bugGnash - The GNU Flash player - Bugs: bug #16815, segfault in as_value.cpp to_bool...

 
 

bug #16815: segfault in as_value.cpp to_bool if (m_type == STRING)

Submitted by:  Patrice Dumas <pertusus>
Submitted on:  Sun 11 Jun 2006 09:26:28 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sat 01 Jul 2006 12:44:04 AM UTC, comment #9:

Forget about this, fixed the last bit of segfaulting behaviours.
Rest in piece, horrible SWF!

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sat 01 Jul 2006 12:36:05 AM UTC, comment #8:

Forgot to mention: to reproduce the bug you must click on the
'start' button. Here is the stack trace:

Program received signal SIGSEGV, Segmentation fault.
gnash::DisplayList::advance (this=0x847998c, delta_time=0.0419999994)
at stl_list.h:117
117 { _M_node = _M_node->_M_next; }
(gdb) bt
#0 gnash::DisplayList::advance (this=0x847998c, delta_time=0.0419999994)
at stl_list.h:117
#1 0x407c1e9d in gnash::sprite_instance::advance_sprite (this=0x84798e0,
delta_time=0) at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1179
#2 0x407c2005 in gnash::sprite_instance::advance (this=0x84798e0,
delta_time=0) at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1228
#3 0x4078b687 in gnash::DisplayList::advance (this=0x826d2cc,
delta_time=0.0419999994) at /home/strk/src/gnash/gnash/server/dlist.cpp:430
#4 0x407c1e9d in gnash::sprite_instance::advance_sprite (this=0x826d220,
delta_time=0) at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1179
#5 0x407c1f7d in gnash::sprite_instance::advance_root (this=0x826d220,
delta_time=0.0419999994)
at /home/strk/src/gnash/gnash/server/sprite_instance.cpp:1197
#6 0x40767c0b in gnash::movie_root::advance (this=0x83eb558,
delta_time=0.0419999994)
at /home/strk/src/gnash/gnash/server/movie_root.cpp:236
#7 0x0804bed9 in main (argc=2, argv=0xbffff634)
at /home/strk/src/gnash/gnash/backend/gnash.cpp:887

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sat 01 Jul 2006 12:33:49 AM UTC, comment #7:

Just a note, a bug fix just committed triggers a new segfault playing this movie. We know that the movie is bogus, but maybe this is a good chance of making gnash robust in these cases.
Since this bug item already has the movie attached, I'd keep it somehow opened. What's the best way to do this ?
Should I open a new bug and make it refer to this one for the attachment and listswf/flasm information?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sat 01 Jul 2006 12:19:26 AM UTC, comment #6:

I'll close this bug, but I'm interested in bug reports about "Stack underrun" conditions, expecially if the SWF is known
to be correct. In this case Ming also agrees with gnash in
that there's a Stack underrun condition as the first action
in the SWF is an ActionLogicalNot, which expects a value on the stack to which to apply the NOT op. Following is initial Ming's "listswf" output, which also show a duplicated ACTION_CONSTANTPOOL (also looking invalid).

Just in case Ming was wrong I also gave the movie a try
under 'flasm', which reports same problems.

So, kudos to Gnash that's able to not die with this !

[Ming]

File version: 6
File size: 386638
Frame size: (0,11200)x(0,8400)
Frame rate: 31.000000 / sec.
Total frames: 22

Offset: 21 (0x0015)
Block type: 9 (SWF_SETBACKGROUNDCOLOR)
Block length: 3

RGBA: ( 0, 0, 0,ff)

Offset: 26 (0x001a)
Block type: 45 (SWF_SOUNDSTREAMHEAD2)
Block length: 4

Offset: 32 (0x0020)
Block type: 12 (SWF_DOACTION)
Block length: 658

29 Actions
SWFACTION_LOGICALNOT
SWFACTION_IF
BranchOffset: 5
1 Action
SWFACTION_CONSTANTPOOL
SWFACTION_CONSTANTPOOL
[000] polosa

[flasm]

errors during run

Declared constant pool length 648 differs from calculated length 2
Declared constant pool length 39 differs from calculated length 2
Declared constant pool length 37 differs from calculated length 2
Declared constant pool length 8 differs from calculated length 2
Declared constant pool length 633 differs from calculated length 2
Declared constant pool length 396 differs from calculated length 2
Declared constant pool length 19 differs from calculated length 2

initial flm

movie '../../tests/warp-forest.swf' compressed // flash 6, total frames: 22, fra
me rate: 31 fps, 560x420 px

frame 0
not
branchIfTrue label1
constants

Sandro Santilli <strk>
Project MemberIn charge of this item.
Fri 30 Jun 2006 11:48:31 PM UTC, comment #5:

I don't know what the swf is supposed to do exactly.
It should resemble a game, it doesn't seem to start for now,
but this is really a separate issue, so this bug should be
closed.

