bugGnash - The GNU Flash player - Bugs: bug #20725, parsing stops on malformed(?) SWF

 
 

bug #20725: parsing stops on malformed(?) SWF

Submitted by:  Tomas Groth <tgc>
Submitted on:  Wed 08 Aug 2007 11:11:47 PM UTC  
 
Category: coreSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 09 Aug 2007 04:18:58 AM UTC, comment #4:

More info:
adpcm_expand, stereo:0, sample_count:15403, nbits:5

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 09 Aug 2007 02:36:22 AM UTC, comment #3:

This is the call:

// 4 is the fixed header for each sample
// ( 16bit sample id, 6bit stepsize_index )
// nbits is the number of bits for each sample
in->ensureBytes( sample_count * ( 3 + (int)ceil(n_bits/8) ) );

which results in that number:

need to read 46209 bytes, but only 9635 left

Ideas on what's wrong ? (I'm sure something is wrong)

Also, does it seem correct to have a single ADPCM sound while most of it is mp3 ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 09 Aug 2007 02:32:45 AM UTC, comment #2:

Added some more debugging, it's the ADPCM expand function failing:

...
27497] 22:29:37: DEBUG: MP3 format
27497] 22:29:37: DEBUG: ADPCM format
27497] 22:29:37: ERROR: Parsing exception: premature end of tag: need to read 46209 bytes, but only 9635 left in this tag

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 08 Aug 2007 11:41:00 PM UTC, comment #1:

Must be a wrong computation of the number of bytes to expect in input, see if you can find what's wrong with it.

#0 0xb722edb5 in __cxa_throw () from /usr/lib/libstdc++.so.6
#1 0x081e6aa8 in gnash::stream::ensureBytes (this=0x8a09800, needed=46209) at /usr/include/c++/3.4/ext/new_allocator.h:69
#2 0x08317eff in sound_expand (in=0x864a1b8, format=@0xb66ee2ac, sample_16bit=8, stereo=false, sample_count=@0xb66ee2b0, data=@0xb66ee2b4,
data_bytes=@0xb66ee2b8) at /usr/include/c++/3.4/cmath:175
#3 0x08318d8d in gnash::SWF::tag_loaders::define_sound_loader (in=0x864a1b8, tag=gnash::SWF::DEFINESOUND, m=0x864aec8)
at /home/strk/src/gnash/gnash-head/server/swf/tag_loaders.cpp:1096

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 08 Aug 2007 11:11:47 PM UTC, original submission:

When playing http://www.atomfilms.com/afassets/flash/gangsta_rap_se.swf with latest cvs and sound enabled the parser bails out, and doesn't complete, which means that only part of the movie can be played. If sound is disabled the parser continues, and the movie can be played in its full length.

Gnash's output when the error occurs:
10083] 01:11:07: Your X server expects RGB24 pixmap data for standard mode.
10083] 01:11:07: Created top level window
10083] 01:11:07: framebuffer pixel format is RGB24
10083] 01:11:07: Base url set to: file:///home/tomas/gnash/swf/gangsta_rap_se.swf
10083] 01:11:07: Movie file:///home/tomas/gnash/swf/gangsta_rap_se.swf (SWF6) added to library
10083] 01:11:07: GTK-AGG: 510000 bytes offscreen buffer allocated

10083] 01:11:07: initialized AGG buffer <0x2b0c71d96010>, 510000 bytes, 500x333, rowsize is 1500 bytes
10083] 01:11:07: MALFORMED SWF: Bitmap fill specifies '65535' as associated bitmap character id, but that character is not found in the Characters Dictionary. It seems common to find such malformed SWF, so we'll only warn once about this.
10083] 01:11:07: ERROR: Unimplemented: DefineFontInfo2 partially implemented
10083] 01:11:07: MALFORMED SWF: First gradient in a fill_style have position==9 (expected 0). This seems to be common, so will warn only once.
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (4) and end (2) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (2) and end (1) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (3) and end (1) shapes of a morph
10083] 01:11:07: MALFORMED SWF: Different number of paths in start (2) and end (1) shapes of a morph
10083] 01:11:07: ERROR: Parsing exception: premature end of tag
10083] 01:11:07: MALFORMED SWF: 38 action blocks and 0 init action blocks are NOT followed by a SHOWFRAME tag
10083] 01:11:07: MALFORMED SWF: 6365 frames advertised in header, but only 291 SHOWFRAME tags found in stream. Updating total frames count

Tomas Groth <tgc>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by tgc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 09 Aug 2007 04:18:58 AM UTCstrkStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Thu 09 Aug 2007 03:09:28 AM UTCstrkAssigned toNone=>strk

    Back to the top


    Powered by Savane 3.1-cleanup1