[Mplayer-advusers] [BUG] segfault with very long file names in 0.90-cvs and main-cvs

[Pierre Lombard]

Hi,

Looks some stack overflow in playtree I guess (already reported a few
months ago).

The playtree code does not seem most obvious to me so if anyone more
fluent with it could check this...

I don't have the exact project name underhand but the mplayer mozilla
plugin folks should add some URL length check if not already done.


The tests are done on a K7 and IIRC there was some report that they did
not crash on PPC.


*With 0.90-cvs:
  mplayer `perl -e 'print "A"x99999'`
segfaults

#0  0x400a809b in FT_Done_FreeType () from /usr/lib/libfreetype.so.6
(gdb) bt
#0  0x400a809b in FT_Done_FreeType () from /usr/lib/libfreetype.so.6
#1  0x080b5500 in done_freetype () at font_load_ft.c:1104
#2  0x0808583b in main (argc=2, argv=0xbffe7244) at mplayer.c:3387

  mplayer `perl -e 'print "A"x9999'`
is OK


*With main-cvs:
  mplayer `perl -e 'print "A"x99999'`
segfaults

(gdb) bt
#0  0x0809e647 in m_config_pop (config=0x41414141) at m_config.c:99
#1  0x080923c9 in play_tree_iter_step (iter=0x84297a8, d=1,
with_nodes=0) at playtree.c:558
#2  0x0808717c in main (argc=2, argv=0xbffe7244) at mplayer.c:3457

  mplayer `perl -e 'print "A"x9999'`
segfaults

#0  free_str_list (dst=0x8421a30) at m_option.c:396
396       for(i = 0 ; d[i] != NULL ; i++)
(gdb) bt
#0  free_str_list (dst=0x8421a30) at m_option.c:396
#1  0x080a0209 in copy_str_list (opt=0x83162a0, dst=0x8421a30,
src=0x8421a30) at m_option.c:574
#2  0x0809e713 in m_config_pop (config=0x84247c0) at m_option.h:236
#3  0x080923c9 in play_tree_iter_step (iter=0x842bec0, d=1,
with_nodes=0) at playtree.c:558
#4  0x0808717c in main (argc=2, argv=0xbfffd1d4) at mplayer.c:3457


Best regards,
--
Pierre