bugGnash - The GNU Flash player - Bugs: bug #19774, URGENT: Out of bounds memory...

 
 

bug #19774: URGENT: Out of bounds memory access (leading to arbitrary code execution)

Submitter:  None
Submitted:  Wed 02 May 2007 03:14:04 PM UTC
   
 
Category:  ActionScript Severity:  3 - Normal
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 17 May 2007 02:40:44 PM UTC, comment #3: 


http://forums.speedguide.net/showthread.php?t=222145
http://forums.speedguide.net/showthread.php?t=222144
http://forums.speedguide.net/showthread.php?t=222143
http://forums.speedguide.net/showthread.php?t=222142
http://forums.speedguide.net/showthread.php?t=222141
http://forums.speedguide.net/showthread.php?t=222140
http://forums.speedguide.net/showthread.php?t=222139
http://forums.speedguide.net/showthread.php?t=222138
http://forums.speedguide.net/showthread.php?t=222137
http://forums.speedguide.net/showthread.php?t=222136
http://forums.speedguide.net/showthread.php?t=222135
http://forums.speedguide.net/showthread.php?t=222134
http://forums.speedguide.net/showthread.php?t=222133
http://forums.speedguide.net/showthread.php?t=222132
http://forums.speedguide.net/showthread.php?t=222131
http://forums.speedguide.net/showthread.php?t=222130
http://forums.speedguide.net/showthread.php?t=222129
http://forums.speedguide.net/showthread.php?t=222128
http://forums.speedguide.net/showthread.php?t=222127
http://forums.speedguide.net/showthread.php?t=222126
http://forums.speedguide.net/showthread.php?t=222125
http://forums.speedguide.net/showthread.php?t=222124
http://forums.speedguide.net/showthread.php?t=222123
http://forums.speedguide.net/showthread.php?t=222122
http://forums.speedguide.net/showthread.php?t=222121
http://forums.speedguide.net/showthread.php?t=222120
http://forums.speedguide.net/showthread.php?t=222119
http://forums.speedguide.net/showthread.php?t=222117
http://forums.speedguide.net/showthread.php?t=222116
http://forums.speedguide.net/showthread.php?t=222115
http://forums.speedguide.net/showthread.php?t=222114
http://forums.speedguide.net/showthread.php?t=222113
http://forums.speedguide.net/showthread.php?t=222112
http://forums.speedguide.net/showthread.php?t=222111
http://forums.speedguide.net/showthread.php?t=222110
http://forums.speedguide.net/showthread.php?t=222109
http://forums.speedguide.net/showthread.php?t=222108
http://forums.speedguide.net/showthread.php?t=222107
http://forums.speedguide.net/showthread.php?t=222106
http://forums.speedguide.net/showthread.php?t=222105
http://forums.speedguide.net/showthread.php?t=222104
http://forums.speedguide.net/showthread.php?t=222103
http://forums.speedguide.net/showthread.php?t=222102
http://forums.speedguide.net/showthread.php?t=222101
http://forums.speedguide.net/showthread.php?t=222100
http://forums.speedguide.net/showthread.php?t=222099
http://forums.speedguide.net/showthread.php?t=222098
http://forums.speedguide.net/showthread.php?t=222097
http://forums.speedguide.net/showthread.php?t=222096
http://forums.speedguide.net/showthread.php?t=222095
http://forums.speedguide.net/showthread.php?t=222094


Invalid User ID <#59428>
Wed 16 May 2007 08:33:25 AM UTC, comment #2: 

Confirmed to be fixed by Baby on irc and by pere on debian bug tracker (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=423433)

Sandro Santilli <strk>
Group Member
Wed 02 May 2007 06:56:05 PM UTC, comment #1: 

Current HEAD raises a malformed SWF error in that case.

MALFORMED SWF: last SHOWFRAME of a DEFINESPRITE tag isn't followed by an END. Seeking to next END tag.

I think all assertions are in place too. Please check.

(0.7.2 is not supported anymore)

Sandro Santilli <strk>
Group Member
Wed 02 May 2007 03:14:04 PM UTC, original submission:  

When parsing a DEFINESPRITE tag gnash increases an internal
variable (m_loading_frame) whenever it encounters a SHOWFRAME tag.

After m_loading_frame gets bigger than m_frame_count some of the
tag loader functions for the next tag (e.g. PLACEOBJECT) call
add_execute_tag which calls m_playlist[m_loading_frame].push_back(c)(m_playlist has only m_frame_count elements, so m_playlist[m_loading_frame] references heap memory after m_playlist). This can end in freeing a user supplied address (see example).


I have attached a patch to 0.7.2.


-email is unavailable-

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #12670:  gnash.patch added by None (404B - text/x-patch)
file #12671:  gnashcrash.swf added by None (7KiB - application/x-shockwave-flash)
file #12672:  gnashcrash.sswf added by None (6KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by #59428 (Posted a comment)
  • -email is unavailable- added by strk (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-05-16 strk StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2007-05-02 strk PrivacyPrivate Public
    2007-05-02 strk StatusNone Ready For Test
    2007-05-02 None Attached File- Added gnash.patch, #12670
        Attached File- Added gnashcrash.swf, #12671
        Attached File- Added gnashcrash.sswf, #12672

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code