bugGnash - The GNU Flash player - Bugs: bug #42372, integer overflow from RTMP.cpp:1162

 
 

bug #42372: integer overflow from RTMP.cpp:1162

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Thu 15 May 2014 08:58:15 PM UTC
   
 
Category:  core Severity:  3 - Normal
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 16 May 2014 12:09:55 PM UTC, comment #5: 

Polish added in 46367cd4cd4.

Bastiaan Jacques <bjacques>
Group Member
Thu 15 May 2014 11:24:42 PM UTC, comment #4: 

Given that the protocol mandates 32-bit timestamp sizes and presumably also the ms granularity, any timestamp source would eventually overflow.

In 45d6c4aaf0 I have attempted to let the overflow happen, avoiding undefined behaviour.

Bastiaan Jacques <bjacques>
Group Member
Thu 15 May 2014 10:14:33 PM UTC, comment #3: 

Actually, the previous comment assumes the system in question has 100 ticks per second. And even then, I miscalculated the uptime: it's actually 66 days, so the overflow is not as huge.

Not that this changes the nature of the problem, of course.

Bastiaan Jacques <bjacques>
Group Member
Thu 15 May 2014 10:02:03 PM UTC, comment #2: 

The problem seems to be here that getUptime() returns the uptime in milliseconds, whereas a system's uptime in ms necessarily overflows a 32-bit integer in under 50 days. In this case, the system has an uptime of over two years.

The calculated value is being used as a timestamp in RTMP messages. I wonder if we could use another source for timestamping.

Bastiaan Jacques <bjacques>
Group Member
Thu 15 May 2014 08:59:35 PM UTC, comment #1: 

I can't reproduce the error with ubsan. Possibly because I use a different architechture, or perhaps because my curl installation lacks RTMP support.

Bastiaan Jacques <bjacques>
Group Member
Thu 15 May 2014 08:58:15 PM UTC, original submission:  

Ubsan reported the following error, see http://gnashdev.org:8010/builders/rawhide-linux-i386/builds/332/steps/make_anal_verbose/logs/stdio :

RTMP.cpp:1162:22: runtime error: signed integer overflow: 570358355 * 1000 cannot be represented in type 'long int'

Gabriele produced this stacktrace: https://paste.debian.net/plain/99725

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #31387:  42372 added by gg0 (36KiB - application/octet-stream - backtrace)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gg0 (Updated the item)
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-16 bjacques StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2014-05-16 gg0 Attached File- Added 42372, #31387
    2014-05-15 bjacques StatusNone Ready For Test
        Assigned toNone bjacques

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code