0002682: Crash in libmlt.so.5 on startup

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0002682

Kdenlive

MLT

public

2012-07-15 23:06

2012-07-15 23:37

Reporter

gerhard_s

Assigned To

Priority

high

Severity

crash

Reproducibility

always

Status

new

Resolution

open

Platform

x86_64

OpenSUSE

OS Version

11.4

Product Version

0.9.2

Target Version

Fixed in Version

Summary

0002682: Crash in libmlt.so.5 on startup

Description

I'm unable to start kdenlive as it always crashes in mlt_property_get_string() in libmlt.so.5.

The reason is that sprintf is used in mlt_property_get_string() and the buffer is obviously too small.

Attached patch fixes the problem by using snprintf(which I think is a good practise anyway).

Steps To Reproduce

just start kdenlive and it immediately crashes.

Additional Information

I'm using KDE 4.8.4

Here's the backtrace:

*** buffer overflow detected ***: kdenlive terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7fb40fc44f37]
/lib64/libc.so.6(+0xe7ce0)[0x7fb40fc42ce0]
/lib64/libc.so.6(+0xe7059)[0x7fb40fc42059]
/lib64/libc.so.6(_IO_default_xsputn+0x85)[0x7fb40fbcc255]
/lib64/libc.so.6(__printf_fp+0x13d6)[0x7fb40fba43e6]
/lib64/libc.so.6(_IO_vfprintf+0x1216)[0x7fb40fb9e826]
/lib64/libc.so.6(__vsprintf_chk+0x9d)[0x7fb40fc420fd]
/lib64/libc.so.6(__sprintf_chk+0x7f)[0x7fb40fc4203f]
/usr/lib64/libmlt.so.5(mlt_property_get_string+0xb6)[0x7fb41320e646]
kdenlive[0x618139]
kdenlive[0x623cf4]
kdenlive[0x4ff594]
kdenlive[0x4dc5df]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x7fb40fb79bfd]
kdenlive[0x456ed9]
======= Memory map: ========
00400000-007ff000 r-xp 00000000 08:22 1977219 /usr/bin/kdenlive
009fe000-009ff000 r--p 003fe000 08:22 1977219 /usr/bin/kdenlive
009ff000-00a06000 rw-p 003ff000 08:22 1977219 /usr/bin/kdenlive
00a06000-016d2000 rw-p 00000000 00:00 0 [heap]
7fb3f008e000-7fb3f0163000 r--p 00000000 08:22 1447392 /usr/share/locale/de/LC_MESSAGES/desktop_translations.mo
7fb3f0163000-7fb3f0166000 r-xp 00000000 08:22 1976455 /usr/lib64/mlt/libmltvorbis.so
7fb3f0166000-7fb3f0365000 ---p 00003000 08:22 1976455 /usr/lib64/mlt/libmltvorbis.so
7fb3f0365000-7fb3f0366000 r--p 00002000 08:22 1976455 /usr/lib64/mlt/libmltvorbis.so
7fb3f0366000-7fb3f0367000 rw-p 00003000 08:22 1976455 /usr/lib64/mlt/libmltvorbis.so
7fb3f0367000-7fb3f0371000 r-xp 00000000 08:22 1979485 /usr/lib64/mlt/libmltlinsys.so
7fb3f0371000-7fb3f0570000 ---p 0000a000 08:22 1979485 /usr/lib64/mlt/libmltlinsys.so
7fb3f0570000-7fb3f0571000 r--p 00009000 08:22 1979485 /usr/lib64/mlt/libmltlinsys.so
7fb3f0571000-7fb3f0572000 rw-p 0000a000 08:22 1979485 /usr/lib64/mlt/libmltlinsys.so
7fb3f0572000-7fb3f0577000 r-xp 00000000 08:22 1977180 /usr/lib64/mlt/libmltkdenlive.so
7fb3f0577000-7fb3f0776000 ---p 00005000 08:22 1977180 /usr/lib64/mlt/libmltkdenlive.so
7fb3f0776000-7fb3f0777000 r--p 00004000 08:22 1977180 /usr/lib64/mlt/libmltkdenlive.so
7fb3f0777000-7fb3f0778000 rw-p 00005000 08:22 1977180 /usr/lib64/mlt/libmltkdenlive.so
7fb3f0778000-7fb3f077d000 r-xp 00000000 08:22 1975896 /usr/lib64/mlt/libmltoldfilm.so
7fb3f077d000-7fb3f097c000 ---p 00005000 08:22 1975896 /usr/lib64/mlt/libmltoldfilm.so
