bugGnash - The GNU Flash player - Bugs: bug #20733, Parser regression

 
 

bug #20733: Parser regression

Submitted by:  Tomas Groth <tgc>
Submitted on:  Thu 09 Aug 2007 05:18:08 PM UTC  
 
Category: coreSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 10 Aug 2007 01:53:48 PM UTC, comment #7:

No, let's leave 0.8.1 the way it is

Sandro Santilli <strk>
Project MemberIn charge of this item.
Fri 10 Aug 2007 10:25:16 AM UTC, comment #6:

I committed the SoundInfo-class patch to head. Should it also be committed to 0.8.1?

Tomas Groth <tgc>
Fri 10 Aug 2007 04:00:05 AM UTC, comment #5:

I also committed a patch fixing the 1-byte shortage. feed.swf now plays better then before (but adpcm decoder is still bogus, as the ERROR lines tell)

xiaao also plays fine here.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 09 Aug 2007 11:34:58 PM UTC, comment #4:

I committed a patch that do NOT throw a ParserException but just check if the computation of number of bytes needed matches the actual number of bytes read and prints an ERROR if the whole read gets past the end of tag.

This gives about the same behaviour which was in 0.8.0, which is read arbitrary sample data from subsequent tags, but will let us know so we can fix the parser/decoder of ADPCM more easily.

Note that another call to sound_expand is revealing another bug in the caller (sound_stream_block_loader) in that there's not even a single byte available for the decoder to read !

This seems to have to do with the 4 bytes discarded in that loader, which tgc found was only correct for MP3 format, not for ADPCM.

Thomas is supposedly working on a redesign of the SoundData which should let us know which format the stream has.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 09 Aug 2007 06:47:54 PM UTC, comment #3:

Confirmed for feed.swf too
md5sum : 56104186a2ec8a614e0bfb4aad4e9423
version : SWF4

Now, I verified that in both cases the computation of needed bytes matches the number of bytes actually read, but in both cases these bytes go beyond the end of the tag, as advertised in tag header.

This could mean that either the SWF is malformed or the Gnash parser itself is bogus.

In both cases I guess we want to try at keep going rather then abort the parsing. Note that the stream should get back in sync at stream::close_tag(), which currently doesn't check that end tag position is NOT before the current stream position (but should, IMHO).

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 09 Aug 2007 05:49:19 PM UTC, comment #2:

Confirmed. Still in sound_expand.
md5sum: 002c437c375bb4c55cf0533bab5e3436
version: SWF4

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 09 Aug 2007 05:39:53 PM UTC, comment #1:

The same goes for http://www.kungfo0.org/theweb/fight/xxiao03.swf

Tomas Groth <tgc>
Thu 09 Aug 2007 05:18:08 PM UTC, original submission:

The parsing of http://flash.li.ru/feed.swf stops with an error:

8180] 19:17:18: initialized AGG buffer <0x2ac2652c4010>, 390000 bytes, 400x300, rowsize is 1200 bytes
8180] 19:17:18: MALFORMED SWF: First gradient in a fill_style have position==124 (expected 0). This seems to be common, so will warn only once.
8180] 19:17:18: ERROR: Parsing exception: premature end of tag: need to read 576 bytes, but only 342 left in this tag
8180] 19:17:18: MALFORMED SWF: 30 action blocks and 0 init action blocks are NOT followed by a SHOWFRAME tag
8180] 19:17:18: MALFORMED SWF: 1230 frames advertised in header, but only 43 SHOWFRAME tags found in stream. Updating total frames count

Tomas Groth <tgc>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by tgc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 10 Aug 2007 04:11:10 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 10 Aug 2007 04:00:05 AM UTCstrkStatusIn Progress=>Ready For Test
    Thu 09 Aug 2007 11:34:58 PM UTCstrkStatusConfirmed=>In Progress
    Thu 09 Aug 2007 05:49:19 PM UTCstrkStatusNone=>Confirmed
      Assigned toNone=>strk

    Back to the top


    Powered by Savane 3.1-cleanup1