bugGnash - The GNU Flash player - Bugs: bug #34686, action_buffer.cpp:52: void...


bug #34686: action_buffer.cpp:52: void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int): Assertion `endPos <= in.get

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Sat 29 Oct 2011 04:53:34 PM UTC  
Category: parserSeverity: 5 - Blocker
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


(Jump to the original submission Jump to the original submission)

Sat 13 Jul 2013 10:17:28 PM UTC, comment #6:

I've committed a testcase in e93616f79c that will show (if you try to) that an empty action should not hide a later, non-empty action.

As for the fix, I realised it is silly to read a further byte, and then to create an empty action buffer, if the event length is zero.

Fixed in 9a68f3e0.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sun 30 Oct 2011 09:16:54 AM UTC, comment #5:

event_length - (hasKeyPress ? -1 : 0)

The above will add 1 rather than subtract it.

Would love to see a testcase for this showing how such a partial event handler should not hide later defined ones.
Such test would be along the lines of:

onClipKeyPress = <no_action>
onClipMouseDown = action 2

The test should check that onClipMouseDown is executed even if onClipKeyPress was invalid.

Sandro Santilli <strk>
Project Member
Sat 29 Oct 2011 10:23:55 PM UTC, comment #4:

That would fix the abort. But we might be skipping over legitimate information if we break. What do you think of this approach?

(file #24244)

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sat 29 Oct 2011 07:33:07 PM UTC, comment #3:

Moving the consistency checking function after event_lenght decrement should fix this, right ? The one currently done efter event_length first read.

Sandro Santilli <strk>
Project Member
Sat 29 Oct 2011 06:37:47 PM UTC, comment #2:


In readPlaceActions(SWFStream& in), when event_length is first read, it is zero. A key press event is detected, so event_length is reduced by one. event_length is unsigned, so it becomes a very large number. This amount is then passed on to action_buffer::read(), leading, if you are lucky, to an abort.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sat 29 Oct 2011 06:28:42 PM UTC, comment #1:

I'm attaching the SWF. Can be reproduced offline. Version 8.

(file #24243)

Sandro Santilli <strk>
Project Member
Sat 29 Oct 2011 04:53:34 PM UTC, original submission:

Downstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=702348 ; although my backtrace is a bit different.

STR: gui/gnash http://ads.standartnews.com/www/images/fibank_berbo_yes_728x90_wo_cyr.swf

Note the value of event_length in the below trace.

#3 0x0000003f7162ef62 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4 0x00007ffff7b37fe5 in gnash::action_buffer::read (this=0x7fffed4c1150, in=..., endPos=4294975083) at ../../../gnash/libcore/parser/action_buffer.cpp:52
startPos = 7788
_PRETTY_FUNCTION_ = "void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int)"
size = 32767
buf = 0x7fffed4c1150 ""
#5 0x00007ffff79fbe95 in gnash::SWF::PlaceObject2Tag::readPlaceActions (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:178
flags = 26889728
action = {_M_ptr = 0x7fffed4c1150}
total_known_events = 19
event_length = 4294967295
ch = gnash::key::INVALID
s_code_bits = {gnash::event_id::LOAD, gnash::event_id::ENTER_FRAME, gnash::event_id::UNLOAD, gnash::event_id::MOUSE_MOVE, gnash::event_id::MOUSE_DOWN,
gnash::event_id::MOUSE_UP, gnash::event_id::KEY_DOWN, gnash::event_id::KEY_UP, gnash::event_id::DATA, gnash::event_id::INITIALIZE, gnash::event_id::PRESS,
gnash::event_id::RELEASE, gnash::event_id::RELEASE_OUTSIDE, gnash::event_id::ROLL_OVER, gnash::event_id::ROLL_OUT, gnash::event_id::DRAG_OVER,
gnash::event_id::DRAG_OUT, gnash::event_id::KEY_PRESS, gnash::event_id::CONSTRUCT}
movie_version = 8
reserved = 0
all_event_flags = 2048
#6 0x00007ffff79fc355 in gnash::SWF::PlaceObject2Tag::readPlaceObject2 (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:299
No locals.
#7 0x00007ffff79fcc65 in gnash::SWF::PlaceObject2Tag::read (this=0x7fffed426430, in=..., tag=gnash::SWF::PLACEOBJECT2)
at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:439
No locals.
#8 0x00007ffff79fce9d in gnash::SWF::PlaceObject2Tag::loader (in=..., tag=gnash::SWF::PLACEOBJECT2, m=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:482
"static void gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, const gnash::RunResources&)"
ch = {px = 0x7fffed426430}
#9 0x00007ffff7b3d140 in gnash::SWFParser::read (this=0x7fffe99bba60, bytes=40079) at ../../../gnash/libcore/parser/SWFParser.cpp:96
lf = 0x7ffff79fce04 <gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, gnash::RunResources const&)>
startPos = 7701
tagLoaders = @0x7ffff4b564f0
#10 0x00007ffff7b4284f in gnash::SWFMovieDefinition::read_all_swf (this=0x7fffed49b000) at ../../../gnash/libcore/parser/SWFMovieDefinition.cpp:477
_PRETTY_FUNCTION_ = "void gnash::SWFMovieDefinition::read_all_swf()"
startPos = 21

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #24244:  gnash-actionbuf-fix.diff added by bjacques (1KiB - text/x-patch - proposed fix)
file #24243:  test.swf added by strk (27KiB - application/x-shockwave-flash)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by bjacques (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 13 Jul 2013 10:17:28 PM UTCbjacquesStatusConfirmed=>Fixed
    Sat 13 Jul 2013 11:44:01 AM UTCbjacquesSeverity4 - Important=>5 - Blocker
    Sun 07 Jul 2013 01:42:22 PM UTCbjacquesSeverity3 - Normal=>4 - Important
    Sat 29 Oct 2011 10:23:55 PM UTCbjacquesAttached File-=>Added gnash-actionbuf-fix.diff, #24244
    Sat 29 Oct 2011 06:28:42 PM UTCstrkAttached File-=>Added test.swf, #24243

    Back to the top

    Powered by Savane 3.1-cleanup1