bugGnash - The GNU Flash player - Bugs: bug #32732, Assertion `std::ftell(_data) ==...

 
 

bug #32732: Assertion `std::ftell(_data) == pos' failed. in tu_file.cpp:182

Submitter:  Sandro Santilli <strk>
Submitted:  Wed 09 Mar 2011 10:44:58 PM UTC
   
 
Category:  video-ffmpeg Severity:  5 - Blocker
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 11 Mar 2011 03:59:14 PM UTC, comment #9: 

Fixed by 1163866db47b0177d0dd894dc5e50ccc5cf9734b

Sandro Santilli <strk>
Group Member
Thu 10 Mar 2011 04:12:04 PM UTC, comment #8: 


> Isn't 4294990684 the numerical value that string::npos evaluates to on a 32bit machine ?


No. npos is numeric_limits<unsigned int>::max(), which is 4294967295. The offset in question is thus greater than the maximum value of an unsigned int.

Bastiaan Jacques <bjacques>
Group Member
Thu 10 Mar 2011 11:22:38 AM UTC, comment #7: 

Ah! Then this is a simple case of buffer overflow.

I think the bug is in tu_file::seek(std::streampos pos).

On your 64-bit machine size_t is a 64-bit integer, so that the following line:

    if (static_cast<size_t>(pos) > size()) return false;

actually returns false, because the file size is too large. So that's why you can't reproduce the assertion on the 64-bit machine.

On the 32-bit machine, the 64-bit integer (std::streampos) overflows in the static_cast to size_t, which is 32-bits. It then becomes a relatively small number, which is a reasonable number for a file size.

In the call to fseek, the integer again gets cast to a long (32-bit), again turning it into a small number.

A little while later the assertion compares the original streampos (a very large number) to the current file position, and lo and behold, it is not where it is supposed to be.

Bastiaan Jacques <bjacques>
Group Member
Thu 10 Mar 2011 08:18:45 AM UTC, comment #6: 

@bjacques is the other way around: I can only reproduce on the 32bit system, so rob's a good point.

Sandro Santilli <strk>
Group Member
Thu 10 Mar 2011 01:02:41 AM UTC, comment #5: 

Sandro is only able to reproduce this issue on his 64-bit machine.

Bastiaan Jacques <bjacques>
Group Member
Wed 09 Mar 2011 11:05:46 PM UTC, comment #4: 

Isn't 4294990684 the numerical value that string::npos evaluates to on a 32bit machine ?

Rob Savoye <rsavoye>
Group administrator
Wed 09 Mar 2011 10:55:09 PM UTC, comment #3: 

Actually, tu_file::seek() checks that the offset is less than size(), so that theory goes out the window.

Bastiaan Jacques <bjacques>
Group Member
Wed 09 Mar 2011 10:52:19 PM UTC, comment #2: 

4294990684 seems like an unreasonably large offset. The easy way to fix would be to check that offset < stream->size().

Bastiaan Jacques <bjacques>
Group Member
Wed 09 Mar 2011 10:46:43 PM UTC, comment #1: 

For the record, my snow.mpg file md5: 310a5779e53cf4fa13298876aa64804c

Sandro Santilli <strk>
Group Member
Wed 09 Mar 2011 10:44:58 PM UTC, original submission:  

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb7d51b70 (LWP 23388)]
0x0012d422 in __kernel_vsyscall ()
(gdb) bt          
#0  0x0012d422 in __kernel_vsyscall ()
#1  0x0138d651 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x01390a82 in *__GI_abort () at abort.c:92
#3  0x01386718 in *__GI___assert_fail (assertion=0xa675d6 "std::ftell(_data) == pos",
    file=0xa70dfc "../../gnash-git/libbase/tu_file.cpp", line=182,
    function=0xa716a0 "virtual bool gnash::tu_file::seek(std::streampos)") at assert.c:81
#4  0x00a4171b in gnash::tu_file::seek (this=0x8269d30, pos=...) at ../../gnash-git/libbase/tu_file.cpp:182
#5  0x009b672b in gnash::media::ffmpeg::MediaParserFfmpeg::seekMedia (this=0x8209800, offset=4294990684, whence=0)
    at ../../gnash-git/libmedia/ffmpeg/MediaParserFfmpeg.cpp:561
#6  0x009b6b32 in gnash::media::ffmpeg::MediaParserFfmpeg::seekMediaWrapper (opaque=0x8209800, offset=4295434624,
    whence=0) at ../../gnash-git/libmedia/ffmpeg/MediaParserFfmpeg.cpp:59
#7  0x02251c35 in ?? () from /usr/lib/i686/cmov/libavformat.so.52


The above was running gui/gtk-gnash easyvideo.swf with Gnash 0.8.9dev (master-19991-f07c4e9).

media.flv (loaded by easyvideo.swf) is a symlink to snow.mpg (the infamous snow plugin demo). I could not reproduce the same problem on the 64bit machine. This one is linux-lucid-x86 (the buildbot slave).

Sandro Santilli <strk>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by strk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-11 strk StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2011-03-10 bjacques StatusNone Ready For Test
        Assigned toNone bjacques

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code