#714517 RyGel crashes when Xmbc ennumerates 'Pictures'

Package:
rygel
Source:
rygel
Description:
GNOME UPnP/DLNA services
Submitter:
Date:
2013-07-31 10:21:04 UTC
Severity:
important
#714517#5
Date:
2013-06-30 10:51:34 UTC
From:
To:
When ennumerating the pcitures share on my setup from XMBC the rygel
process crashes on a NULL pointer dereference.

Gdb backtrace is:-
(gdb) bt
#0  rygel_media_export_root_container_real_find_object_co (_data_=0x1e153d0)
    at rygel-media-export-root-container.c:726
#1  0x00007f17f96f0537 in g_simple_async_result_complete ()
   from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#2  0x00007f17f96f0639 in ?? ()
   from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#3  0x00007f17f9182355 in g_main_context_dispatch ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007f17f9182688 in ?? ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f17f9182a82 in g_main_loop_run ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6  0x0000000000418ea4 in rygel_main_run (
    self=0x19e0800) at rygel-main.c:439
#7  rygel_main_main (args_length1=1,
    args=0x7fff38b00a68) at rygel-main.c:1232
#8  main (argc=1, argv=<optimized out>)
    at rygel-main.c:1265


Line 726 appears to be:-
        ((RygelMediaObject*) _data_->_tmp12_)->parent = (RygelMediaContainer*) _data_->self;

and _data_->_tmp12_ is confirmed to be NULL.

(gdb) p _data_->container
$5 = (RygelMediaExportQueryContainer *) 0x0
(gdb) p _data_->_tmp12_
$6 = (RygelMediaExportQueryContainer *) 0x0

As far as I can tell this maps to line 128 in rygel-media-export-root-container.vala
(BTW would in be posible to incldue #line directives in the generated C)

Which is this:-
            var factory = QueryContainerFactory.get_default ();
            var container = factory.create_from_id (this.media_db, id);
-->         container.parent = this;

            return container;
        }


It seem to be then that  fatory.create_from_id is returnnig a NULL object, and that there is
no protection for that. However it look like this the factory iare never intended to return a
NULL object.

This is reasonable easy to  reproduce so more debugging is possible.

#714517#10
Date:
2013-06-30 18:34:30 UTC
From:
To:
Hello Roger Gammans.

Thanks for your very well analyzed bug report!
I'll have to look closer at this but I quickly looked at more
recent versions and changes in git. Looks like
commit 6755a280d0d537f517a53466c3bbbc3113a47943
might be very related to your problem.
See https://git.gnome.org/browse/rygel/commit/?id=6755a2

Would be awesome if you could test if the patch applies cleanly
to 0.14, build it and check if it solves your issue!

Please tell me if you need assistance and I'll try to help out
when I find time.

#714517#15
Date:
2013-06-30 22:28:59 UTC
From:
To:
That applies cleanly and seem to prevent rygel crashing.

I can no longer see 'Pictures' advertised - but that might be something
different. I haven't had much of a chance to experiment this evening.