Gnash - The GNU Flash player - Bugs: bug #19774, URGENT: Out of bounds memory...

Group

Main
- Main
- View members
- Search
Homepage
Download
Support
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Mailing lists
Source code
Bugs
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Tasks
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Patches
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
News
- Browse
- Atom feed
- ~~Submit~~
- ~~Manage~~

bug #19774: URGENT: Out of bounds memory access (leading to arbitrary code execution)

Submitter:	None
Submitted:	Wed 02 May 2007 03:14:04 PM UTC


Category:	ActionScript	Severity:	3 - Normal
Release:	None	Status:	Fixed
Privacy:	Public	Assigned to:	None
Open/Closed:	Closed

* Mandatory Fields

Add a New Comment Rich Markup

Thu 17 May 2007 02:40:44 PM UTC, comment #3: http://forums.speedguide.net/showthread.php?t=222145 http://forums.speedguide.net/showthread.php?t=222144 http://forums.speedguide.net/showthread.php?t=222143 http://forums.speedguide.net/showthread.php?t=222142 http://forums.speedguide.net/showthread.php?t=222141 http://forums.speedguide.net/showthread.php?t=222140 http://forums.speedguide.net/showthread.php?t=222139 http://forums.speedguide.net/showthread.php?t=222138 http://forums.speedguide.net/showthread.php?t=222137 http://forums.speedguide.net/showthread.php?t=222136 http://forums.speedguide.net/showthread.php?t=222135 http://forums.speedguide.net/showthread.php?t=222134 http://forums.speedguide.net/showthread.php?t=222133 http://forums.speedguide.net/showthread.php?t=222132 http://forums.speedguide.net/showthread.php?t=222131 http://forums.speedguide.net/showthread.php?t=222130 http://forums.speedguide.net/showthread.php?t=222129 http://forums.speedguide.net/showthread.php?t=222128 http://forums.speedguide.net/showthread.php?t=222127 http://forums.speedguide.net/showthread.php?t=222126 http://forums.speedguide.net/showthread.php?t=222125 http://forums.speedguide.net/showthread.php?t=222124 http://forums.speedguide.net/showthread.php?t=222123 http://forums.speedguide.net/showthread.php?t=222122 http://forums.speedguide.net/showthread.php?t=222121 http://forums.speedguide.net/showthread.php?t=222120 http://forums.speedguide.net/showthread.php?t=222119 http://forums.speedguide.net/showthread.php?t=222117 http://forums.speedguide.net/showthread.php?t=222116 http://forums.speedguide.net/showthread.php?t=222115 http://forums.speedguide.net/showthread.php?t=222114 http://forums.speedguide.net/showthread.php?t=222113 http://forums.speedguide.net/showthread.php?t=222112 http://forums.speedguide.net/showthread.php?t=222111 http://forums.speedguide.net/showthread.php?t=222110 http://forums.speedguide.net/showthread.php?t=222109 http://forums.speedguide.net/showthread.php?t=222108 http://forums.speedguide.net/showthread.php?t=222107 http://forums.speedguide.net/showthread.php?t=222106 http://forums.speedguide.net/showthread.php?t=222105 http://forums.speedguide.net/showthread.php?t=222104 http://forums.speedguide.net/showthread.php?t=222103 http://forums.speedguide.net/showthread.php?t=222102 http://forums.speedguide.net/showthread.php?t=222101 http://forums.speedguide.net/showthread.php?t=222100 http://forums.speedguide.net/showthread.php?t=222099 http://forums.speedguide.net/showthread.php?t=222098 http://forums.speedguide.net/showthread.php?t=222097 http://forums.speedguide.net/showthread.php?t=222096 http://forums.speedguide.net/showthread.php?t=222095 http://forums.speedguide.net/showthread.php?t=222094	Invalid User ID <#59428>
Wed 16 May 2007 08:33:25 AM UTC, comment #2: Confirmed to be fixed by Baby on irc and by pere on debian bug tracker (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=423433)	Sandro Santilli <strk>
Wed 02 May 2007 06:56:05 PM UTC, comment #1: Current HEAD raises a malformed SWF error in that case. MALFORMED SWF: last SHOWFRAME of a DEFINESPRITE tag isn't followed by an END. Seeking to next END tag. I think all assertions are in place too. Please check. (0.7.2 is not supported anymore)	Sandro Santilli <strk>
Wed 02 May 2007 03:14:04 PM UTC, original submission: When parsing a DEFINESPRITE tag gnash increases an internal variable (m_loading_frame) whenever it encounters a SHOWFRAME tag. After m_loading_frame gets bigger than m_frame_count some of the tag loader functions for the next tag (e.g. PLACEOBJECT) call add_execute_tag which calls m_playlist[m_loading_frame].push_back(c)(m_playlist has only m_frame_count elements, so m_playlist[m_loading_frame] references heap memory after m_playlist). This can end in freeing a user supplied address (see example). I have attached a patch to 0.7.2. -email is unavailable-	Anonymous

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:


Comment:

Attached Files

file #12670: gnash.patch added by None (404B - text/x-patch)

file #12671: gnashcrash.swf added by None (7KiB - application/x-shockwave-flash)

file #12672: gnashcrash.sswf added by None (6KiB - application/octet-stream)

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-email is unavailable- added by #59428 (Posted a comment)

-email is unavailable- added by strk (Posted a comment)

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

Please enter the title of George Orwell's famous dystopian book (it's a date):

Follow 7 latest changes.

Date	Changed by	Updated Field	Previous Value	Replaced by
2007-05-16	strk	Status	Ready For Test	Fixed
		Open/Closed	Open	Closed
2007-05-02	strk	Privacy	Private	Public
2007-05-02	strk	Status	None	Ready For Test
2007-05-02	None	Attached File	-	Added gnash.patch, #12670
		Attached File	-	Added gnashcrash.swf, #12671
		Attached File	-	Added gnashcrash.sswf, #12672

Gnash - The GNU Flash player - Bugs: bug #19774, URGENT: Out of bounds memory...

bug #19774: URGENT: Out of bounds memory access (leading to arbitrary code execution)

<a href="#postcomment">Post a Comment</a>

<a href="#discussion">Discussion</a>

<a href="#attached">Attached Files</a>

<a href="#dependencies">Dependencies</a>

<a href="#cc">Mail Notification Carbon-Copy List</a>

<a href="#votes">Votes</a>

<a href="#history">History</a>