bugGnash - The GNU Flash player - Bugs: bug #23028, Uncontrollable loop

 
 

bug #23028: Uncontrollable loop

Submitter:  None
Submitted:  Wed 23 Apr 2008 11:02:05 AM UTC
   
 
Category:  None Severity:  3 - Normal
Release:  None Status:  Confirmed
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 27 Sep 2010 04:31:02 PM UTC, comment #13: 

I tested http://www.stackopolis.com/play/assets/stackopolisV26.swf with the git trunk version (the one after 0.8.8 was released), and the loop still happen with this version.

 Petter Reinholdtsen <pere>
Group Member
  Spam posted by anonymous
Thu 31 Jul 2008 06:55:52 AM UTC, comment #11: 

just tried adding a ShowFrame between the two DoAction blocks.
Still works.
Now I wonder if you can also jump into the middle of a non-action tag thus forcing interpretation of the bytes there as actions
(like, anyone feels like trying to stealth code info shapes ?)

 Sandro Santilli <strk>
Group Member
Thu 31 Jul 2008 06:39:13 AM UTC, comment #10: 

Attached is a diff against trunk adding an swfmill-based teast
for the jump-to-previous-block case.

Gnash fails.
The patch doesn't implement "expecting" the failure.

It could be modified to insert an in-between non-action
tag to check if the offset is really based on the SWF stream
offsets. It probably is.

I don't commit this myself cause it'd take 30 minutes for me..

(file #16215)

 Sandro Santilli <strk>
Group Member
Wed 30 Jul 2008 05:32:56 PM UTC, comment #9: 

Yes, the woodmann.com site seems to describe what's happening. I'd guess it's a jump-back obfuscation, where we are supposed to jump backwards into the middle of the unknown tag 253 (which should be skipped) and then possibly out again. If that's the case, Gnash is jumping back much too far.

The variable names are also obfuscated, but that shouldn't cause Gnash any problems.

 Benjamin Wolsey <bwy>
Group Member
Wed 30 Jul 2008 12:59:00 PM UTC, comment #8: 

I searched a bit and found some interesting sites:
http://www.gotoandplay.it/_articles/2004/04/swfProtection.php
http://www.woodmann.com/forum/archive/index.php/t-10300.html

As far as I understand the tag 253 is something like DoAction OR DoInitAction ( at least it has actionscript code). I tried out this in impl.cpp/ensure_loaders_registered:
register_tag_loader(SWF::STUPID, DoActionTag::doActionLoader);
where SWF::STUPID is 253. This caused the movie's loader part to work well but then the result is miserable again.

 Kristof Szilagyi <szkristof>
Tue 29 Jul 2008 08:43:32 PM UTC, comment #7: 

I've been looking at this SWF with swfmill, flasm and ming, and all of them look like they can't parse it correctly. I'm fairly sure the jump should never be attempted, as this would likely cause the pp to fail as well.

Ming parses various different sections of the SWF as an unknown tag, although variable names crop up in those unknown tags. One such section:

Offset: 73 (0x0049)
Block type: 253 (Unknown Block Type)
Block length: 155

0000: 99 02 00 34 00 63 02 00  00 00 96 09 00 08 00 07   
0010: 13 00 00 00 08 01 23 96  09 00 08 00 07 11 00 00   
0020: 00 05 00 23 96 02 00 08  02 1c 96 04 00 08 03 05   
0030: 00 4f 00 00 99 02 00 fc  ff 96 02 00 05 01 96 02   
0040: 00 05 00 96 02 00 05 00  96 02 00 05 01 9d 02 00   
0050: 19 00 88 16 00 04 00 00  4c 4f 57 00 53 74 61 67   
0060: 65 00 73 68 6f 77 4d 65  6e 75 00 9d 02 00 0d 00   
0070: 88 0a 00 04 00 01 00 02  00 03 00 04 00 9d 02 00   
0080: 0f 00 96 02 00 05 01 96  02 00 05 00 99 02 00 bc   
0090: ff 99 02 00 74 ff 99 02  00 0b 00                  
...4.c.. ........
......#. ........
...#.... ........
.O...... ........
........ ........
........ LOW.Stag
e.showMe nu......
........ ........
........ ........
....t... ...

The tag length field here is 16255, followed by 155, so ming is doing what it's supposed to; only the result is nonsense. All the decompilation after this first 'unknown' tag also looks extremely unlikely.

Converting to XML then back again with swfmill makes an SWF play in the pp like the original does in Gnash.

 Benjamin Wolsey <bwy>
Group Member
Tue 29 Jul 2008 07:41:13 PM UTC, comment #6: 

We already have a test for jump-after-END opcode under misc-swfmill.all, maybe we should add a jump-before-start too,
checking if you can jump to arbitrary sections in the input stream ?

 Sandro Santilli <strk>
Group Member
Tue 29 Jul 2008 07:28:48 AM UTC, comment #5: 

It looks like it's been obfuscated somehow - listswf / listswf_d indeed give weird output.


This comes up a lot:
PC:60 - EX: ActionBranchAlways ( -77)
After execution: PC 60, next PC 18446744073709551604, stack follows

Both gnash and the pp stop executing a frame's actions in this case (when the jump ends up before 0) (I've only tested with single-frame movies so far). Perhaps the offsets or offset values are being incorrectly parsed in Gnash (and ming), as the pp carries on playing while Gnash jumps to the next frame.

 Benjamin Wolsey <bwy>
Group Member
Wed 07 May 2008 05:29:06 AM UTC, comment #4: 

swfdump works with it.

BTW, this file is surely malformed.  Don't know how the movie is controled, actionscripts in it do not make any sense to me...








Zou Lunkai <zoulunkai>
Tue 06 May 2008 10:16:45 AM UTC, comment #3: 

still, if the proprietary player plays it, we should as well..
Please file a bug on bugs.libming.org for listswf

 Sandro Santilli <strk>
Group Member
Tue 06 May 2008 07:28:10 AM UTC, comment #2: 

I'v tried dump the file with listswf, failed. Seems the file itself is malformed.


Zou Lunkai <zoulunkai>
Wed 23 Apr 2008 12:26:41 PM UTC, comment #1: 

Zou, sounds timeline control related...

 Sandro Santilli <strk>
Group Member
Wed 23 Apr 2008 11:02:05 AM UTC, original submission:  

Run http://www.stackopolis.com/play/assets/stackopolisV26.swf and wait for the menu to load, then after a few seconds it will start looping through the game and playing a specific sound over and over.
Version is SWF6.

 Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #16215:  jump_to_prev_block.patch added by strk (4KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by pere (Posted a comment)
  • -email is unavailable- added by szkristof (Posted a comment)
  • -email is unavailable- added by bwy (Posted a comment)
  • -email is unavailable- added by zoulunkai (Posted a comment)
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by strk

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-07-31 strk Attached File- Added jump_to_prev_block.patch, #16215
    2008-05-06 strk StatusNone Confirmed
    2008-04-23 strk Carbon-Copy- Added zoulunkai

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-df36.
    Corresponding source code