bugGnash - The GNU Flash player - Bugs: bug #19952, regression: segfault at parse time...

 
 

bug #19952: regression: segfault at parse time with 3dtris.swf

Submitted by:  Sandro Santilli <strk>
Submitted on:  Thu 24 May 2007 01:08:16 PM UTC  
 
Category: soundSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 25 May 2007 12:47:46 PM UTC, comment #6:

confirmed

Sandro Santilli <strk>
Project Member
Fri 25 May 2007 12:43:48 PM UTC, comment #5:

I've just committed a fix. The problem was that the data pointer which was assigned into the data that is delete[]d, was actually a temporary pointer in adpcm_expand() which is used to walk the buffer. This caused delete[] to be called on a pointer to the end of the buffer, rather than the start. :)

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Fri 25 May 2007 12:08:09 PM UTC, comment #4:

So it's the new adpcm_expand() and the way it works that's the problem... Martin would you mind looking at it? - iirc you rewrote that code...

Tomas Groth <tgc>
Fri 25 May 2007 10:22:00 AM UTC, comment #3:

Another case:

http://www.atomfilms.com/afassets/flash/gangsta_rap_se.swf

      • glibc detected *** free(): invalid pointer: 0x08926d44 ***
Sandro Santilli <strk>
Project Member
Thu 24 May 2007 01:21:42 PM UTC, comment #2:

Similar problem with 568db6323c3109f.swf.

This time is a double free or corruption message from glib

      • glibc detected *** free(): invalid pointer: 0x0811f54c ***

gdb still reports the problem being in :

gnash::SWF::tag_loaders::define_sound_loader

In particular, the 'delete [] data' line.
Data is NOT null, even if set ot NULL before calling the function that supposedly allocates it.
Could it be allocation is not done using new [] ?

Sandro Santilli <strk>
Project Member
Thu 24 May 2007 01:12:14 PM UTC, comment #1:

Nah, setting to NULL didn't help... here's valgrind report:

==14686== Thread 2:
==14686== Invalid read of size 1
==14686== at 0x51760E4: GST_sound_handler::create_sound(void*, int, int, gnash::sound_handler::format_type, int, bool) (sound_handler_gst.cpp:97)
==14686== by 0x41C68BA: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream, gnash::SWF::tag_type, gnash::movie_definition) (tag_loaders.cpp:1168)
==14686== by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
==14686== by 0x42949B0: gnash::MovieLoader::execute(gnash::movie_def_impl*) (movie_def_impl.cpp:109)
==14686== by 0x42A3B02: void boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl> >::operator()<void ()(gnash::movie_def_impl), boost::_bi::list0>(boost::_bi::type<void>, void ()(gnash::movie_def_impl*)&, boost::_bi::list0&, int) (bind.hpp:229)
==14686== by 0x42A3B52: boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >::operator()() (bind_template.hpp:20)
==14686== by 0x42A3B7C: boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >, void>::invoke(boost::detail::function::any_pointer) (function_template.hpp:136)
==14686== by 0x4AE383C: (within /usr/lib/libboost_thread-gcc-mt-1_33_1.so.1.33.1)
==14686== by 0x4AED340: start_thread (in /lib/tls/i686/cmov/libpthread-2.3.6.so)
==14686== by 0x45A44ED: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
==14686== Address 0x564A28C is 0 bytes after a block of size 140 alloc'd
==14686== at 0x401CD67: operator new[](unsigned) (vg_replace_malloc.c:195)
==14686== by 0x41C4F58: gnash::adpcm_expand(unsigned char&, gnash::stream, int, bool) (tag_loaders.cpp:1774)
==14686== by 0x41C631D: gnash::SWF::tag_loaders::sound_expand(gnash::stream, gnash::sound_handler::format_type&, bool, bool, unsigned char&, unsigned&) (tag_loaders.cpp:1381)
==14686== by 0x41C686D: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream, gnash::SWF::tag_type, gnash::movie_definition) (tag_loaders.cpp:1160)
==14686== by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
==14686== by 0x42949B0: gnash::MovieLoader::execute(gnash::movie_def_impl*) (movie_def_impl.cpp:109)
==14686== by 0x42A3B02: void boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl> >::operator()<void ()(gnash::movie_def_impl), boost::_bi::list0>(boost::_bi::type<void>, void ()(gnash::movie_def_impl*)&, boost::_bi::list0&, int) (bind.hpp:229)
==14686== by 0x42A3B52: boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >::operator()() (bind_template.hpp:20)
==14686== by 0x42A3B7C: boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >, void>::invoke(boost::detail::function::any_pointer) (function_template.hpp:136)
==14686== by 0x4AE383C: (within /usr/lib/libboost_thread-gcc-mt-1_33_1.so.1.33.1)
==14686== by 0x4AED340: start_thread (in /lib/tls/i686/cmov/libpthread-2.3.6.so)
==14686== by 0x45A44ED: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
==14686==
==14686== Invalid free() / delete / delete[]
==14686== at 0x401D70A: operator delete[](void*) (vg_replace_malloc.c:256)
==14686== by 0x41C6918: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream, gnash::SWF::tag_type, gnash::movie_definition) (tag_loaders.cpp:1176)
==14686== by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)

Sandro Santilli <strk>
Project Member
Thu 24 May 2007 01:08:16 PM UTC, original submission:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1229300816 (LWP 21546)]
0xb79d2334 in free () from /lib/tls/i686/cmov/libc.so.6
(gdb) bt
#0 0xb79d2334 in free () from /lib/tls/i686/cmov/libc.so.6
#1 0xb7b518b1 in operator delete () from /usr/lib/libstdc++.so.6
#2 0xb7b518fd in operator delete[] () from /usr/lib/libstdc++.so.6
#3 0xb7dcd912 in gnash::SWF::tag_loaders::define_sound_loader (in=0x822cc18, tag=gnash::SWF::DEFINESOUND, m=0x822d5f8) at swf/tag_loaders.cpp:1176
#4 0xb7e9b6e5 in gnash::movie_def_impl::read_all_swf (this=0x822d5f8) at movie_def_impl.cpp:889
#5 0xb7e9b9a9 in gnash::MovieLoader::execute (md=0x822d5f8) at movie_def_impl.cpp:109

It's not clear to me where is 'data' allocated. Anyway it is not initialized to NULL. I'm trying simply initializing it to see if the bug is fixed.

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #12885:  3dtris.swf added by martinwguy (19KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by tgc (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 29 May 2007 12:59:29 AM UTCmartinwguyAttached File-=>Added 3dtris.swf, #12885
    Fri 25 May 2007 12:47:46 PM UTCstrkOpen/ClosedOpen=>Closed
    Fri 25 May 2007 12:45:35 PM UTCbjacquesStatusReady For Test=>Fixed
      Assigned tomartinwguy=>bjacques
    Fri 25 May 2007 12:43:48 PM UTCbjacquesStatusNone=>Ready For Test
    Fri 25 May 2007 12:08:09 PM UTCtgcAssigned toNone=>martinwguy
    Thu 24 May 2007 01:12:14 PM UTCstrkAssigned tostrk=>None
      Carbon-Copy-=>Added martinwguy
      Carbon-Copy-=>Added tgc

    Back to the top


    Powered by Savane 3.1-cleanup1