bugGnash - The GNU Flash player - Bugs: bug #21583, double free or corruption playing...

 
 

bug #21583: double free or corruption playing swf6/sugarbowl_1.swf

Submitted by:  Sandro Santilli <strk>
Submitted on:  Wed 14 Nov 2007 09:42:48 PM UTC  
 
Category: coreSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 03 Dec 2007 04:18:52 PM UTC, comment #3:

FYI: was not directly related to threading. was a wild pointer so anything might have changed results ;)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 03 Dec 2007 12:06:33 PM UTC, comment #2:

I confirm it doesn't segfault with loader thread disabled.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 21 Nov 2007 01:54:38 AM UTC, comment #1:

Disabling the loading thread would eliminate this corruption, and possibly future problems(I dislike the loading thread:)).

Zou Lunkai <zoulunkai>
Wed 14 Nov 2007 09:42:48 PM UTC, original submission:

I can reproduce also with -r1.
Playing with valgrind doesn't reproduce the segfault, but keeps warning about PropertyList conditionally jumping on uninitialized memory...

      • glibc detected *** /home/strk/src/gnash/gnash-head-backup/gui/.libs/lt-gtk-gnash: double free or corruption (out): 0x082d8340 ***

======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb73d6d65]
/lib/tls/i686/cmov/libc.so.6(cfree+0x90)[0xb73da800]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0xb759fd81]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash12DynamicShape5clearEv+0x3f)[0xb7d1006f]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so[0xb7d323e3]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash16builtin_functionclERKNS_7fn_callE+0x1a)[0xb7cf85fa]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash11call_methodERKNS_8as_valueEPNS_14as_environmentEPNS_9as_objectEii+0x97)[0xb7e7c057]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash3SWF11SWFHandlers16ActionCallMethodERNS_10ActionExecE+0x27f)[0xb7e4a3af]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZNK5gnash3SWF13ActionHandler7executeERNS_10ActionExecE+0x12)[0xb7e40952]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZNK5gnash3SWF11SWFHandlers7executeENS0_11action_typeERNS_10ActionExecE+0x36)[0xb7e4f6c6]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash10ActionExecclEv+0x3f1)[0xb7e78481]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash10GlobalCode7executeEv+0x6e)[0xb7d2989e]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash10movie_root18processActionQueueEi+0x34)[0xb7d24784]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash10movie_root18processActionQueueEv+0x4f)[0xb7d2481f]
/home/strk/src/gnash/gnash-head-backup/server/.libs/libgnashserver-cvs.so(_ZN5gnash10movie_root7advanceEf+0x51)[0xb7d25231]
/home/strk/src/gnash/gnash-head-backup/gui/.libs/lt-gtk-gnash(_ZN5gnash3Gui12advanceMovieEv+0x43)[0x807b9a3]
/home/strk/src/gnash/gnash-head-backup/gui/.libs/lt-gtk-gnash(ZN5gnash3Gui13advance_movieEPS0+0x11)[0x8086141]
/usr/lib/libglib-2.0.so.0[0xb76fb8d6]
/usr/lib/libglib-2.0.so.0(g_main_context_dispatch+0x17c)[0xb76fb11c]

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14400:  sugarbowl_1.swf added by strk (31KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by zoulunkai (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  • -unavailable- added by strk
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 03 Dec 2007 04:18:06 PM UTCstrkStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Mon 03 Dec 2007 10:20:06 AM UTCstrkStatusConfirmed=>In Progress
      Assigned toNone=>strk
    Wed 21 Nov 2007 01:55:50 AM UTCzoulunkaiCategoryNone=>core
      StatusNone=>Confirmed
    Wed 14 Nov 2007 09:42:48 PM UTCstrkAttached File-=>Added sugarbowl_1.swf, #14400
      Carbon-Copy-=>Added cmusick

    Back to the top


    Powered by Savane 3.1-cleanup1