bugGnash - The GNU Flash player - Bugs: bug #34686, action_buffer.cpp:52: void...


bug #34686: action_buffer.cpp:52: void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int): Assertion `endPos <= in.get

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Sat 29 Oct 2011 04:53:34 PM UTC  
Category:  parser Severity:  5 - Blocker
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  Bastiaan Jacques <bjacques>
Open/Closed:  Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


( Jump to the original submission)

Sat 13 Jul 2013 10:17:28 PM UTC, comment #6:

I've committed a testcase in e93616f79c that will show (if you try to) that an empty action should not hide a later, non-empty action.

As for the fix, I realised it is silly to read a further byte, and then to create an empty action buffer, if the event length is zero.

Fixed in 9a68f3e0.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sun 30 Oct 2011 09:16:54 AM UTC, comment #5:

event_length - (hasKeyPress ? -1 : 0)

The above will add 1 rather than subtract it.

Would love to see a testcase for this showing how such a partial event handler should not hide later defined ones.
Such test would be along the lines of:

onClipKeyPress = <no_action>
onClipMouseDown = action 2

The test should check that onClipMouseDown is executed even if onClipKeyPress was invalid.

Sandro Santilli <strk>
Project Member
Sat 29 Oct 2011 10:23:55 PM UTC, comment #4:

That would fix the abort. But we might be skipping over legitimate information if we break. What do you think of this approach?

(file #24244)

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sat 29 Oct 2011 07:33:07 PM UTC, comment #3:

Moving the consistency checking function after event_lenght decrement should fix this, right ? The one currently done efter event_length first read.

Sandro Santilli <strk>
Project Member
Sat 29 Oct 2011 06:37:47 PM UTC, comment #2:


In readPlaceActions(SWFStream& in), when event_length is first read, it is zero. A key press event is detected, so event_length is reduced by one. event_length is unsigned, so it becomes a very large number. This amount is then passed on to action_buffer::read(), leading, if you are lucky, to an abort.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sat 29 Oct 2011 06:28:42 PM UTC, comment #1:

I'm attaching the SWF. Can be reproduced offline. Version 8.

(file #24243)

Sandro Santilli <strk>
Project Member
Sat 29 Oct 2011 04:53:34 PM UTC, original submission:

Downstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=702348 ; although my backtrace is a bit different.

STR: gui/gnash http://ads.standartnews.com/www/images/fibank_berbo_yes_728x90_wo_cyr.swf

Note the value of event_length in the below trace.

#3 0x0000003f7162ef62 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4 0x00007ffff7b37fe5 in gnash::action_buffer::read (this=0x7fffed4c1150, in=..., endPos=4294975083) at ../../../gnash/libcore/parser/action_buffer.cpp:52
startPos = 7788
_PRETTY_FUNCTION_ = "void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int)"
size = 32767
buf = 0x7fffed4c1150 ""
#5 0x00007ffff79fbe95 in gnash::SWF::PlaceObject2Tag::readPlaceActions (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:178
flags = 26889728
action = {_M_ptr = 0x7fffed4c1150}
total_known_events = 19
event_length = 4294967295
ch = gnash::key::INVALID
s_code_bits = {gnash::event_id::LOAD, gnash::event_id::ENTER_FRAME, gnash::event_id::UNLOAD, gnash::event_id::MOUSE_MOVE, gnash::event_id::MOUSE_DOWN,
gnash::event_id::MOUSE_UP, gnash::event_id::KEY_DOWN, gnash::event_id::KEY_UP, gnash::event_id::DATA, gnash::event_id::INITIALIZE, gnash::event_id::PRESS,
gnash::event_id::RELEASE, gnash::event_id::RELEASE_OUTSIDE, gnash::event_id::ROLL_OVER, gnash::event_id::ROLL_OUT, gnash::event_id::DRAG_OVER,
gnash::event_id::DRAG_OUT, gnash::event_id::KEY_PRESS, gnash::event_id::CONSTRUCT}
movie_version = 8
reserved = 0
all_event_flags = 2048
#6 0x00007ffff79fc355 in gnash::SWF::PlaceObject2Tag::readPlaceObject2 (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:299
No locals.
#7 0x00007ffff79fcc65 in gnash::SWF::PlaceObject2Tag::read (this=0x7fffed426430, in=..., tag=gnash::SWF::PLACEOBJECT2)
at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:439
No locals.
#8 0x00007ffff79fce9d in gnash::SWF::PlaceObject2Tag::loader (in=..., tag=gnash::SWF::PLACEOBJECT2, m=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:482
"static void gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, const gnash::RunResources&)"
ch = {px = 0x7fffed426430}
#9 0x00007ffff7b3d140 in gnash::SWFParser::read (this=0x7fffe99bba60, bytes=40079) at ../../../gnash/libcore/parser/SWFParser.cpp:96
lf = 0x7ffff79fce04 <gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, gnash::RunResources const&)>
startPos = 7701
tagLoaders = @0x7ffff4b564f0
#10 0x00007ffff7b4284f in gnash::SWFMovieDefinition::read_all_swf (this=0x7fffed49b000) at ../../../gnash/libcore/parser/SWFMovieDefinition.cpp:477
_PRETTY_FUNCTION_ = "void gnash::SWFMovieDefinition::read_all_swf()"
startPos = 21

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #24244:  gnash-actionbuf-fix.diff added by bjacques (1KiB - text/x-patch - proposed fix)
file #24243:  test.swf added by strk (27KiB - application/x-shockwave-flash)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by strk (Updated the item)
  • -email is unavailable- added by bjacques (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-07-13 bjacques StatusConfirmed => Fixed
        Open/ClosedOpen => Closed
    2013-07-13 bjacques Severity4 - Important => 5 - Blocker
    2013-07-07 bjacques Severity3 - Normal => 4 - Important
    2011-10-29 bjacques Attached File- => Added gnash-actionbuf-fix.diff, #24244
    2011-10-29 strk Attached File- => Added test.swf, #24243

    Back to the top

    Powered by Savane 3.4