bugGnash - The GNU Flash player - Bugs: bug #21482, segfault playing simple movie

 
 

bug #21482: segfault playing simple movie

Submitted by:  Sandro Santilli <strk>
Submitted on:  Tue 30 Oct 2007 07:32:06 PM UTC  
 
Category: ActionScriptSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 31 Oct 2007 08:28:47 AM UTC, comment #2:

Found the probnlem.
ActionNewAdd takes a reference of a stack value,
then calls to_primitive which trigger a function call thus
pushing some more values on the stack.
Pushing value on the stack makes the stack element reference
invalid !! (stack is likely reallocated).

It's fixed by not using the reference again after any possibly pushing-on-stack call.

Chad's "safe stack" would likely fix all the others we're not noticing... time to start an integration plan ?

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 31 Oct 2007 08:06:40 AM UTC, comment #1:

a debugging build reports:

lt-gprocessor: /usr/include/boost/variant/detail/visitation_impl.hpp:203: typename Visitor::result_type boost::detail::variant::visitation_impl(int, int, Visitor&, VPCV, mpl_::true_, NBF, W, S) [with W = mpl_::int_<20>, S = boost::detail::variant::visitation_impl_step<boost::mpl::l_iter<boost::mpl::l_end>, boost::mpl::l_iter<boost::mpl::l_end> >, Visitor = boost::detail::variant::copy_into, VPCV = const void*, NBF = boost::variant<boost::blank, double, bool, boost::intrusive_ptr<gnash::as_object>, gnash::as_value::SpriteProxy, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_, boost::detail::variant::void_>::has_fallback_type_]: Assertion `false' failed.
Aborted (core dumped)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 30 Oct 2007 07:32:06 PM UTC, original submission:

The movie has been compiled from the attached testSWFDEC.as
and is attached as out.swf

VL report:

==30847== Invalid write of size 4
==30847== at 0x43A3033: std::string::assign(std::string const&) (in /usr/lib/libstdc++.so.6.0.8)
==30847== by 0x40C8E00: gnash::as_value::operator=(gnash::as_value const&) (basic_string.h:486)
==30847== by 0x4222995: gnash::SWF::SWFHandlers::ActionNewAdd(gnash::ActionExec&) (ASHandlers.cpp:2839)
==30847== by 0x420DD01: gnash::SWF::ActionHandler::execute(gnash::ActionExec&) const (ASHandlers.cpp:174)
==30847== by 0x4210CC5: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:453)
==30847== by 0x4244C40: gnash::ActionExec::operator()() (ActionExec.cpp:344)
==30847== by 0x40F3E5D: gnash::GlobalCode::execute() (ExecutableCode.h:77)
==30847== by 0x40EEEE9: gnash::movie_root::processActionQueue() (movie_root.cpp:1148)
==30847== by 0x40F1012: gnash::movie_root::setRootMovie(gnash::movie_instance*) (movie_root.cpp:152)
==30847== by 0x804A886: main (processor.cpp:352)
==30847== Address 0x53C8E70 is 24 bytes inside a block of size 64 free'd
==30847== at 0x40213B6: operator delete(void*) (vg_replace_malloc.c:244)
==30847== by 0x40AF320: std::vector<gnash::as_value, std::allocator<gnash::as_value> >::_M_insert_aux(__gnu_cxx::__normal_iterator<gnash::as_value*, std::ve
ctor<gnash::as_value, std::allocator<gnash::as_value> > >, gnash::as_value const&) (new_allocator.h:94)
==30847== by 0x4219237: gnash::SWF::SWFHandlers::ActionPushData(gnash::ActionExec&) (stl_vector.h:610)
==30847== by 0x420DD01: gnash::SWF::ActionHandler::execute(gnash::ActionExec&) const (ASHandlers.cpp:174)
==30847== by 0x4210CC5: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:453)
==30847== by 0x4244C40: gnash::ActionExec::operator()() (ActionExec.cpp:344)
==30847== by 0x41178A0: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:337)
==30847== by 0x4248806: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int) (action.cpp:155)
==30847== by 0x4248CDA: gnash::call_method0(gnash::as_value const&, gnash::as_environment, gnash::as_object) (action.cpp:184)
==30847== by 0x40C8802: gnash::as_value::to_primitive(gnash::as_environment&, gnash::as_value::type) const (as_value.cpp:253)
==30847== by 0x40C895D: gnash::as_value::to_primitive(gnash::as_environment&) const (as_value.cpp:231)
==30847== by 0x42228FA: gnash::SWF::SWFHandlers::ActionNewAdd(gnash::ActionExec&) (ASHandlers.cpp:2816)

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14260:  out.swf added by strk (221B - application/x-shockwave-flash)
file #14261:  testSWFDEC.as added by strk (409B - application/x-applix-spreadsheet)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 31 Oct 2007 08:28:48 AM UTCstrkCarbon-Copy-=>Added cmusick
    Wed 31 Oct 2007 08:28:47 AM UTCstrkStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Tue 30 Oct 2007 07:32:06 PM UTCstrkAttached File-=>Added out.swf, #14260
      Attached File-=>Added testSWFDEC.as, #14261

    Back to the top


    Powered by Savane 3.1-cleanup1