bugGnash - The GNU Flash player - Bugs: bug #21667, double free or corruption with...

 
 

bug #21667: double free or corruption with firefox 2.0.0.10 & cvs gnash (in _ZN16nsPluginInstance9startProcEm?)

Submitted by:  None
Submitted on:  Wed 28 Nov 2007 08:37:18 PM UTC  
 
Category: NoneSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sat 29 Dec 2007 01:39:48 PM UTC, comment #9:

I guess this was fixed.. ( 1 month inactivity )

Sandro Santilli <strk>
Project Member
Fri 30 Nov 2007 11:13:20 PM UTC, comment #8:

Maybe you can try running firefox within valgrind and point it
to a simple swf ?

Sandro Santilli <strk>
Project Member
Fri 30 Nov 2007 02:29:09 PM UTC, comment #7:

Casting nam or param to (void*) produces:

plugin.cpp:588: error: invalid cast from type 'const std::basic_string<char, std::char_traits<char>, std::allocator<char> >' to type 'void*'
plugin.cpp:592: error: invalid cast from type 'std::string' to type 'void*'

looks fine to me.

domen@nd47:~/tmp/gnash/plugin$ gcc -v
Using built-in specs.
Target: i586-tukaani-linux-gnu
Configured with: ../gcc-4.1.2/configure --prefix=/usr --libdir=/usr/lib --infodir=/usr/share/info --mandir=/usr/share/man --libexecdir=/usr/lib --enable-shared --enable-threads=posix --enable-languages=c,c++,objc,obj-c++,fortran,ada,java --enable-__cxa_atexit --disable-checking --with-system-zlib --enable-clocale=gnu --build=i586-tukaani-linux-gnu --host=i586-tukaani-linux-gnu --target=i586-tukaani-linux-gnu --with-arch=i586 --with-tune=i686
Thread model: posix
gcc version 4.1.2

Domen Puncer <domen>
Fri 30 Nov 2007 12:56:27 PM UTC, comment #6:

mm.. we got a similar problem with the kparts plugin, can it be string is not std::string there ? or maybe you're usign a bogus compiler ?

In any case I changed the code the way you suggested for now.

Sandro Santilli <strk>
Project Member
Fri 30 Nov 2007 12:16:55 PM UTC, comment #5:

If I change code from
string param = nam + string("=") + val;
to
string param = nam;
param += string("=");
param += val;
then there's no error, and it starts "gtk-gnash".

The nam and val:

0
nam: flashvars
val is very long here, couple of kB
nam: 0x9dfce68; val: 0x9dfce6c
1
2
3
4
5
nam: height
nam: 0x9e7bd58; val: 0x9e7bd5c
val is 300 or something here
The problem shows when these two 'nam' and 'val' are concatenated (because it has problem freeing the bigger from before?).

Domen Puncer <domen>
Fri 30 Nov 2007 09:22:06 AM UTC, comment #4:

Yes, you're right, seems something inside the loop,
comment out lines till you find the offending one ?

print 'nam' and 'val' values ?

glibc detected *** /usr/lib/firefox-2.0.0.10/firefox-bin: munmap_chunk(): invalid pointer: 0x09c05d88 ***

Sandro Santilli <strk>
Project Member
Fri 30 Nov 2007 08:49:50 AM UTC, comment #3:

More prints where? I don't know much about C++ map or iterators.

Output suggests the problem is in the second iteration of the loop, otherwise 100 would be printed, so I don't see how increasing the "16" would make a difference.

Domen Puncer <domen>
Fri 30 Nov 2007 08:21:18 AM UTC, comment #2:

add more prints, then try incrementing that number (16).

Sandro Santilli <strk>
Project Member
Thu 29 Nov 2007 07:10:06 PM UTC, comment #1:

More info:
I inserted these prints into plugin/plugin.cpp:
(sleep just to confirm it's not some timing issue)
578 paramvalues.reserve(_params.size());
579 int errc = 0;
580 sleep(2);
581 for ( map<string,string>::const_iterator it=_params.begin(),
582 itEnd=_params.end();
583 it != itEnd; ++it)
584 {
585 cerr << errc++ << endl;
586 const string& nam=it->first;
587 const string& val=it->second;
588
589 string param = nam + string("=") + val;
590 paramvalues.push_back(param);
591 cerr << errc++ << endl;
592 }
593 errc = 100;
594
595 // REMEMBER TO INCREMENT THE maxargc COUNT IF YOU
596 // ADD NEW ARGUMENTS
597
598 cerr << errc++ << endl;
599 const size_t maxargc = 16 + paramvalues.size()*2;

and got:
...
Forked sucessfully, child process PID is 2460
0
1
2

      • glibc detected *** /usr/lib/firefox-2.0.0.10/firefox-bin: munmap_chunk(): invalid pointer: 0x09c05d88 ***

======= Backtrace: =========
...

Anonymous
Wed 28 Nov 2007 08:37:18 PM UTC, original submission:

domen@nd47:~/tmp$ firefox
xEmbed supported in this Mozilla version
Gtk2+ supported in this Mozilla version
xEmbed supported in this Mozilla version
Gtk2+ supported in this Mozilla version
NewStream: The full URL is http://www.youtube.com/swf/l.swf?video_id=QJ-VZfyBsLw&eurl=http%3A//finance.google.com/finance&iurl=http%3A//img.youtube.com/vi/QJ-VZfyBsLw/default.jpg&t=OEgsToPDskKxJVNLMK3CQvOlrAHP6kws&rel=1&border=0
Closed 58files.

