bugGnash - The GNU Flash player - Bugs: bug #20657, YouTube: segfault (GC-related)

 
 

bug #20657: YouTube: segfault (GC-related)

Submitter:  Sandro Santilli <strk>
Submitted:  Thu 02 Aug 2007 02:54:24 AM UTC
   
 
Category:  core Severity:  6 - Security
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  strk
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 03 Aug 2007 04:08:46 AM UTC, comment #3: 

Valgrind report:

==13384== Invalid read of size 4
==13384==    at 0x841ACD6: gnash::GetterSetter::setValue(gnash::as_object*, gnash::as_value const&) const (GetterSetter.cpp:54)
==13384==    by 0x82E0777: gnash::as_object::set_member_default(std::string const&, gnash::as_value const&) (as_object.cpp:214)
==13384==    by 0x82A2B39: gnash::ActionExec::setObjectMember(gnash::as_object&, std::string const&, gnash::as_value const&) (ActionExec.cpp:471)
==13384==    by 0x8286E93: gnash::SWF::SWFHandlers::ActionSetMember(gnash::ActionExec&) (intrusive_ptr.hpp:114)
==13384==    by 0x82A4819: gnash::ActionExec::operator()() (ActionExec.cpp:218)
==13384==    by 0x831FEB1: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:326)
==13384==    by 0x82B2056: gnash::call_method(gnash::as_value const&, gnash::as_environment*, gnash::as_object*, int, int) (action.cpp:230)
==13384==    by 0x8286A9E: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (intrusive_ptr.hpp:109)
==13384==    by 0x82A4819: gnash::ActionExec::operator()() (ActionExec.cpp:218)
==13384==    by 0x831FEB1: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:326)
==13384==    by 0x82B2056: gnash::call_method(gnash::as_value const&, gnash::as_environment*, gnash::as_object*, int, int) (action.cpp:230)
==13384==    by 0x8286A9E: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (intrusive_ptr.hpp:109)
==13384==  Address 0x63165F0 is 0 bytes inside a block of size 60 free'd
==13384==    at 0x40213B6: operator delete(void*) (vg_replace_malloc.c:244)
==13384==    by 0x845C8CB: gnash::GC::cleanUnreachable() (GC.cpp:96)
==13384==    by 0x845D4D8: gnash::GC::collect() (GC.cpp:141)

Sandro Santilli <strk>
Group Member
Thu 02 Aug 2007 06:19:41 AM UTC, comment #2: 

The missing attachment...

(file #13551)

Sandro Santilli <strk>
Group Member
Thu 02 Aug 2007 04:54:11 AM UTC, comment #1: 

Note that player2.swf played locally works fine:
md5sum: 93a0dedd6e0cc8b074d4c5674d638f58

Maybe the player currently online is yet another one ?

Sandro Santilli <strk>
Group Member
Thu 02 Aug 2007 02:54:24 AM UTC, original submission:  

Attached is an SWF as downloaded from youtube.
segfaults with -r0.

Backtrace:

Program received signal SIGSEGV, Segmentation fault. 
[Switching to Thread -1223804480 (LWP 3308)]
0x083dec89 in ?? ()
(gdb) bt
#0  0x083dec89 in ?? ()
#1  0x08265e40 in gnash::GetterSetter::setValue (this=0x83dec24, this_ptr=0x83deab8, val=@0x83deab8)
    at /home/strk/src/gnash/gnash-head/server/GetterSetter.cpp:54
#2  0x081ad134 in gnash::as_object::set_member_default (this=0x83ddbe8, key=@0x8588b74, val=@0x8588b80)
    at /home/strk/src/gnash/gnash-head/server/as_object.cpp:214
#3  0x081950b0 in gnash::ActionExec::setObjectMember (this=0xbfd1a470, obj=@0x83ddbe8, var=@0x8588b74, val=@0x8588b80)
    at /home/strk/src/gnash/gnash-head/server/vm/ActionExec.cpp:471
#4  0x081829c4 in gnash::SWF::SWFHandlers::ActionSetMember (thread=@0xbfd1a470) at /usr/include/boost/intrusive_ptr.hpp:114
#5  0x0817d5e2 in gnash::SWF::SWFHandlers::execute (this=0x8311d10, type=138094888, thread=@0x83deab8) at /usr/include/c++/3.4/bits/stl_vector.h:462
#6  0x08196665 in gnash::ActionExec::operator() (this=0xbfd1a470) at /home/strk/src/gnash/gnash-head/server/vm/ActionExec.cpp:218
#7  0x081d076b in gnash::swf_function::operator() (this=0x83c5e88, fn=@0xbfd1a5b0) at /home/strk/src/gnash/gnash-head/server/swf_function.cpp:326
#8  0x0819860b in gnash::call_method (method=@0x83deab8, env=0x83deab8, this_ptr=0x83deab8, nargs=138275512, first_arg_bottom_index=138275512)
    at /home/strk/src/gnash/gnash-head/server/vm/action.cpp:230

Sandro Santilli <strk>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #13551:  segfault.swf added by strk (26KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-08-06 strk StatusNone Fixed
        Assigned toNone strk
        Open/ClosedOpen Closed
    2007-08-03 strk SummaryYouTube: segfault YouTube: segfault (GC-related)
        Carbon-Copy- Added zoulunkai
    2007-08-02 strk Attached File- Added segfault.swf, #13551

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code