bugGnash - The GNU Flash player - Bugs: bug #19952, regression: segfault at parse time...

 
 

bug #19952: regression: segfault at parse time with 3dtris.swf

Submitter:  Sandro Santilli <strk>
Submitted:  Thu 24 May 2007 01:08:16 PM UTC
   
 
Category:  sound Severity:  5 - Blocker
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 25 May 2007 12:47:46 PM UTC, comment #6: 

confirmed

Sandro Santilli <strk>
Group Member
Fri 25 May 2007 12:43:48 PM UTC, comment #5: 

I've just committed a fix. The problem was that the data pointer which was assigned into the data that is delete[]d, was actually a temporary pointer in adpcm_expand() which is used to walk the buffer. This caused delete[] to be called on a pointer to the end of the buffer, rather than the start. :)

Bastiaan Jacques <bjacques>
Group Member
Fri 25 May 2007 12:08:09 PM UTC, comment #4: 

So it's the new adpcm_expand() and the way it works that's the problem... Martin would you mind looking at it? - iirc you rewrote that code...

Tomas Groth <tgc>
Fri 25 May 2007 10:22:00 AM UTC, comment #3: 



Another case:

http://www.atomfilms.com/afassets/flash/gangsta_rap_se.swf

* glibc detected * free(): invalid pointer: 0x08926d44 *

Sandro Santilli <strk>
Group Member
Thu 24 May 2007 01:21:42 PM UTC, comment #2: 

Similar problem with 568db6323c3109f.swf.

This time is a double free or corruption message from glib

* glibc detected * free(): invalid pointer: 0x0811f54c *

gdb still reports the problem being in :

gnash::SWF::tag_loaders::define_sound_loader

In particular, the 'delete [] data' line.
Data is NOT null, even if set ot NULL before calling the function that supposedly allocates it.
Could it be allocation is not done using new [] ?

Sandro Santilli <strk>
Group Member
Thu 24 May 2007 01:12:14 PM UTC, comment #1: 

Nah, setting to NULL didn't help... here's valgrind report:

==14686== Thread 2:
==14686== Invalid read of size 1
==14686==    at 0x51760E4: GST_sound_handler::create_sound(void*, int, int, gnash::sound_handler::format_type, int, bool) (sound_handler_gst.cpp:97)
==14686==    by 0x41C68BA: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream*, gnash::SWF::tag_type, gnash::movie_definition*) (tag_loaders.cpp:1168)
==14686==    by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
==14686==    by 0x42949B0: gnash::MovieLoader::execute(gnash::movie_def_impl*) (movie_def_impl.cpp:109)
==14686==    by 0x42A3B02: void boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> >::operator()<void ()(gnash::movie_def_impl), boost::_bi::list0>(boost::_bi::type<void>, void ()(gnash::movie_def_impl)&, boost::_bi::list0&, int) (bind.hpp:229)
==14686==    by 0x42A3B52: boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >::operator()() (bind_template.hpp:20)
==14686==    by 0x42A3B7C: boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >, void>::invoke(boost::detail::function::any_pointer) (function_template.hpp:136)
==14686==    by 0x4AE383C: (within /usr/lib/libboost_thread-gcc-mt-1_33_1.so.1.33.1)
==14686==    by 0x4AED340: start_thread (in /lib/tls/i686/cmov/libpthread-2.3.6.so)
==14686==    by 0x45A44ED: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
==14686==  Address 0x564A28C is 0 bytes after a block of size 140 alloc'd
==14686==    at 0x401CD67: operator new[](unsigned) (vg_replace_malloc.c:195)
==14686==    by 0x41C4F58: gnash::adpcm_expand(unsigned char*&, gnash::stream*, int, bool) (tag_loaders.cpp:1774)
==14686==    by 0x41C631D: gnash::SWF::tag_loaders::sound_expand(gnash::stream*, gnash::sound_handler::format_type&, bool, bool, unsigned char*&, unsigned&) (tag_loaders.cpp:1381)
==14686==    by 0x41C686D: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream*, gnash::SWF::tag_type, gnash::movie_definition*) (tag_loaders.cpp:1160)
==14686==    by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)
==14686==    by 0x42949B0: gnash::MovieLoader::execute(gnash::movie_def_impl*) (movie_def_impl.cpp:109)
==14686==    by 0x42A3B02: void boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> >::operator()<void ()(gnash::movie_def_impl), boost::_bi::list0>(boost::_bi::type<void>, void ()(gnash::movie_def_impl)&, boost::_bi::list0&, int) (bind.hpp:229)
==14686==    by 0x42A3B52: boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >::operator()() (bind_template.hpp:20)
==14686==    by 0x42A3B7C: boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void, void ()(gnash::movie_def_impl), boost::_bi::list1<boost::_bi::value<gnash::movie_def_impl*> > >, void>::invoke(boost::detail::function::any_pointer) (function_template.hpp:136)
==14686==    by 0x4AE383C: (within /usr/lib/libboost_thread-gcc-mt-1_33_1.so.1.33.1)
==14686==    by 0x4AED340: start_thread (in /lib/tls/i686/cmov/libpthread-2.3.6.so)
==14686==    by 0x45A44ED: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
==14686==
==14686== Invalid free() / delete / delete[]
==14686==    at 0x401D70A: operator delete[](void*) (vg_replace_malloc.c:256)
==14686==    by 0x41C6918: gnash::SWF::tag_loaders::define_sound_loader(gnash::stream*, gnash::SWF::tag_type, gnash::movie_definition*) (tag_loaders.cpp:1176)
==14686==    by 0x42946EC: gnash::movie_def_impl::read_all_swf() (movie_def_impl.cpp:889)

Sandro Santilli <strk>
Group Member
Thu 24 May 2007 01:08:16 PM UTC, original submission:  

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1229300816 (LWP 21546)]
0xb79d2334 in free () from /lib/tls/i686/cmov/libc.so.6
(gdb) bt
#0  0xb79d2334 in free () from /lib/tls/i686/cmov/libc.so.6
#1  0xb7b518b1 in operator delete () from /usr/lib/libstdc++.so.6
#2  0xb7b518fd in operator delete[] () from /usr/lib/libstdc++.so.6
#3  0xb7dcd912 in gnash::SWF::tag_loaders::define_sound_loader (in=0x822cc18, tag=gnash::SWF::DEFINESOUND, m=0x822d5f8) at swf/tag_loaders.cpp:1176
#4  0xb7e9b6e5 in gnash::movie_def_impl::read_all_swf (this=0x822d5f8) at movie_def_impl.cpp:889
#5  0xb7e9b9a9 in gnash::MovieLoader::execute (md=0x822d5f8) at movie_def_impl.cpp:109


It's not clear to me where is 'data' allocated. Anyway it is not initialized to NULL. I'm trying simply initializing it to see if the bug is fixed.

Sandro Santilli <strk>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #12885:  3dtris.swf added by martinwguy (19KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by tgc (Posted a comment)
  • -email is unavailable- added by strk (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-05-29 martinwguy Attached File- Added 3dtris.swf, #12885
    2007-05-25 strk Open/ClosedOpen Closed
    2007-05-25 bjacques StatusReady For Test Fixed
        Assigned tomartinwguy bjacques
    2007-05-25 bjacques StatusNone Ready For Test
    2007-05-25 tgc Assigned toNone martinwguy
    2007-05-24 strk Assigned tostrk None
        Carbon-Copy- Added martinwguy
        Carbon-Copy- Added tgc

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code