7fb3f097c000-7fb3f097d000 r--p 00004000 08:22 1975896 /usr/lib64/mlt/libmltoldfilm.so
7fb3f097d000-7fb3f097e000 rw-p 00005000 08:22 1975896 /usr/lib64/mlt/libmltoldfilm.so
7fb3f097e000-7fb3f0995000 r-xp 00000000 08:22 1976812 /usr/lib64/libpostproc.so.52.0.100
7fb3f0995000-7fb3f0b95000 ---p 00017000 08:22 1976812 /usr/lib64/libpostproc.so.52.0.100
7fb3f0b95000-7fb3f0b96000 r--p 00017000 08:22 1976812 /usr/lib64/libpostproc.so.52.0.100
7fb3f0b96000-7fb3f0b97000 rw-p 00018000 08:22 1976812 /usr/lib64/libpostproc.so.52.0.100
7fb3f0b97000-7fb3f0ba7000 r-xp 00000000 08:22 1969331 /usr/lib64/libswresample.so.0.15.100
7fb3f0ba7000-7fb3f0da6000 ---p 00010000 08:22 1969331 /usr/lib64/libswresample.so.0.15.100
7fb3f0da6000-7fb3f0da8000 r--p 0000f000 08:22 1969331 /usr/lib64/libswresample.so.0.15.100
7fb3f0da8000-7fb3f0da9000 rw-p 00011000 08:22 1969331 /usr/lib64/libswresample.so.0.15.100
7fb3f0da9000-7fb3f0db5000 r-xp 00000000 08:22 1977501 /usr/lib64/libavresample.so.0.0.2
7fb3f0db5000-7fb3f0fb4000 ---p 0000c000 08:22 1977501 /usr/lib64/libavresample.so.0.0.2
7fb3f0fb4000-7fb3f0fb5000 r--p 0000b000 08:22 1977501 /usr/lib64/libavresample.so.0.0.2
7fb3f0fb5000-7fb3f0fb6000 rw-p 0000c000 08:22 1977501 /usr/lib64/libavresample.so.0.0.2
7fb3f0fb6000-7fb3f1141000 r-xp 00000000 08:22 656479 /lib64/libcrypto.so.1.0.0
7fb3f1141000-7fb3f1341000 ---p 0018b000 08:22 656479 /lib64/libcrypto.so.1.0.0
7fb3f1341000-7fb3f135a000 r--p 0018b000 08:22 656479 /lib64/libcrypto.so.1.0.0
7fb3f135a000-7fb3f1364000 rw-p 001a4000 08:22 656479 /lib64/libcrypto.so.1.0.0
7fb3f1364000-7fb3f1368000 rw-p 00000000 00:00 0
7fb3f1368000-7fb3f13bd000 r-xp 00000000 08:22 666571 /lib64/libssl.so.1.0.0
7fb3f13bd000-7fb3f15bc000 ---p 00055000 08:22 666571 /lib64/libssl.so.1.0.0
7fb3f15bc000-7fb3f15bf000 r--p 00054000 08:22 666571 /lib64/libssl.so.1.0.0
7fb3f15bf000-7fb3f15c4000 rw-p 00057000 08:22 666571 /lib64/libssl.so.1.0.0
7fb3f15c4000-7fb3f1651000 r-xp 00000000 08:22 1976031 /usr/lib64/libavfilter.so.2.77.100
7fb3f1651000-7fb3f1850000 ---p 0008d000 08:22 1976031 /usr/lib64/libavfilter.so.2.77.100
7fb3f1850000-7fb3f1856000 r--p 0008c000 08:22 1976031 /usr/lib64/libavfilter.so.2.77.100
7fb3f1856000-7fb3f1860000 rw-p 00092000 08:22 1976031 /usr/lib64/libavfilter.so.2.77.100
7fb3f1860000-7fb3f1866000 rw-p 00000000 00:00 0
7fb3f1866000-7fb3f1926000 r-xp 00000000 08:22 1977638 /usr/lib64/libschroedinger-1.0.so.0.10.0
7fb3f1926000-7fb3f1b26000 ---p 000c0000 08:22 1977638 /usr/lib64/libschroedinger-1.0.so.0.10.0
7fb3f1b26000-7fb3f1b28000 r--p 000c0000 08:22 1977638 /usr/lib64/libschroedinger-1.0.so.0.10.0
7fb3f1b28000-7fb3f1b2a000 rw-p 000c2000 08:22 1977638 /usr/lib64/libschroedinger-1.0.so.0.10.0
7fb3f1b2a000-7fb3f1b2b000 rw-p 00000000 00:00 0
7fb3f1b2b000-7fb3f1b43000 r-xp 00000000 08:22 1977673 /usr/lib64/libspeex.so.1.5.0
7fb3f1b43000-7fb3f1d43000 ---p 00018000 08:22 1977673 /usr/lib64/libspeex.so.1.5.0
7fb3f1d43000-7fb3f1d44000 r--p 00018000 08:22 1977673 /usr/lib64/libspeex.so.1.5.0
7fb3f1d44000-7fb3f1d45000 rw-p 00019000 08:22 1977673 /usr/lib64/libspeex.so.1.5.0
7fb3f1d45000-7fb3f1d5d000 r-xp 00000000 08:22 1977727 /usr/lib64/libtheoradec.so.1.1.4KCrash: Application 'kdenlive' crashing...

