[Tremor] Segfault problems with tremor

[Andrew de Quincey]

Hi, I'm attempting to port Tremor to the helix client as a replacement for the 
current FP-based libvorbis. The actual port was relatively easy, as the APIs 
are so similar. However I am having segfault problems in Tremor. I am using 
GCC 3.3.4, uclibc (latest snapshot), on the powerpc.

The problem is coming from here:

void _vorbis_block_ripcord(vorbis_block *vb){
  /* reap the chain */
  struct alloc_chain *reap=vb->reap;
  while(reap){
    struct alloc_chain *next=reap->next;
    _ogg_free(reap->ptr);
    memset(reap,0,sizeof(*reap));
    _ogg_free(reap);
    reap=next;
  }

The call to _ogg_free() causes the segfault. The reason for this _seems_ to be 
in vorbis_block_init():

int vorbis_block_init(vorbis_dsp_state *v, vorbis_block *vb){
  memset(vb,0,sizeof(*vb));
  vb->vd=v;
  vb->localalloc=0;
  vb->localstore=NULL;

  return(0);
}

Specifically,   the memset(vb,0,sizeof(*vb));
This is NOT wiping the supplied vorbis_block structure; it is only wiping the 
first 4 bytes of it - the size of a pointer on the PPC - so the "struct 
alloc_chain*" pointer, "reap"  is pointing at some random value, as well as 
most of the rest of the structure.

In fact, this seems to be present in several places in the code. Am I missing 
something obvious?




the structure of vorbis_block is as follows:


typedef struct vorbis_block{
  /* necessary stream state for linking to the framing abstraction */
  ogg_int32_t  **pcm;       /* this is a pointer into local storage */
  oggpack_buffer opb;

  long  lW;
  long  W;
  long  nW;
  int   pcmend;
  int   mode;

  int         eofflag;
  ogg_int64_t granulepos;
  ogg_int64_t sequence;
  vorbis_dsp_state *vd; /* For read-only access of configuration */

  /* local storage to avoid remallocing; it's up to the mapping to
     structure it */
  void               *localstore;
  long                localtop;
  long                localalloc;
  long                totaluse;
  struct alloc_chain *reap;

} vorbis_block;