bugGnash - The GNU Flash player - Bugs: bug #21206, Segfault running...

 
 

bug #21206: Segfault running Video-EmbedSquareTestRunner

Submitted by:  Sandro Santilli <strk>
Submitted on:  Mon 01 Oct 2007 09:53:17 AM UTC  
 
Category: video-ffmpegSeverity: 6 - Security
Release: NoneStatus: Invalid
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 01 Oct 2007 12:37:40 PM UTC, comment #1:

The problem was with dependency tracking (see mail on gnash-dev)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 01 Oct 2007 09:53:17 AM UTC, original submission:

I belive this was introduced by proper virtual destructors fix.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1228757296 (LWP 21604)]
gnash::VideoDecoderFfmpeg::decodeToImage (this=0x80, input=0x60 <Address 0x60 out of bounds>, inputSize=0) at sdl/VideoDecoderFfmpeg.cpp:319
319 uint8_t* decodedData = decode(input, inputSize, outputSize);
(gdb) bt
#0 gnash::VideoDecoderFfmpeg::decodeToImage (this=0x80, input=0x60 <Address 0x60 out of bounds>, inputSize=0) at sdl/VideoDecoderFfmpeg.cpp:319
#1 0xb7ebfc18 in gnash::video_stream_definition::get_decoder (this=0x80f0890) at video_stream_def.cpp:133
#2 0xb7dc4bda in video_stream_instance (this=0x81605b0, def=0x80f0890, parent=0x8159258, id=1) at video_stream_instance.cpp:168
#3 0xb7ebf915 in gnash::video_stream_definition::create_character_instance (this=0x80f0890, parent=0x8159258, id=1) at video_stream_def.cpp:106
#4 0xb7da3d17 in gnash::sprite_instance::add_display_object (this=0x8159258, character_id=1, name=0x0, event_handlers=@0x81583b0, depth=-16383,
color_transform=@0x8158364, mat=@0x8158384, ratio=-1, clip_depth=-1000000) at sprite_instance.cpp:2730
#5 0xb7dbe662 in gnash::SWF::PlaceObject2Tag::execute (this=0x8158350, m=0x8159258) at swf/PlaceObject2Tag.cpp:365
#6 0xb7db638c in std::for_each<__gnu_cxx::__normal_iterator<gnash::execute_tag* const, std::vector<gnash::execute_tag, std::allocator<gnash::execute_tag> > >, boost::_bi::bind_t<void, boost::_mfi::cmf1<void, gnash::execute_tag, gnash::sprite_instance>, boost::_bi::list2<boost::arg<1>, boost::_bi::value<gnash::sprite_instance*> > > > (__first={_M_current = 0x8109fe8}, __last={_M_current = 0x8109ff0}, __f=
{f_ = {f_ = <error reading variable>}, l_ = {a1_ = {<No data fields>}, a2_ = {t_ = 0x8159258}}}) at /usr/include/boost/bind/mem_fn_template.hpp:195
#7 0xb7da24b0 in gnash::sprite_instance::execute_frame_tags (this=0x8159258, frame=0, typeflags=<value optimized out>) at sprite_instance.cpp:2472
#8 0xb7da8db3 in gnash::sprite_instance::stagePlacementCallback (this=0x8159258) at sprite_instance.cpp:3305
#9 0xb7d955b8 in gnash::movie_instance::stagePlacementCallback (this=0x8159258) at movie_instance.cpp:67
#10 0xb7d98166 in gnash::movie_root::setLevel (this=0x80f0dc8, num=0, movie=@0xbff7774c) at movie_root.cpp:136
#11 0xb7d986f7 in gnash::movie_root::setRootMovie (this=0x80f0dc8, movie=0x8159258) at movie_root.cpp:108
#12 0x08051838 in MovieTester (this=0xbff778f4, url=@0xbff77944) at MovieTester.cpp:111

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 01 Oct 2007 12:37:40 PM UTCstrkStatusNone=>Invalid
      Assigned totgc=>strk
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1