bugGnash - The GNU Flash player - Bugs: bug #31044, memory corruption in XMLNode

 
 

bug #31044: memory corruption in XMLNode

Submitter:  Torstein <kvikende>
Submitted:  Wed 15 Sep 2010 02:16:32 PM UTC
   
 
Category:  None Severity:  6 - Security
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 02 Nov 2013 08:57:41 AM UTC, comment #5: 

Ok got it, it's not marking the parent, but the parent's object.
I don't really understand why that's needed and don't see a testcase in the commit but I know calling setReachable multiple times for an as_object doesn't hurt so no problem for me.

Sandro Santilli <strk>
Group Member
Fri 01 Nov 2013 09:36:59 PM UTC, comment #4: 

This bug was supposedly fixed by http://git.savannah.gnu.org/cgit/gnash.git/commit/?id=38be50cecc4648289d7a4820ad188ee7d2db4ab2

But the introduced parent-mark is in contraddition with XMLNode_a class documentation (in the header file) that says:

/// 3. The top node of an XML tree is always accessible in ActionScript, either
///    as an XML_as or a user-created XMLNode_as.
/// 4. XMLNodes consequently mark their children as reachable, but not their
///    parent.


Memory management for XMLNode object seems to be really confusing.
See also bug #40439

Sandro Santilli <strk>
Group Member
Wed 13 Oct 2010 03:09:15 PM UTC, comment #3: 

A run with valgrind here showed lots of issues but none with XML (all with ffmpeg and sdl sound).

Sandro Santilli <strk>
Group Member
Mon 27 Sep 2010 08:13:50 AM UTC, comment #2: 

Should be fixed in trunk. It seems the object associated with a parent node was getting deleted.

Benjamin Wolsey <bwy>
Group Member
Fri 17 Sep 2010 02:16:29 PM UTC, comment #1: 

This is a memory corruption from accessing a deleted DisplayObject from XMLNode_parentNode, valgrind shows. I've misplaced my valgrind report.

Benjamin Wolsey <bwy>
Group Member
Wed 15 Sep 2010 02:16:32 PM UTC, original submission:  

Hello.

I am running Firefox 4.0 Beta 5 on Fedora 13 x64 with the Gnash plug in installed.

When visiting http://code.bocoup.com/audio-data-api/flash-vs-html5/ you'll hear the late Michael Jackson play and watch him dance. However, on the right there's a button and a scrollable area. Press the play button in the scrollable area and Gnash seg. faults according to Fedora's ABRT.

Downstream bug report: https://bugzilla.redhat.com/show_bug.cgi?id=633395


Note: Due to my unfamiliarity with Savannah I managed to report this as a support ticket instead of a bug. Link: https://savannah.gnu.org/support/?107478

Sorry for that.

Torstein <kvikende>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #21465:  gnashbacktrace.txt added by kvikende (232KiB - text/plain - Back trace from ABRT)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by bwy (Posted a comment)
  • -email is unavailable- added by kvikende (Submitted the item)
  • -email is unavailable- added by kvikende
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 12 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-02 strk StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2013-11-01 strk StatusFixed Ready For Test
        Open/ClosedClosed Open
    2010-10-13 strk StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2010-09-27 bwy StatusConfirmed Ready For Test
    2010-09-17 bwy Severity3 - Normal 6 - Security
        StatusNone Confirmed
        SummaryA flash file causes seg fault #0 0x00000000016851b2 in ?? () memory corruption in XMLNode
    2010-09-15 kvikende Attached File- Added gnashbacktrace.txt, #21465
        Carbon-Copy- Added kvikende

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code