[app_server] crash in PicturePlayer::Play: buffer overrun

[diver]

hrev47314.

Launching XRS v1.13 unofficial beta2 crashes app_server .

state: Call (PicturePlayer::Play: buffer overrun)

Frame		IP			Function Name
-----------------------------------------------
00000000	0x615fe112	commpage_syscall + 0x2 
		Disassembly:
		commpage_syscall:
		0x615fe110:             89e1  mov %esp, %ecx
		0x615fe112:             0f34  sysenter  <--

		Frame memory:
				
0x715633b8	0x279a571	debugger + 0x39 
0x71563530	0x15924df	BPrivate::PicturePlayer::Play(void*, int32, void*) + 0xdb 
0x71563580	0x129cde6	ServerPicture::Play(DrawingContext*) + 0x8e 
0x71564c00	0x12a568e	ServerWindow::_DispatchViewDrawingMessage(int32, BPrivate::LinkReceiver&) + 0x2612 
0x71564de0	0x12a2d81	ServerWindow::_DispatchViewMessage(int32, BPrivate::LinkReceiver&) + 0x2531 
0x71564f10	0x12a0790	ServerWindow::_DispatchMessage(int32, BPrivate::LinkReceiver&) + 0x1270 
0x71564f90	0x12a7756	ServerWindow::_MessageLooper() + 0x27a 
0x71564fc0	0x1282c9a	MessageLooper::_message_thread(void*) + 0x26 
0x71564fe8	0x27a1621	thread_entry + 0x21 
00000000	0x615fe250	commpage_thread_exit + 0 

[jackburton]

Would be interesting to compile libbe with DEBUG=2 (more specifically, just #define DEBUG 2 inside PicturePlayer.cpp). Then launch XRS. It SHOULD produce a file in /var/log/PicturePlayer.log with the BPicture ops used by XRS.

[pulkomandy]

It seems the picture data is corrupted or truncated. As each of the operations come with a size, I'm not sure the drawing operations are relevant.

It's possible that the picture comes from archived data (in a BMessage) and we have a compatibility problem with pictures archived on BeOS.

[jackburton]

Replying to pulkomandy:

It seems the picture data is corrupted or truncated. As each of the operations come with a size, I'm not sure the drawing operations are relevant.

It's possible that the picture comes from archived data (in a BMessage) and we have a compatibility problem with pictures archived on BeOS.

That might very well be the case. I'm sure at least we treat strings differently.

[anevilyak]

(In #11645) Looks like this is in fact a duplicate of #10922.

[jackburton]

I think this could've been fixed by mmlr's recent work on PicturePlayer.

[diver]

app_server no longer crashes. Fixed in hrev49620.