less immediately when you visit a
website with AAC audio. Vimeo for example :)

> If there is code in jessie that causes stack corruption, it should be
> fixed in any case in my opinion, regardless whether it causes crashes
> or not.  Is it clear whether the stack corruption implies a security
> threat?

The relevant upstream bug is
  https://bugzilla.gnome.org/show_bug.cgi?id=748571

The problem here is that the configure check for the faad version went
wrong based on the specific compiler version. It's fairly trivial, if
the release team agrees that we should get that into jessie I can do
that in any case. It shouldn't have any negative side effects.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/pkg-gstreamer-maintainers/attachments/20151112/0ac64534/attachment-0001.sig>