bugGnash - The GNU Flash player - Bugs: bug #16311, segmentation fault when opening...

 
 

bug #16311: segmentation fault when opening attached file

Submitted by:  Pablo Rodríguez <ousia>
Submitted on:  Sun 09 Apr 2006 05:33:56 PM UTC  
 
Category: coreSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 08 Nov 2006 02:55:19 PM UTC, comment #7:

This looks like an unsupported SWF version. Will check again when I have a chance. Meanwhile, if anyone could try at reproducing that would hepl.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 01 Aug 2006 12:35:26 AM UTC, comment #6:

I gave this item another shot.
What I found out is that a DefineFont2 tag contains a glyphs
offset table which seems bogus:

table_base at 36 - glyph 0 at 828 (base+792) - stream at 828
table_base at 36 - glyph 1 at 829 (base+793) - stream at 830

The above basically says that glyph0 is 1-byte long: from offset
828 to offset 829 (as written in the SWF itself).

I can't find any way to define a shape in a single byte.
1 byte is used for fill and style num bits, and at least another
byte is used for the end-shape-record (in case of a null shape).

So, either the SWF is really bad or we miss something about the
meaning of the offset value (reported to be expressed in bytes
from Alexis' reference: http://sswf.sourceforge.net/SWFalexref.html#tag_definefont2)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 12 Jul 2006 04:16:02 PM UTC, comment #5:

This would need some research on interpretation of the 777 tag.
Any help is appreciated. None of the available clean sources
seem to contain information about it.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 12 Jul 2006 11:28:30 AM UTC, comment #4:

Firefox (using flash-plugin-7.0.61) plays it fine.

Pablo Rodríguez <ousia>
Mon 10 Jul 2006 11:25:07 PM UTC, comment #3:

I tried disassembling the SWF with both Ming and flasm.
Both agree on the fact that the SWF is malformed.
Flasm reports: unknown tag 777.
Can you actually play this file with any player ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Fri 30 Jun 2006 08:20:37 PM UTC, comment #2:

Confirmed. As usual, a minimal testcase, possibly with Ming sources would be the best approach.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Fri 21 Apr 2006 04:15:17 PM UTC, comment #1:

This appears to be a bug with DefineFont2. It sees something in the input stream it doesn't like and calls abort().

Rob Savoye <rsavoye>
Project Administrator
Sun 09 Apr 2006 05:33:56 PM UTC, original submission:

After having dowloaded CVS-20060409, I get a segmentation fault with the attached file (that was generated with pdf2swf from swftools).

The error I get is:

lt-gnash: font.cpp:207: void gnash::font::read(gnash::stream, int, gnash::movie_definition): Assertion `new_pos >= in->get_position()' failed.

And here is the backtrace:

#0 0xffffe410 in ?? ()
#1 0xbfffeeac in ?? ()
#2 0x00000006 in ?? ()
#3 0x00001f6d in ?? ()
#4 0xb77c16e5 in raise () from /lib/tls/libc.so.6
#5 0xb77c3049 in abort () from /lib/tls/libc.so.6
#6 0xb77bad71 in __assert_fail () from /lib/tls/libc.so.6
#7 0xb7c95c2e in gnash::font::read () from /usr/lib/libgnashserver.so.0
#8 0xb7ca3817 in gnash::define_font_loader ()
from /usr/lib/libgnashserver.so.0
#9 0xb7cc33b0 in gnash::movie_def_impl::read ()
from /usr/lib/libgnashserver.so.0
#10 0xb7ca4d6d in gnash::create_movie_sub () from /usr/lib/libgnashserver.so.0
#11 0xb7ca523f in gnash::create_library_movie_sub ()
from /usr/lib/libgnashserver.so.0
#12 0xb7ca599b in gnash::create_library_movie ()
from /usr/lib/libgnashserver.so.0
#13 0x0804bd46 in ?? ()
#14 0xb77aee4b in __libc_start_main () from /lib/tls/libc.so.6
#15 0x0804b671 in ?? ()

gcc -v
Reading specs from /usr/lib/gcc/i586-mandrake-linux-gnu/3.4.3/specs
Configured with: ../configure --prefix=/usr --libexecdir=/usr/lib --with-slibdir=/lib --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --enable-long-long --enable-__cxa_atexit --enable-clocale=gnu --disable-libunwind-exceptions --enable-languages=c,c++,ada,f77,objc,java --host=i586-mandrake-linux-gnu --with-system-zlib
Thread model: posix
gcc version 3.4.3 (Mandrakelinux 10.2 3.4.3-7mdk)

uname -r
2.6.11-6mdk

Thanks for your excellent work. I hope it helps,

Pablo

Pablo Rodríguez <ousia>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 11 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Thu 09 Nov 2006 02:18:54 PM UTCstrkStatusIn Progress=>Fixed
  Open/ClosedOpen=>Closed
Thu 09 Nov 2006 01:54:56 PM UTCstrkStatusConfirmed=>In Progress
Wed 08 Nov 2006 02:55:19 PM UTCstrkCategoryNone=>core
  Severity3 - Normal=>5 - Blocker
Mon 09 Oct 2006 10:39:41 AM UTCtgcAttached File#9748=>Removed
Wed 12 Jul 2006 04:16:02 PM UTCstrkStatusNeed Info=>Confirmed
  Assigned toNone=>strk
Mon 10 Jul 2006 11:25:07 PM UTCstrkStatusConfirmed=>Need Info
Fri 30 Jun 2006 08:20:37 PM UTCstrkStatusNone=>Confirmed
Sun 09 Apr 2006 05:33:56 PM UTCousiaAttached File-=>Added jono-bacon.swf, #9748

Back to the top


Powered by Savane 3.1-cleanup1