#760898 libsndfile1-dev: Ogg/Vorbis writing segfaults with large buffer size

Package:
libsndfile1-dev
Source:
libsndfile
Description:
Development files for libsndfile; a library for reading/writing audio files
Submitter:
Frank Heckenbach
Date:
2023-08-30 11:45:03 UTC
Severity:
normal
#760898#5
Date:
2014-09-09 00:39:42 UTC
From:
To:
The following program segfaults when trying to write a large block
to an Ogg/Vorbis file at once. The exact size where it crashes seems
to depend on the parameters (samplerate, channels), but was always
below 0x800000 in my tests.

Writing it in several smaller chunks seems to work. However, writing
in blocks of size 0x100000 is about twice as slow as writing in
blocks of size 0x10000 (which is about as fast as oggenc).

#include <string.h>
#include <sndfile.h>

int main ()
{
  enum { n = 0x800000 };
  SF_INFO sfi;
  sfi.frames = n;
  sfi.samplerate = 44100;
  sfi.channels = 1;
  sfi.format = SF_FORMAT_OGG | SF_FORMAT_VORBIS;
  sfi.sections = 1;
  sfi.seekable = 0;
  SNDFILE *sf = sf_open ("/dev/null", SFM_WRITE, &sfi);
  static float data[n];
  memset (data, 0, sizeof (data));
  sf_writef_float (sf, data, n);
}

gdb backtrace:

Program received signal SIGSEGV, Segmentation fault.
0xb7c0baa8 in ?? () from /usr/lib/i386-linux-gnu/libvorbis.so.0
(gdb) bt
#0  0xb7c0baa8 in ?? () from /usr/lib/i386-linux-gnu/libvorbis.so.0
#1  0xb7c0c96f in vorbis_analysis_wrote () from /usr/lib/i386-linux-gnu/libvorbis.so.0
#2  0xb7f75341 in ?? () from /usr/lib/i386-linux-gnu/libsndfile.so.1
#3  0xb7f756f1 in ?? () from /usr/lib/i386-linux-gnu/libsndfile.so.1
#4  0xb7f514c3 in sf_writef_float () from /usr/lib/i386-linux-gnu/libsndfile.so.1
#5  0x080486ad in main ()

#760898#10
Date:
2021-01-11 16:45:07 UTC
From:
To:
the issue perists with current versions of libsndfile.

however, the crash is obviously in libvorbis rather than libsndfile.
here's a full backtrace (with debug-packages installed):

```
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7cd8fcd in _preextrapolate_helper (v=v@entry=0x55555755c800)
at block.c:428
428	block.c: No such file or directory.
(gdb) bt
#0  0x00007ffff7cd8fcd in _preextrapolate_helper
(v=v@entry=0x55555755c800) at block.c:428
#1  0x00007ffff7cd9c55 in vorbis_analysis_wrote
(v=v@entry=0x55555755c800, vals=vals@entry=8388608)
     at block.c:516
#2  0x00007ffff7f3a8fe in vorbis_write_samples
(psf=psf@entry=0x5555575592a0,
     odata=odata@entry=0x55555755c580, vdata=vdata@entry=0x55555755c7a0,
     in_frames=in_frames@entry=8388608) at ogg_vorbis.c:758
#3  0x00007ffff7f3ab88 in vorbis_write_f (psf=0x5555575592a0,
ptr=0x555555558060 <data>,
     lens=8388608) at ogg_vorbis.c:840
#4  0x00007ffff7f1ae1d in sf_writef_float (sndfile=0x5555575592a0,
ptr=0x555555558060 <data>,
     frames=8388608) at sndfile.c:2457
#5  0x00005555555551d2 in main ()
(gdb)
```

shouldn't this bug be re-assigned to libvorbis?

gmsadr
IOhannes