bugGnash - The GNU Flash player - Bugs: bug #20694, segfault playing copter.swf (OGL)

 
 

bug #20694: segfault playing copter.swf (OGL)

Submitted by:  Sandro Santilli <strk>
Submitted on:  Sun 05 Aug 2007 05:05:00 PM UTC  
 
Category: render-openglSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 05 Aug 2007 05:11:28 PM UTC, comment #1:

Valgrind report seems interesting:

==2831== Invalid read of size 4
==2831== at 0x81086C8: gnash::character_def::~character_def() (character_def.cpp:43)
==2831== by 0x8118374: gnash::shape_character_def::~shape_character_def() (new_allocator.h:69)
==2831== by 0x80E5AD8: gnash::DynamicShape::~DynamicShape() (DynamicShape.h:39)
==2831== by 0x80DBF69: gnash::sprite_instance::~sprite_instance() (ref_counted.h:88)
==2831== by 0x82400BC: gnash::GC::cleanUnreachable() (GC.cpp:96)
==2831== by 0x8240282: gnash::GC::collect() (GC.cpp:141)
==2831== by 0x80C5BFC: gnash::movie_root::advance(float) (movie_root.cpp:675)
==2831== by 0x80AB16B: gnash::Gui::advance_movie(gnash::Gui*) (gui.cpp:487)
==2831== by 0x47BD3C5: (within /usr/lib/libglib-2.0.so.0.1200.11)
==2831== by 0x47BCDF1: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.1200.11)
==2831== by 0x47BFDCE: (within /usr/lib/libglib-2.0.so.0.1200.11)
==2831== by 0x47C0178: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.1200.11)
==2831== Address 0x56B9B58 is 0 bytes inside a block of size 16 free'd
==2831== at 0x40213B6: operator delete(void*) (vg_replace_malloc.c:244)
==2831== by 0x80BD4A2: gnash::tri_cache_manager::~tri_cache_manager() (render_handler_tri.cpp:368)
==2831== by 0x81086CF: gnash::character_def::~character_def() (character_def.cpp:43)
==2831== by 0x8118374: gnash::shape_character_def::~shape_character_def() (new_allocator.h:69)
==2831== by 0x80E5AD8: gnash::DynamicShape::~DynamicShape() (DynamicShape.h:39)
==2831== by 0x80DBF69: gnash::sprite_instance::~sprite_instance() (ref_counted.h:88)
==2831== by 0x82400BC: gnash::GC::cleanUnreachable() (GC.cpp:96)
==2831== by 0x8240282: gnash::GC::collect() (GC.cpp:141)
==2831== by 0x80C5BFC: gnash::movie_root::advance(float) (movie_root.cpp:675)
==2831== by 0x80AB16B: gnash::Gui::advance_movie(gnash::Gui*) (gui.cpp:487)
==2831== by 0x47BD3C5: (within /usr/lib/libglib-2.0.so.0.1200.11)
==2831== by 0x47BCDF1: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.1200.11)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sun 05 Aug 2007 05:05:00 PM UTC, original submission:

#0 0x00000019 in ?? ()
#1 0x08118375 in ~shape_character_def (this=0x89c8f84) at /usr/include/c++/3.4/ext/new_allocator.h:69
#2 0x080e5ad9 in ~DynamicShape (this=0x89c8f70) at /home/strk/src/gnash/gnash-head/server/DynamicShape.h:39
#3 0x080dbf6a in ~sprite_instance (this=0x89c6080) at /home/strk/src/gnash/gnash-head/libbase/ref_counted.h:88
#4 0x082400bd in gnash::GC::cleanUnreachable (this=0x87569b8) at /home/strk/src/gnash/gnash-head/libbase/GC.cpp:96
#5 0x08240283 in gnash::GC::collect (this=0x87569b8) at /home/strk/src/gnash/gnash-head/libbase/GC.cpp:141
#6 0x080c5bfd in gnash::movie_root::advance (this=0x88959f8, delta_time=9.15854097e-34) at /home/strk/src/gnash/gnash-head/server/movie_root.cpp:675
#7 0x080ab16c in gnash::Gui::advance_movie (gui=0x8754e50) at /home/strk/src/gnash/gnash-head/gui/gui.cpp:487

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 06 Aug 2007 03:30:27 AM UTCstrkStatusNone=>Fixed
      Assigned toNone=>strk
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1