JESS can crash when rendering an 8-bit surface through its non-MMX path.
In render_blur(), bmax is initialized only inside the MMX branch, but
is also used as the loop bound in the scalar branch. The resulting
undefined behavior can make the loop run beyond the pixel buffer.

I reproduced the SIGSEGV with a headless libvisual client rendering a
320x240 8-bit surface with synthetic stereo audio, on native amd64 and
sh4 under QEMU. GDB stops in render_blur() at renderer.c:421, called by
renderer(), act_jess_render() and visual_actor_run(). The preserved
amd64 -6 binary also reproduces the crash; this is a pre-existing bug.
The unchanged sh4 plugin completes the same test with a 32-bit surface.

Moving the existing bmax assignment before the MMX/non-MMX branch fixes
all 16 test frames on both native amd64 and sh4/QEMU. I submitted the
runtime fix upstream:
https://github.com/Libvisual/libvisual/pull/433

The Debian patch and regression test are committed on Salsa:
https://salsa.debian.org/debian/libvisual-plugins/-/commit/de745fb

The attached regression test explicitly disables MMX and exercises the
8-bit path. With libvisual-0.4-dev, a C compiler and pkgconf installed:

    cc -O2 -Wall -Wextra jess-8bit.c -o jess-8bit \
      $(pkg-config --cflags --libs libvisual-0.4)
    ./jess-8bit

The updated autopkgtest fails with exit 139 against the -6 package
currently in unstable and passes with the local patched -7 candidate.
The complete amd64 sbuild and Lintian source/binary checks also pass.
Salsa CI pipeline #1203422 passed all 11 required jobs, including
amd64/i386 builds, Lintian and the updated autopkgtest:
https://salsa.debian.org/debian/libvisual-plugins/-/pipelines/1203422
The candidate remains UNRELEASED and has not been uploaded.

Best regards,
Federico

We believe that the bug you reported is fixed in the latest version of
libvisual-plugins, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152771@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Federico Molara <federico@molara.net> (supplier of updated libvisual-plugins package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 01 Nov 2026 14:41:47 +0100
Source: libvisual-plugins
Architecture: source
Version: 1:0.4.2+dfsg-7
Distribution: unstable
Urgency: medium
Maintainer: Federico Molara <federico@molara.net>
Changed-By: Federico Molara <federico@molara.net>
Closes: 1152771
Changes:
 libvisual-plugins (1:0.4.2+dfsg-7) unstable; urgency=medium
 .
   * Compile only the JESS draw.c object at -O1 on sh4 to work around a
     GCC 16 register-allocation failure in stars_create_state. Keep the
     normal optimization flags for all other objects and architectures.
   * Fix a JESS crash when rendering 8-bit video without MMX by initializing
     the blur loop bound before selecting the rendering path. (Closes: #1152771)
     Extend the installed-plugin autopkgtest to cover scalar 8-bit rendering.
Checksums-Sha1:
 bd9b09b38721d724719924483e30a7021b953ca3 2348 libvisual-plugins_0.4.2+dfsg-7.dsc
 e198f23ea559057e091d07dc800e4f9426c8345f 13832 libvisual-plugins_0.4.2+dfsg-7.debian.tar.xz
 6c998a0bce8696ca91261a049e2f7eeb07b25f99 14602 libvisual-plugins_0.4.2+dfsg-7_source.buildinfo
Checksums-Sha256:
 b88827387b7371f88682eb3cc57e3daf7e316505564250a60b5dd1245d015d0b 2348 libvisual-plugins_0.4.2+dfsg-7.dsc
 793fc23c6290b75b314a98da074e2fbdfcdd91719f8337579376176e20430e98 13832 libvisual-plugins_0.4.2+dfsg-7.debian.tar.xz
 6934e46d6c7c3ad7b267abe6216b9bd4d3837cfccbb309aab0c3ead4698119c8 14602 libvisual-plugins_0.4.2+dfsg-7_source.buildinfo
Files:
 9d6c232f91ed3e6fc44f48ab64475102 2348 sound optional libvisual-plugins_0.4.2+dfsg-7.dsc
 eebd05b18c63c304b911209d01f4afeb 13832 sound optional libvisual-plugins_0.4.2+dfsg-7.debian.tar.xz
 3411c4ce551c4a729b6875e5b3561094 14602 sound optional libvisual-plugins_0.4.2+dfsg-7_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEIG2wtKi4GtZKKKg+lE0AYz5YTgEFAmrnQ10ACgkQlE0AYz5Y
TgHIfQ//aF+bYHuC8bPG0rAzpdzfbt3CKFytE4tTYSzomEN3IFx1/+KuEGH+BHaa
INAzLmJ9h1B14sxLfkbC5fvoNnupqSCbAJDNFRrAxXjmuAQhEDe3bu85azRmnean
aQ3CQYZx0Beh9UFoR3vc87/IQpqoNo+WIH9QT7rtmX0aDz4rsTFNgF+aQOr3EKOf
8+xe7pOq8WsTAX9LntbGPWHpgodHnQFkdn5gwhkdtNCabubbfj36lWVlB5CW3jtT
MHIb926q0GYHatwbPZwIcqCAwEnnY+rDnTyJZXa2u1gKMhoj2174jOUpEeaHOUAy
heK+mxzDskIExdUNXLdabdcvYyONRXT3QrCTdRjLig95vhmku/N0aL6y9U8Sk/8+
q1Lxj4l1JXOTNZfqVOwAsixy8jojZn8c1lG2Q/pEzeNetWJz2nzzGA8G2CkVkTO9
MtGzBuo6i4Wx19ZI8DcnbYb4tvMaJFZw9RXm2KR++ZQZZ+wPKCYz+J7ApMDV0ShJ
hrbzKUInjw/5GFV8apzfx7rEqk2EaDSJ+BzKPbnBtWuTzpbd4q1c0ILgPofzyJbA
t9UwLMTcKzOaQueus5FkL7LKoBKXY0K8Xp6Zu3HJxZYipK9xrdBwNv1Xr7oK+DY9
riJKhKx8Fj9ksIF5eUZAXM7JJ2jKwh6jg4HE9M3lZw6znQ587CY=
=1HuZ
-----END PGP SIGNATURE-----