bugGnash - The GNU Flash player - Bugs: bug #34686, action_buffer.cpp:52: void...

 
 

bug #34686: action_buffer.cpp:52: void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int): Assertion `endPos <= in.get

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Sat 29 Oct 2011 04:53:34 PM UTC
   
 
Category:  parser Severity:  5 - Blocker
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 13 Jul 2013 10:17:28 PM UTC, comment #6: 

I've committed a testcase in e93616f79c that will show (if you try to) that an empty action should not hide a later, non-empty action.

As for the fix, I realised it is silly to read a further byte, and then to create an empty action buffer, if the event length is zero.

Fixed in 9a68f3e0.

Bastiaan Jacques <bjacques>
Group Member
Sun 30 Oct 2011 09:16:54 AM UTC, comment #5: 

event_length - (hasKeyPress ? -1 : 0)

The above will add 1 rather than subtract it.

Would love to see a testcase for this showing how such a partial event handler should not hide later defined ones.
Such test would be along the lines of:

 onClipKeyPress = <no_action>
 onClipMouseDown = action 2

The test should check that onClipMouseDown is executed even if onClipKeyPress was invalid.

Sandro Santilli <strk>
Group Member
Sat 29 Oct 2011 10:23:55 PM UTC, comment #4: 

That would fix the abort. But we might be skipping over legitimate information if we break. What do you think of this approach?

(file #24244)

Bastiaan Jacques <bjacques>
Group Member
Sat 29 Oct 2011 07:33:07 PM UTC, comment #3: 

Moving the consistency checking function after event_lenght decrement should fix this, right ? The one currently done efter event_length first read.

Sandro Santilli <strk>
Group Member
Sat 29 Oct 2011 06:37:47 PM UTC, comment #2: 

Analysis:

In readPlaceActions(SWFStream& in), when event_length is first read, it is zero. A key press event is detected, so event_length is reduced by one. event_length is unsigned, so it becomes a very large number. This amount is then passed on to action_buffer::read(), leading, if you are lucky, to an abort.

Bastiaan Jacques <bjacques>
Group Member
Sat 29 Oct 2011 06:28:42 PM UTC, comment #1: 

I'm attaching the SWF. Can be reproduced offline. Version 8.

(file #24243)

Sandro Santilli <strk>
Group Member
Sat 29 Oct 2011 04:53:34 PM UTC, original submission:  

Downstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=702348 ; although my backtrace is a bit different.

STR: gui/gnash http://ads.standartnews.com/www/images/fibank_berbo_yes_728x90_wo_cyr.swf

Note the value of event_length in the below trace.

#3  0x0000003f7162ef62 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4  0x00007ffff7b37fe5 in gnash::action_buffer::read (this=0x7fffed4c1150, in=..., endPos=4294975083) at ../../../gnash/libcore/parser/action_buffer.cpp:52
        startPos = 7788
        _PRETTY_FUNCTION_ = "void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int)"
        size = 32767
        buf = 0x7fffed4c1150 ""
#5  0x00007ffff79fbe95 in gnash::SWF::PlaceObject2Tag::readPlaceActions (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:178
        flags = 26889728
        action = {_M_ptr = 0x7fffed4c1150}
        total_known_events = 19
        event_length = 4294967295
        ch = gnash::key::INVALID
        s_code_bits = {gnash::event_id::LOAD, gnash::event_id::ENTER_FRAME, gnash::event_id::UNLOAD, gnash::event_id::MOUSE_MOVE, gnash::event_id::MOUSE_DOWN,
    gnash::event_id::MOUSE_UP, gnash::event_id::KEY_DOWN, gnash::event_id::KEY_UP, gnash::event_id::DATA, gnash::event_id::INITIALIZE, gnash::event_id::PRESS,
    gnash::event_id::RELEASE, gnash::event_id::RELEASE_OUTSIDE, gnash::event_id::ROLL_OVER, gnash::event_id::ROLL_OUT, gnash::event_id::DRAG_OVER,
    gnash::event_id::DRAG_OUT, gnash::event_id::KEY_PRESS, gnash::event_id::CONSTRUCT}
        movie_version = 8
        reserved = 0
        all_event_flags = 2048
#6  0x00007ffff79fc355 in gnash::SWF::PlaceObject2Tag::readPlaceObject2 (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:299
No locals.
#7  0x00007ffff79fcc65 in gnash::SWF::PlaceObject2Tag::read (this=0x7fffed426430, in=..., tag=gnash::SWF::PLACEOBJECT2)
    at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:439
No locals.
#8  0x00007ffff79fce9d in gnash::SWF::PlaceObject2Tag::loader (in=..., tag=gnash::SWF::PLACEOBJECT2, m=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:482
        _PRETTY_FUNCTION_ =
    "static void gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, const gnash::RunResources&)"
        ch = {px = 0x7fffed426430}
#9  0x00007ffff7b3d140 in gnash::SWFParser::read (this=0x7fffe99bba60, bytes=40079) at ../../../gnash/libcore/parser/SWFParser.cpp:96
        lf = 0x7ffff79fce04 <gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, gnash::RunResources const&)>
        startPos = 7701
        tagLoaders = @0x7ffff4b564f0
#10 0x00007ffff7b4284f in gnash::SWFMovieDefinition::read_all_swf (this=0x7fffed49b000) at ../../../gnash/libcore/parser/SWFMovieDefinition.cpp:477
        _PRETTY_FUNCTION_ = "void gnash::SWFMovieDefinition::read_all_swf()"
        startPos = 21

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #24244:  gnash-actionbuf-fix.diff added by bjacques (1KiB - text/x-patch - proposed fix)
file #24243:  test.swf added by strk (27KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Updated the item)
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-07-13 bjacques StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2013-07-13 bjacques Severity4 - Important 5 - Blocker
    2013-07-07 bjacques Severity3 - Normal 4 - Important
    2011-10-29 bjacques Attached File- Added gnash-actionbuf-fix.diff, #24244
    2011-10-29 strk Attached File- Added test.swf, #24243

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code