Bug#797227: segfault - gst_memory_unmap, libgstreamer

[Sebastian Dröge]

On Di, 2015-09-01 at 11:28 +0300, Sebastian Dröge wrote:
> On Di, 2015-09-01 at 10:25 +0200, Vincent Lefevre wrote:
> > On 2015-09-01 11:07:28 +0300, Sebastian Dröge wrote:
> > > The gcc 5 transition might've broken something related to 
> > > iceweasel,
> > > which is written in C++ and depends a lot on C++ libraries. Which 
> > > 
> > > then
> > > might result in the invalid memory accesses mentioned above.
> > > 
> > > But GStreamer and dependencies in use here are plain C, so are
> > > unaffected by that transition. Same for GTK.
> > 
> > No, GStreamer is linked against libpcre:
> 
> GLib is linked against pcre, yes. But nothing there is actually using
> it, and even if it was you would see something blowing up with regex
> handling instead :)
> 
> > > I think there are problems somewhere in iceweasel in the way it 
> > > is
> > > using GTK, which is independent of the gcc 5 transition. And 
> > > which
> > > might or might not be the reason for the crash.
> > 
> > I would tend to say that the effects of these GTK problems are only
> > local. If they yield more global memory corruption due to specific
> > remote contents (e.g. a video), then this is an important security
> > issue.
> 
> Who knows? It's poking at memory that was freed already and things 
> like that, which could cause random crashes at a later time.


The crash is most likely this bug here:
https://bugzilla.gnome.org/show_bug.cgi?id=748571

That would also explain why it doesn't crash with 1.5.90.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/pkg-gstreamer-maintainers/attachments/20150901/205bf1b3/attachment.sig>