bugGnash - The GNU Flash player - Bugs: bug #34686, action_buffer.cpp:52: void...


bug #34686: action_buffer.cpp:52: void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int): Assertion `endPos <= in.get

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Sat Oct 29 16:53:34 2011  
Category: parserSeverity: 5 - Blocker
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):

You are not logged in

Please log in, so followups can be emailed to you.


(Jump to the original submission Jump to the original submission)

Sat Jul 13 22:17:28 2013, comment #6:

I've committed a testcase in e93616f79c that will show (if you try to) that an empty action should not hide a later, non-empty action.

As for the fix, I realised it is silly to read a further byte, and then to create an empty action buffer, if the event length is zero.

Fixed in 9a68f3e0.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sun Oct 30 09:16:54 2011, comment #5:

event_length - (hasKeyPress ? -1 : 0)

The above will add 1 rather than subtract it.

Would love to see a testcase for this showing how such a partial event handler should not hide later defined ones.
Such test would be along the lines of:

onClipKeyPress = <no_action>
onClipMouseDown = action 2

The test should check that onClipMouseDown is executed even if onClipKeyPress was invalid.

Sandro Santilli <strk>
Project Member
Sat Oct 29 22:23:55 2011, comment #4:

That would fix the abort. But we might be skipping over legitimate information if we break. What do you think of this approach?

(file #24244)

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sat Oct 29 19:33:07 2011, comment #3:

Moving the consistency checking function after event_lenght decrement should fix this, right ? The one currently done efter event_length first read.

Sandro Santilli <strk>
Project Member
Sat Oct 29 18:37:47 2011, comment #2:


In readPlaceActions(SWFStream& in), when event_length is first read, it is zero. A key press event is detected, so event_length is reduced by one. event_length is unsigned, so it becomes a very large number. This amount is then passed on to action_buffer::read(), leading, if you are lucky, to an abort.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sat Oct 29 18:28:42 2011, comment #1:

I'm attaching the SWF. Can be reproduced offline. Version 8.

(file #24243)

Sandro Santilli <strk>
Project Member
Sat Oct 29 16:53:34 2011, original submission:

Downstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=702348 ; although my backtrace is a bit different.

STR: gui/gnash http://ads.standartnews.com/www/images/fibank_berbo_yes_728x90_wo_cyr.swf

Note the value of event_length in the below trace.

#3 0x0000003f7162ef62 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4 0x00007ffff7b37fe5 in gnash::action_buffer::read (this=0x7fffed4c1150, in=..., endPos=4294975083) at ../../../gnash/libcore/parser/action_buffer.cpp:52
startPos = 7788
_PRETTY_FUNCTION_ = "void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int)"
size = 32767
buf = 0x7fffed4c1150 ""
#5 0x00007ffff79fbe95 in gnash::SWF::PlaceObject2Tag::readPlaceActions (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:178
flags = 26889728
action = {_M_ptr = 0x7fffed4c1150}
total_known_events = 19
event_length = 4294967295
ch = gnash::key::INVALID
s_code_bits = {gnash::event_id::LOAD, gnash::event_id::ENTER_FRAME, gnash::event_id::UNLOAD, gnash::event_id::MOUSE_MOVE, gnash::event_id::MOUSE_DOWN,
gnash::event_id::MOUSE_UP, gnash::event_id::KEY_DOWN, gnash::event_id::KEY_UP, gnash::event_id::DATA, gnash::event_id::INITIALIZE, gnash::event_id::PRESS,
gnash::event_id::RELEASE, gnash::event_id::RELEASE_OUTSIDE, gnash::event_id::ROLL_OVER, gnash::event_id::ROLL_OUT, gnash::event_id::DRAG_OVER,
gnash::event_id::DRAG_OUT, gnash::event_id::KEY_PRESS, gnash::event_id::CONSTRUCT}
movie_version = 8
reserved = 0
all_event_flags = 2048
#6 0x00007ffff79fc355 in gnash::SWF::PlaceObject2Tag::readPlaceObject2 (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:299
No locals.
#7 0x00007ffff79fcc65 in gnash::SWF::PlaceObject2Tag::read (this=0x7fffed426430, in=..., tag=gnash::SWF::PLACEOBJECT2)
at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:439
No locals.
#8 0x00007ffff79fce9d in gnash::SWF::PlaceObject2Tag::loader (in=..., tag=gnash::SWF::PLACEOBJECT2, m=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:482
"static void gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, const gnash::RunResources&)"
ch = {px = 0x7fffed426430}
#9 0x00007ffff7b3d140 in gnash::SWFParser::read (this=0x7fffe99bba60, bytes=40079) at ../../../gnash/libcore/parser/SWFParser.cpp:96
lf = 0x7ffff79fce04 <gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, gnash::RunResources const&)>
startPos = 7701
tagLoaders = @0x7ffff4b564f0
#10 0x00007ffff7b4284f in gnash::SWFMovieDefinition::read_all_swf (this=0x7fffed49b000) at ../../../gnash/libcore/parser/SWFMovieDefinition.cpp:477
_PRETTY_FUNCTION_ = "void gnash::SWFMovieDefinition::read_all_swf()"
startPos = 21

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #24244:  gnash-actionbuf-fix.diff added by bjacques (1kB - text/x-patch - proposed fix)
file #24243:  test.swf added by strk (27kB - application/x-shockwave-flash)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by bjacques (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat Jul 13 22:17:28 2013bjacquesStatusConfirmed=>Fixed
    Sat Jul 13 11:44:01 2013bjacquesSeverity4 - Important=>5 - Blocker
    Sun Jul 7 13:42:22 2013bjacquesSeverity3 - Normal=>4 - Important
    Sat Oct 29 22:23:55 2011bjacquesAttached File-=>Added gnash-actionbuf-fix.diff, #24244
    Sat Oct 29 18:28:42 2011strkAttached File-=>Added test.swf, #24243

    Back to the top

    Powered by Savane 3.1-cleanup1