bugGnash - The GNU Flash player - Bugs: bug #20657, YouTube: segfault (GC-related)

 
 

bug #20657: YouTube: segfault (GC-related)

Submitted by:  Sandro Santilli <strk>
Submitted on:  Thu 02 Aug 2007 02:54:24 AM UTC  
 
Category: coreSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 03 Aug 2007 04:08:46 AM UTC, comment #3:

Valgrind report:

==13384== Invalid read of size 4
==13384== at 0x841ACD6: gnash::GetterSetter::setValue(gnash::as_object*, gnash::as_value const&) const (GetterSetter.cpp:54)
==13384== by 0x82E0777: gnash::as_object::set_member_default(std::string const&, gnash::as_value const&) (as_object.cpp:214)
==13384== by 0x82A2B39: gnash::ActionExec::setObjectMember(gnash::as_object&, std::string const&, gnash::as_value const&) (ActionExec.cpp:471)
==13384== by 0x8286E93: gnash::SWF::SWFHandlers::ActionSetMember(gnash::ActionExec&) (intrusive_ptr.hpp:114)
==13384== by 0x82A4819: gnash::ActionExec::operator()() (ActionExec.cpp:218)
==13384== by 0x831FEB1: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:326)
==13384== by 0x82B2056: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int) (action.cpp:230)
==13384== by 0x8286A9E: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (intrusive_ptr.hpp:109)
==13384== by 0x82A4819: gnash::ActionExec::operator()() (ActionExec.cpp:218)
==13384== by 0x831FEB1: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:326)
==13384== by 0x82B2056: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int) (action.cpp:230)
==13384== by 0x8286A9E: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (intrusive_ptr.hpp:109)
==13384== Address 0x63165F0 is 0 bytes inside a block of size 60 free'd
==13384== at 0x40213B6: operator delete(void*) (vg_replace_malloc.c:244)
==13384== by 0x845C8CB: gnash::GC::cleanUnreachable() (GC.cpp:96)
==13384== by 0x845D4D8: gnash::GC::collect() (GC.cpp:141)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 02 Aug 2007 06:19:41 AM UTC, comment #2:

The missing attachment...

(file #13551)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 02 Aug 2007 04:54:11 AM UTC, comment #1:

Note that player2.swf played locally works fine:
md5sum: 93a0dedd6e0cc8b074d4c5674d638f58

Maybe the player currently online is yet another one ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 02 Aug 2007 02:54:24 AM UTC, original submission:

Attached is an SWF as downloaded from youtube.
segfaults with -r0.

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1223804480 (LWP 3308)]
0x083dec89 in ?? ()
(gdb) bt
#0 0x083dec89 in ?? ()
#1 0x08265e40 in gnash::GetterSetter::setValue (this=0x83dec24, this_ptr=0x83deab8, val=@0x83deab8)
at /home/strk/src/gnash/gnash-head/server/GetterSetter.cpp:54
#2 0x081ad134 in gnash::as_object::set_member_default (this=0x83ddbe8, key=@0x8588b74, val=@0x8588b80)
at /home/strk/src/gnash/gnash-head/server/as_object.cpp:214
#3 0x081950b0 in gnash::ActionExec::setObjectMember (this=0xbfd1a470, obj=@0x83ddbe8, var=@0x8588b74, val=@0x8588b80)
at /home/strk/src/gnash/gnash-head/server/vm/ActionExec.cpp:471
#4 0x081829c4 in gnash::SWF::SWFHandlers::ActionSetMember (thread=@0xbfd1a470) at /usr/include/boost/intrusive_ptr.hpp:114
#5 0x0817d5e2 in gnash::SWF::SWFHandlers::execute (this=0x8311d10, type=138094888, thread=@0x83deab8) at /usr/include/c++/3.4/bits/stl_vector.h:462
#6 0x08196665 in gnash::ActionExec::operator() (this=0xbfd1a470) at /home/strk/src/gnash/gnash-head/server/vm/ActionExec.cpp:218
#7 0x081d076b in gnash::swf_function::operator() (this=0x83c5e88, fn=@0xbfd1a5b0) at /home/strk/src/gnash/gnash-head/server/swf_function.cpp:326
#8 0x0819860b in gnash::call_method (method=@0x83deab8, env=0x83deab8, this_ptr=0x83deab8, nargs=138275512, first_arg_bottom_index=138275512)
at /home/strk/src/gnash/gnash-head/server/vm/action.cpp:230

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #13551:  segfault.swf added by strk (26KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 06 Aug 2007 06:28:51 PM UTCstrkStatusNone=>Fixed
      Assigned toNone=>strk
      Open/ClosedOpen=>Closed
    Fri 03 Aug 2007 04:08:46 AM UTCstrkSummaryYouTube: segfault =>YouTube: segfault (GC-related)
      Carbon-Copy-=>Added zoulunkai
    Thu 02 Aug 2007 06:19:41 AM UTCstrkAttached File-=>Added segfault.swf, #13551

    Back to the top


    Powered by Savane 3.1-cleanup1