-
Bug
-
Resolution: Fixed
-
P2
-
8
-
both linux x86 and linux amd64, jdk 1.8.0-b129
I was trying to get mediaplayer to play internet radio by implementing a proxy which rewrites the icecast to http. This didn't really work out acceptably so 'internet streaming' is not the point of this report.
But I had a repeated crash in gstreamer because the proxy (and original icecast signal) wasn't sending any Content-Length header in the http response. If gstreamer and/or mediaplayer is used as part of the web browser component this has security implications since a URL could point to a service which returns such a http response (albeit an invalid one).
FWIW the crash occurred here:
Stack: [0x84dad000,0x855ae000], sp=0x855ad1e4, free space=8192k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libfxplugins.so+0x8d28] cache_has_enough_data+0xc
C [libfxplugins.so+0x74b8] progress_buffer_loop+0xbd
C [libgstreamer-lite.so+0x6bdd5] gst_task_func+0x203
C [libgstreamer-lite.so+0x6cebd] default_func+0x29
C [libglib-2.0.so.0+0x6c3a1] fileno+0x6c3a1
C [libglib-2.0.so.0+0x69bd0] fileno+0x69bd0
C [libpthread.so.0+0x5e99] abort@@GLIBC_2.0+0x5e99
This is an example response that causes the problem. Simply adding a Content-Length field to the header stops it crashing.
HTTP/1.0 200 OK
Content-Type: audio/mpeg
icy-br:256
icy-genre:blahblah
icy-name:blahblah
icy-notice1:<BR>This stream requires <a href="http://www.winamp.com/">Winamp</a><BR>
icy-notice2:SHOUTcast Distributed Network Audio Server/Linux v1.9.8<BR>
icy-pub:0
icy-url:http://somehost.com
Server: OnNet-CDN/1.0.11
Cache-Control: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
[binary mp3 data follows]
But I had a repeated crash in gstreamer because the proxy (and original icecast signal) wasn't sending any Content-Length header in the http response. If gstreamer and/or mediaplayer is used as part of the web browser component this has security implications since a URL could point to a service which returns such a http response (albeit an invalid one).
FWIW the crash occurred here:
Stack: [0x84dad000,0x855ae000], sp=0x855ad1e4, free space=8192k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libfxplugins.so+0x8d28] cache_has_enough_data+0xc
C [libfxplugins.so+0x74b8] progress_buffer_loop+0xbd
C [libgstreamer-lite.so+0x6bdd5] gst_task_func+0x203
C [libgstreamer-lite.so+0x6cebd] default_func+0x29
C [libglib-2.0.so.0+0x6c3a1] fileno+0x6c3a1
C [libglib-2.0.so.0+0x69bd0] fileno+0x69bd0
C [libpthread.so.0+0x5e99] abort@@GLIBC_2.0+0x5e99
This is an example response that causes the problem. Simply adding a Content-Length field to the header stops it crashing.
HTTP/1.0 200 OK
Content-Type: audio/mpeg
icy-br:256
icy-genre:blahblah
icy-name:blahblah
icy-notice1:<BR>This stream requires <a href="http://www.winamp.com/">Winamp</a><BR>
icy-notice2:SHOUTcast Distributed Network Audio Server/Linux v1.9.8<BR>
icy-pub:0
icy-url:http://somehost.com
Server: OnNet-CDN/1.0.11
Cache-Control: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
[binary mp3 data follows]