Some errors still appear when started with -v which seems to
be related with Stack underrun, but there are other errors
and it is likely to be a example which is too complex for
gnash for now, so I'll go back to it in the future.

I cannot close the bug, but I believe it should be.

Patrice Dumas <pertusus>
Fri 30 Jun 2006 08:07:50 PM UTC, comment #4:

Equipped gnash with checks on stack size on each action handler.
Wheter due to malformed SWF or gnash bugs stack underruns
are now handled safely (ie: no aborts).
The warp-forest doesn't abort now. Fixing it further (assuming that the SWF is correct) requires knowing exactly what should be expected. I would close this item and ask the original submitter about filing a new report stating exactly what is expected and not happening.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 29 Jun 2006 12:41:52 AM UTC, comment #3:

Attached.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 26 Jun 2006 01:50:07 PM UTC, comment #2:

Updates: the url became invalid. If anyone can attach
the movie to this report we'll eventually try to fix
gnash.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 19 Jun 2006 10:23:57 AM UTC, comment #1:

the url of movie (for easy access):
http://media.koreus.com/banner-ads-00028/200606/warp-forest.swf

Generally, it's better to add the -v switch when facing a bug.
In this case, with head we get:

...
ERROR: export error: don't know how to export resource 'shot2'
ERROR: export error: don't know how to export resource 'shot1'
gnash: /home/strk/src/gnash/gnash/server/as_environment.h:126: gnash::as_value& gnash::as_environment::top(unsigned int): Assertion `m_stack.size() > dist' failed.

Basically, at the time ActionLogicalNot is found the stack
is empty. We had a similar problem with ActionPop, and I
made it a warning (if the stack is empty, there's nothing
to pop, just keep going). In this case what should we do ?
Log an error and exit ? Note that altought at the moment
the "empty stack" condition is probably due to some bug
in Gnash, in general it is always possible to have bogus
SWFs instead.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sun 11 Jun 2006 09:26:28 AM UTC, original submission:

gnash segfaults with the flash game located at

http://www.koreus.com/media/warp-forest.html

backtrace:

(gdb) bt
#0 gnash::as_value::to_bool (this=0xffffffe4) at as_value.cpp:243
#1 0x003fa836 in gnash::SWF::SWFHandlers::ActionLogicalNot (env=@0x93405cc)
at swf/ASHandlers.cpp:543
#2 0x003f99e2 in gnash::SWF::ActionHandler::execute (this=0x91e558c, env=@0x93405cc)
at swf/ASHandlers.cpp:121
#3 0x00405e16 in gnash::SWF::SWFHandlers::execute (this=0x454268,
type=gnash::SWF::ACTION_LOGICALNOT, env=@0x93405cc) at swf/ASHandlers.cpp:365
#4 0x003a6126 in gnash::action_buffer::execute (this=0x924e5c4, env=0x93405cc, start_pc=0,
exec_bytes=658, retval=0x0, initial_with_stack=@0xbfe6bbf4, is_function2=false)
at action.cpp:859
#5 0x003a926d in gnash::action_buffer::execute (this=0x924e5c4, env=0x93405cc) at action.cpp:693
#6 0x003e2c3c in gnash::sprite_instance::do_actions (this=0x93404e8) at sprite_instance.cpp:81
#7 0x003e900d in gnash::sprite_instance::on_event_load (this=0x93404e8) at sprite_instance.h:417
#8 0x0038d7f7 in gnash::movie_root::advance (this=0x9340398, delta_time=0) at movie_root.cpp:191
#9 0x0804be23 in main (argc=0, argv=Cannot access memory at address 0xffffffe8
) at gnash.cpp:866

Patrice Dumas <pertusus>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #10266:  warp-forest.swf added by strk (295KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 7 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sat 01 Jul 2006 12:19:26 AM UTCstrkStatusReady For Test=>Fixed
  Open/ClosedOpen=>Closed
Fri 30 Jun 2006 08:07:50 PM UTCstrkStatusIn Progress=>Ready For Test
Thu 29 Jun 2006 12:41:53 AM UTCstrkAttached File-=>Added warp-forest.swf, #10266
Thu 29 Jun 2006 12:41:52 AM UTCstrkStatusNeed Info=>In Progress
Mon 26 Jun 2006 01:50:07 PM UTCstrkStatusNone=>Need Info
Mon 19 Jun 2006 10:23:57 AM UTCstrkAssigned toNone=>strk

Back to the top


Powered by Savane 3.1-cleanup1