bugGnash - The GNU Flash player - Bugs: bug #20077, Segfault in propertylist

 
 

bug #20077: Segfault in propertylist

Submitted by:  Tomas Groth <tgc>
Submitted on:  Mon 04 Jun 2007 11:57:43 PM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Tomas Groth <tgc>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 08 Jun 2007 06:13:17 PM UTC, comment #4:

A fix has been committed to head and the 0.8.0 branch.

Tomas Groth <tgc>In charge of this item.
Fri 08 Jun 2007 03:50:31 PM UTC, comment #3:

Stacktrace on OpenBSD from visiting audi.dk:

#0 0x0c72157c in gnash::embedVideoDecoderFfmpeg::decodeFrame(unsigned char*, int) (this=0x8b28c700, data=0x84bc2300 "xF\023(\023(?\212��", size=58)
at embedVideoDecoderFfmpeg.cpp:219
219 decodedFrame->m_data[byte + (linecc->width3)] = (unsigned char) (frame->data[0]+(lineframe->linesize[0])+byte);
(gdb) bt
#0 0x0c72157c in gnash::embedVideoDecoderFfmpeg::decodeFrame(unsigned char*, int) (this=0x8b28c700, data=0x84bc2300 "xF\023(\023(?\212��", size=58)
at embedVideoDecoderFfmpeg.cpp:219
#1 0x06cce4b5 in gnash::video_stream_instance::display() (this=0x7ecb7100)
at video_stream_instance.cpp:104
#2 0x06ceaae8 in gnash::DisplayList::display() (this=0x7ea310b0)
at dlist.cpp:810
#3 0x06cb57e8 in gnash::sprite_instance::display() (this=0x7ea31000)
at sprite_instance.cpp:3006
#4 0x06c9de09 in gnash::movie_root::display() (this=0x7dca9a00)
at movie_root.cpp:646
#5 0x0a8234fc in gnash::Gui::display(gnash::movie_root*) (this=0x7e539380,
m=0x7dca9a00) at gui.cpp:402
#6 0x0a8235dc in gnash::Gui::advance_movie(gnash::Gui*) (gui=0x7e539380)
at gui.cpp:482
#7 0x04013947 in g_main_context_is_owner ()
from /usr/local/lib/libglib-2.0.so.1200.11
#8 0x040113a3 in g_source_is_destroyed ()
from /usr/local/lib/libglib-2.0.so.1200.11
#9 0x0401238d in g_main_context_dispatch ()
from /usr/local/lib/libglib-2.0.so.1200.11
#10 0x040126b2 in g_main_context_dispatch ()
from /usr/local/lib/libglib-2.0.so.1200.11

This looks like the code to copy frames just before rendering.

Bastiaan Jacques <bjacques>
Project Member
Wed 06 Jun 2007 03:45:58 PM UTC, comment #2:

The deadlock with Gst should now be fixed, but width ffmpeg gnash still segfaults.

Tomas Groth <tgc>In charge of this item.
Tue 05 Jun 2007 12:09:38 AM UTC, comment #1:

With GST the SWF makes gnash deadlock in embedVideoGst, but no segfault.

Tomas Groth <tgc>In charge of this item.
Mon 04 Jun 2007 11:57:43 PM UTC, original submission:

When running the following SWF gnash segfaults what after about ten seconds: "http://audi.dk/global/general/audi_dk/campaign/4CBDAA44-AF66-4BA8-A4C7-9144347841DB.swf?xmldata=%2Fglobal%2Fgeneral%2Faudi%5Fdk%2Fcampaign%2Fa5%2Fteaser%2Exml&amp;09%2D03%2D2007+10%3A31%3A40"

The movie can also be seen by entering audi.dk

It contains embedded video, so that might be part of the problem, I used ffmpeg/opengl to get it.

