Crash in player_ov_read when playing song

[ivankelly]

Im using openspotify with the spotify xbmc plugin, and everything but playback seems to be working ok. Log from playing the file is below. I've added the stripping header lines. The segfault occurs when there is previous_bytes, so it's subtracted from bytes_to_consume. Both previous_bytes and bytes_to_consume are 2048, so this makes bytes_to_consume 0. Then when the header is substracted from bytes_to_consume it becomes -167 and a memmove is attempted with this. I've tried a few changes, which stop the crash, but don't give playback.

#0 0xb6078d06 in ?? () from /lib/i686/cmov/libc.so.6 #1 0xb607b1ae in malloc () from /lib/i686/cmov/libc.so.6 #2 0xb5aaaaae in ?? () from /usr/lib/libxcb.so.1 #3 0xb5aa918b in ?? () from /usr/lib/libxcb.so.1 #4 0xb5aab761 in xcb_wait_for_reply () from /usr/lib/libxcb.so.1 #5 0xb5f237a6 in _XReply () from /usr/lib/libX11.so.6 #6 0xb5f17307 in XSync () from /usr/lib/libX11.so.6 #7 0xb62ced85 in ?? () from /usr/lib/libSDL-1.2.so.0 #8 0xb62d7312 in ?? () from /usr/lib/libSDL-1.2.so.0 #9 0xb62c1215 in SDL_FreeCursor () from /usr/lib/libSDL-1.2.so.0 #10 0xb62c1553 in ?? () from /usr/lib/libSDL-1.2.so.0 #11 0xb62c5c05 in SDL_VideoQuit () from /usr/lib/libSDL-1.2.so.0 #12 0xb629d5d3 in SDL_QuitSubSystem () from /usr/lib/libSDL-1.2.so.0 #13 0xb629d66e in SDL_Quit () from /usr/lib/libSDL-1.2.so.0 #14 0xb629deaf in ?? () from /usr/lib/libSDL-1.2.so.0 #15 #16 0xb60804f3 in memmove () from /lib/i686/cmov/libc.so.6 #17 0xb627b422 in player_ov_read (dest=0xb4b1cff, size=1, nmemb=2048, private=0xb2e84750) at player.c:830 #18 0xb5e8508b in ?? () from /usr/lib/libvorbisfile.so.3 #19 0xb5e85320 in ?? () from /usr/lib/libvorbisfile.so.3 #20 0xb5e87c09 in ?? () from /usr/lib/libvorbisfile.so.3 #21 0xb5e87ddd in ov_open_callbacks () from /usr/lib/libvorbisfile.so.3 player.c:437 player_schedule() SCHEDULER: INIT new track, calling ov_open_callbacks() player.c:649 player_ov_read() OV_READ: Want 2048 (1x2048) bytes from offset 0, have 0, is_downloading:0 player.c:697 player_ov_read() OV_READ: INSIDE: Requesting 4096 bytes from pos 0 (reader at 0, have 0 bytes) iothread.c:80 iothread() Processing request player.c:928 player_process_request() REQUEST: Got request PLAYER_SUBSTREAM channel.c:61 channel_register() Registered channel 'da5f73dc4eeb33c283c9f7fad6c1826add7b7927' with id 0 commands.c:327 cmd_getsubstreams() cmd_getsubstreams: allocated channel 0, retrieving song 'da5f73dc4eeb33c283c9f7fad6c1826add7b7927' commands.c:351 cmd_getsubstreams() Sending GetSubstreams(file_id=da5f73dc4eeb33c283c9f7fad6c1826add7b7927, offset=0 [0 bytes], length=1024 [4096 bytes]) packet.c:133 packet_write() Sending packet with command 0x08, length 44, IV=66 commands.c:363 cmd_getsubstreams() end request.c:140 request_set_result() Returned results for with output iothread.c:82 iothread() Request processing returned 0 packet.c:77 packet_read_and_process() 1448 bytes buffered, header.cmd=0x09, header.len=24 channel.c:173 channel_process() channel 0: Entering callback (header 1) for channel 'da5f73dc4eeb33c283c9f7fad6c1826add7b7927', 5 bytes data channel.c:173 channel_process() channel 0: Entering callback (header 2) for channel 'da5f73dc4eeb33c283c9f7fad6c1826add7b7927', 2 bytes data channel.c:173 channel_process() channel 0: Entering callback (header 3) for channel 'da5f73dc4eeb33c283c9f7fad6c1826add7b7927', 7 bytes data packet.c:77 packet_read_and_process() 1417 bytes buffered, header.cmd=0x09, header.len=4098 packet.c:77 packet_read_and_process() 2865 bytes buffered, header.cmd=0x09, header.len=4098 packet.c:77 packet_read_and_process() 4114 bytes buffered, header.cmd=0x09, header.len=4098 channel.c:203 channel_process() channel 0: Entering callback (state: data) for channel 'da5f73dc4eeb33c283c9f7fad6c1826add7b7927', 4096 bytes data player.c:730 player_ov_read() OV_READ: WILL STRIP HEADER, pos:0, len:4096

player.c:827 player_ov_read() OV_READ: STRIPPING HEADER, bytes to consume:2048

player.c:649 player_ov_read() OV_READ: Want 2048 (1x2048) bytes from offset 2048, have 2048, is_downloading:4096
player.c:661 player_ov_read() OV_READ: Off-boundary at position 2048, seeking back 2048 bytes
player.c:730 player_ov_read() OV_READ: WILL STRIP HEADER, pos:0, len:4096
player.c:827 player_ov_read() OV_READ: STRIPPING HEADER, bytes to consume:0
packet.c:77 packet_read_and_process() 9 bytes buffered, header.cmd=0xed, header.len=23819