bugGnash - The GNU Flash player - Bugs: bug #42145, Use after free in getRunResources()

 
 

bug #42145: Use after free in getRunResources()

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Fri 18 Apr 2014 09:52:31 PM UTC
   
 
Category:  core Severity:  6 - Security
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 19 Apr 2014 12:25:04 PM UTC, comment #1: 

Fixed in c1083e3.

Bastiaan Jacques <bjacques>
Group Member
Fri 18 Apr 2014 09:52:31 PM UTC, original submission:  

STR: start gangsta_rap_se.swf, click play and allow the animation to run for a few seconds. Then exit Gnash.


==15117== Invalid read of size 8
==15117==    at 0x4C9BA2D: gnash::getRunResources(gnash::as_object const&) (as_object.cpp:1145)
==15117==    by 0x4CFA3B3: gnash::MovieClip::stopStreamSound() (MovieClip.cpp:2102)
==15117==    by 0x4CFC2A6: gnash::MovieClip::~MovieClip() (MovieClip.cpp:527)
==15117==    by 0x4CDD89C: gnash::SWFMovie::~SWFMovie() (Movie.h:57)
==15117==    by 0x56BD1E0: gnash::GC::~GC() (GC.cpp:62)
==15117==    by 0x4CE0CFD: gnash::movie_root::~movie_root() (movie_root.cpp:190)
==15117==    by 0x154999: gnash::Player::run(int, char**, std::string const&, std::string const&) (Player.cpp:661)
==15117==    by 0x12E7E0: playFile(gnash::Player&, int, char**, std::string const&) (gnash.cpp:92)
==15117==    by 0x13184E: main (bind.hpp:457)
==15117==  Address 0x23590c08 is 40 bytes inside a block of size 144 free'd
==15117==    at 0x4A07991: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==15117==    by 0x4C9657C: gnash::as_object::~as_object() (as_object.h:174)
==15117==    by 0x56BD1E0: gnash::GC::~GC() (GC.cpp:62)
==15117==    by 0x4CE0CFD: gnash::movie_root::~movie_root() (movie_root.cpp:190)
==15117==    by 0x154999: gnash::Player::run(int, char**, std::string const&, std::string const&) (Player.cpp:661)
==15117==    by 0x12E7E0: playFile(gnash::Player&, int, char**, std::string const&) (gnash.cpp:92)
==15117==    by 0x13184E: main (bind.hpp:457)


Presumably this is a destruction order issue.

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-04-19 bjacques StatusNone Fixed
        Assigned toNone bjacques
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code