Tags

No tags attached.

Build/Install Method

Manual build from release

Attached Files

mlt_property_crash.patch [^] (1,221 bytes) 2012-07-15 23:06 [Show Content] [Hide Content]

--- src/framework/mlt_property.c.orig	2012-05-20 23:07:53.405414177 +0200
+++ src/framework/mlt_property.c	2012-05-20 23:08:58.227965077 +0200
@@ -573,25 +573,25 @@
 		{
 			self->types |= mlt_prop_string;
 			self->prop_string = malloc( 32 );
-			sprintf( self->prop_string, "%d", self->prop_int );
+			snprintf( self->prop_string, 32, "%d", self->prop_int );
 		}
 		else if ( self->types & mlt_prop_double )
 		{
 			self->types |= mlt_prop_string;
 			self->prop_string = malloc( 32 );
-			sprintf( self->prop_string, "%f", self->prop_double );
+			snprintf( self->prop_string, 32, "%f", self->prop_double );
 		}
 		else if ( self->types & mlt_prop_position )
 		{
 			self->types |= mlt_prop_string;
 			self->prop_string = malloc( 32 );
-			sprintf( self->prop_string, "%d", (int)self->prop_position );
+			snprintf( self->prop_string, 32, "%d", (int)self->prop_position );
 		}
 		else if ( self->types & mlt_prop_int64 )
 		{
 			self->types |= mlt_prop_string;
 			self->prop_string = malloc( 32 );
-			sprintf( self->prop_string, "%"PRId64, self->prop_int64 );
+			snprintf( self->prop_string, 32, "%"PRId64, self->prop_int64 );
 		}
 		else if ( self->types & mlt_prop_data && self->serialiser != NULL )
 		{

Relationships

Notes
(0008161) gerhard_s (reporter) 2012-07-15 23:37	An important detail may be which version of mlt I use ;-) libmlt5-0.7.8+0.7.9_78_g14c5abc

Issue History
Date Modified	Username	Field	Change
2012-07-15 23:06	gerhard_s	New Issue
2012-07-15 23:06	gerhard_s	File Added: mlt_property_crash.patch
2012-07-15 23:37	gerhard_s	Note Added: 0008161