When ennumerating the pcitures share on my setup from XMBC the rygel
process crashes on a NULL pointer dereference.
Gdb backtrace is:-
(gdb) bt
#0 rygel_media_export_root_container_real_find_object_co (_data_=0x1e153d0)
at rygel-media-export-root-container.c:726
#1 0x00007f17f96f0537 in g_simple_async_result_complete ()
from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#2 0x00007f17f96f0639 in ?? ()
from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#3 0x00007f17f9182355 in g_main_context_dispatch ()
from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4 0x00007f17f9182688 in ?? ()
from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5 0x00007f17f9182a82 in g_main_loop_run ()
from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6 0x0000000000418ea4 in rygel_main_run (
self=0x19e0800) at rygel-main.c:439
#7 rygel_main_main (args_length1=1,
args=0x7fff38b00a68) at rygel-main.c:1232
#8 main (argc=1, argv=<optimized out>)
at rygel-main.c:1265
Line 726 appears to be:-
((RygelMediaObject*) _data_->_tmp12_)->parent = (RygelMediaContainer*) _data_->self;
and _data_->_tmp12_ is confirmed to be NULL.
(gdb) p _data_->container
$5 = (RygelMediaExportQueryContainer *) 0x0
(gdb) p _data_->_tmp12_
$6 = (RygelMediaExportQueryContainer *) 0x0
As far as I can tell this maps to line 128 in rygel-media-export-root-container.vala
(BTW would in be posible to incldue #line directives in the generated C)
Which is this:-
var factory = QueryContainerFactory.get_default ();
var container = factory.create_from_id (this.media_db, id);
--> container.parent = this;
return container;
}
It seem to be then that fatory.create_from_id is returnnig a NULL object, and that there is
no protection for that. However it look like this the factory iare never intended to return a
NULL object.
This is reasonable easy to reproduce so more debugging is possible.