Backtrace:
#0 0x00002ae6836c3991 in std::string::compare () from /usr/lib/libstdc++.so.6
#1 0x0000000000405178 in std::operator< <char, std::char_traits<char>, std::allocator<char> > (__lhs=@0x2aaaac0e5f80, __rhs=@0x7fff27d62660)
at /usr/lib/gcc/x86_64-unknown-linux-gnu/4.1.2/../../../../include/c++/4.1.2/bits/basic_string.h:2213
#2 0x00000000004051c2 in std::less<std::string>::operator() (
this=0x2aaaac0530a0, __x=@0x2aaaac0e5f80, __y=@0x7fff27d62660)
at /usr/lib/gcc/x86_64-unknown-linux-gnu/4.1.2/../../../../include/c++/4.1.2/bits/stl_function.h:227
#3 0x00002ae682fed662 in std::_Rb_tree<std::string, std::pair<std::string const, gnash::Property>, std::_Select1st<std::pair<std::string const, gnash::Property> >, std::less<std::string>, std::allocator<std::pair<std::string const, gnash::Property*> > >::find (this=0x2aaaac0530a0, __k=@0x7fff27d62660)
at /usr/lib/gcc/x86_64-unknown-linux-gnu/4.1.2/../../../../include/c++/4.1.2/bits/stl_tree.h:1317
#4 0x00002ae682fed73a in std::map<std::string, gnash::Property, std::less<std::string>, std::allocator<std::pair<std::string const, gnash::Property> > >::find (this=0x2aaaac0530a0, __x=@0x7fff27d62660)
at /usr/lib/gcc/x86_64-unknown-linux-gnu/4.1.2/../../../../include/c++/4.1.2/bits/stl_map.h:534
#5 0x00002ae682fed77c in gnash::PropertyList::find (this=0x2aaaac0530a0,
key=@0x7fff27d62660) at /home/tomas/gnash/gnash/server/PropertyList.h:78
#6 0x00002ae682feb060 in gnash::PropertyList::getProperty (
---Type <return> to continue, or q <return> to quit---
this=0x2aaaac0530a0, key=@0x7fff27d62660)
at /home/tomas/gnash/gnash/server/PropertyList.cpp:135
#7 0x00002ae683001239 in gnash::as_object::findProperty (this=0x2aaaac053090,
key=@0x7fff27d62660) at /home/tomas/gnash/gnash/server/as_object.cpp:140
#8 0x00002ae68300244f in gnash::as_object::get_member_default (
this=0x2aaaac053090, name=@0x7fff27d62660, val=0x7fff27d62630)
at /home/tomas/gnash/gnash/server/as_object.cpp:112
#9 0x00002ae682fffd46 in gnash::as_object::get_member (this=0x2aaaac053090,
name=@0x7fff27d62660, val=0x7fff27d62630)
at /home/tomas/gnash/gnash/server/as_object.h:250
#10 0x00002ae683007f41 in gnash::character::getUserDefinedEventHandler (
this=0x2aaaac053090, name=@0x2ae68336e1f8)
at /home/tomas/gnash/gnash/server/character.cpp:719
#11 0x00002ae6830086df in gnash::character::queueEventHandler (
this=0x2aaaac053090, id=@0x7fff27d62760)
at /home/tomas/gnash/gnash/server/character.cpp:696
#12 0x00002ae683008850 in gnash::character::unload (this=0x2aaaac053090)
at /home/tomas/gnash/gnash/server/character.cpp:670
#13 0x00002ae68309197d in gnash::DisplayList::remove_display_object (
this=0x74f880, depth=-16383)
at /home/tomas/gnash/gnash/server/dlist.cpp:395
#14 0x00002ae68305666b in gnash::sprite_instance::remove_display_object (
this=0x74f740, depth=-16383)
---Type <return> to continue, or q <return> to quit---
at /home/tomas/gnash/gnash/server/sprite_instance.h:479
#15 0x00002ae6830690f2 in gnash::SWF::RemoveObjectTag::execute (this=0x95b840,
m=0x74f740) at /home/tomas/gnash/gnash/server/swf/RemoveObjectTag.cpp:54
#16 0x00002ae683067549 in gnash::SWF::DisplayListTag::execute_state (
this=0x95b840, m=0x74f740)
at /home/tomas/gnash/gnash/server/swf/DisplayListTag.h:71
#17 0x00002ae68304411f in gnash::sprite_instance::execute_frame_tags (
this=0x74f740, frame=293, typeflags=3)
at /home/tomas/gnash/gnash/server/sprite_instance.cpp:2761
#18 0x00002ae6830447b7 in gnash::sprite_instance::advance_sprite (
this=0x74f740, delta_time=1)
at /home/tomas/gnash/gnash/server/sprite_instance.cpp:2369
#19 0x00002ae68302e4db in gnash::movie_instance::advance (this=0x74f740,
delta_time=1) at /home/tomas/gnash/gnash/server/movie_instance.cpp:88
#20 0x00002ae68302fc69 in gnash::movie_root::advance (this=0x75d350,
delta_time=1) at /home/tomas/gnash/gnash/server/movie_root.cpp:597
#21 0x00002ae68825bc1e in gnash::Gui::advance_movie (gui=0x50f6b0)
at /home/tomas/gnash/gnash/gui/gui.cpp:462
#22 0x00002ae687a3dafb in g_timeout_dispatch () from /usr/lib/libglib-2.0.so.0
#23 0x00002ae687a3d5f3 in g_main_context_dispatch ()
from /usr/lib/libglib-2.0.so.0
#24 0x00002ae687a4043d in g_main_context_iterate ()
from /usr/lib/libglib-2.0.so.0
---Type <return> to continue, or q <return> to quit---
#25 0x00002ae687a40726 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#26 0x00002ae686ab3743 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#27 0x00002ae688255a15 in gnash::GtkGui::run (this=0x50f6b0)
at /home/tomas/gnash/gnash/gui/gtk.cpp:324
#28 0x00002ae6835260b8 in gnash::Player::run (this=0x7fff27d62fe0, argc=2,
argv=0x7fff27d63178,
infile=0x7fff27d63725 "http://audi.dk/global/general/audi_dk/campaign/4CBDAA44-AF66-4BA8-A4C7-9144347841DB.swf?xmldata=%2Fglobal%2Fgeneral%2Faudi%5Fdk%2Fcampaign%2Fa5%2Fteaser%2Exml&amp;09%2D03%2D2007+10%3A31%3A40", url=0x0)
at /home/tomas/gnash/gnash/gui/Player.cpp:363
#29 0x00000000004046d5 in main (argc=2, argv=0x7fff27d63178)
at /home/tomas/gnash/gnash/gui/gnash.cpp:374

Tomas Groth <tgc>In charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by tgc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 08 Jun 2007 06:13:17 PM UTCtgcStatusNone=>Fixed
      Assigned toNone=>tgc
      Open/ClosedOpen=>Closed
    Thu 07 Jun 2007 07:37:25 PM UTCstrkSeverity5 - Blocker=>6 - Security

    Back to the top


    Powered by Savane 3.1-cleanup1