      • glibc detected *** /usr/lib/firefox-2.0.0.10/firefox-bin: double free or corruption (out): 0x09c00088 ***

======= Backtrace: =========
/lib/libc.so.6[0xb750f33d]
/lib/libc.so.6(cfree+0xaa)[0xb7510584]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0xaff07251]
/usr/lib/libstdc++.so.6(_ZNSs4_Rep10_M_destroyERKSaIcE+0x1d)[0xafee3d5d]
/home/domen/.mozilla/plugins/libgnashplugin.so(_ZN16nsPluginInstance9startProcEm+0x833)[0xb093c7c3]
/home/domen/.mozilla/plugins/libgnashplugin.so(_ZN16nsPluginInstance9NewStreamEPcP9_NPStreamhPt+0x8e)[0xb093cb1e]
/home/domen/.mozilla/plugins/libgnashplugin.so(NPP_NewStream+0x46)[0xb093f516]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x823708b]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x82287dc]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x8227b88]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x817370b]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x8173ae1]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x81738a7]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x812b25c]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x812b20f]
/usr/lib/firefox-2.0.0.10/libxpcom_core.so(_ZN23nsInputStreamReadyEvent12EventHandlerEP7PLEvent+0x30)[0xb7ebaa60]
/usr/lib/firefox-2.0.0.10/libxpcom_core.so(PL_HandleEvent+0x1d)[0xb7ed21bf]
/usr/lib/firefox-2.0.0.10/libxpcom_core.so(PL_ProcessPendingEvents+0x70)[0xb7ed2112]
/usr/lib/firefox-2.0.0.10/libxpcom_core.so[0xb7ed37b4]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x824c920]
/usr/lib/libglib-2.0.so.0[0xb79cf15f]
/usr/lib/libglib-2.0.so.0(g_main_context_dispatch+0x181)[0xb79a5a41]
/usr/lib/libglib-2.0.so.0[0xb79a8ab6]
/usr/lib/libglib-2.0.so.0(g_main_loop_run+0x1b7)[0xb79a8e77]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main+0xa6)[0xb7c24ec2]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x824cbc4]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x86ab91c]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x807d279]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x80794a3]
/lib/libc.so.6(__libc_start_main+0x135)[0xb74d2069]
/usr/lib/firefox-2.0.0.10/firefox-bin[0x8079401]
======= Memory map: ========
08048000-08a2c000 r-xp 00000000 03:01 1450288 /usr/lib/firefox-2.0.0.10/firefox-bin
08a2c000-08a45000 rw-p 009e4000 03:01 1450288 /usr/lib/firefox-2.0.0.10/firefox-bin
08a45000-09d7c000 rw-p 08a45000 00:00 0 [heap]
afe58000-aff31000 r-xp 00000000 03:01 555509 /usr/lib/libstdc++.so.6.0.8
aff31000-aff34000 r--p 000d8000 03:01 555509 /usr/lib/libstdc++.so.6.0.8
aff34000-aff36000 rw-p 000db000 03:01 555509 /usr/lib/libstdc++.so.6.0.8
aff36000-aff3c000 rw-p aff36000 00:00 0
aff3c000-aff3d000 ---p aff3c000 00:00 0
aff3d000-b073c000 rwxp aff3d000 00:00 0
b073c000-b082f000 rw-p b073c000 00:00 0
b08a1000-b08e7000 r--p 00000000 03:01 1791715 /usr/share/fonts/truetype/arialbd.ttf
b08e7000-b092b000 r--p 00000000 03:01 1791700 /usr/share/fonts/truetype/arial.ttf
b092b000-b092e000 r-xp 00000000 03:01 2120936 /lib/libnss_dns-2.5.so
b092e000-b0930000 rw-p 00002000 03:01 2120936 /lib/libnss_dns-2.5.so
b0939000-b0942000 r-xp 00000000 fe:03 1636087 /home/domen/.mozilla/plugins/libgnashplugin.so
b0942000-b0943000 rw-p 00008000 fe:03 1636087 /home/domen/.mozilla/plugins/libgnashplugin.so
b0943000-b0950000 r--p 00000000 03:01 1791689 /usr/share/fonts/truetype/VeraMono.ttf
b0950000-b0961000 r--p 00000000 03:01 1791688 /usr/share/fonts/truetype/Vera.ttf
b0961000-b0970000 r--p 00000000 03:01 1791691 /usr/share/fonts/truetype/VeraBd.ttf
b0970000-b0971000 ---p b0970000 00:00 0
b0971000-b1170000 rwxp b0971000 00:00 0
b1170000-b1171000 ---p b1170000 00:00 0
b1171000-b1970000 rwxp b1171000 00:00 0
b1970000-b1971000 ---p b1970000 00:00 0
b1971000-b2170000 rwxp b1971000 00:00 0
b2170000-b2181000 r--p 00000000 03:01 1791688 /usr/share/fonts/truetype/Vera.ttf
b2181000-b21b8000 r-xp 00000000 03:01 1450299 /usr/lib/firefox-2.0.0.10/libfreebl3.so
b21b8000-b21b9000 rw-p 00037000 03:01 1450299 /usr/lib/firefox-2.0.0.10/libfreebl3.so
b21b9000-b21ba000 ---p b21b9000 00:00 0
b21ba000-b29b9000 rwxp b21ba000 00:00 0
b29b9000-b29ba000 ---p b29b9000 00:00 0
b29ba000-b31b9000 rwxp b29ba000 00:00 0
b31b9000-b3219000 rw-s 00000000 00:08 31981672 /SYSV00000000 (deleted)
b3219000-b351e000 r-xp 0Forked sucessfully, child process PID is 8640

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by domen (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by domen (add the poster to CC)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 29 Dec 2007 01:39:48 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 30 Nov 2007 12:56:27 PM UTCstrkSeverity3 - Normal=>5 - Blocker
      StatusNone=>Ready For Test
    Thu 29 Nov 2007 07:22:01 PM UTCdomenCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1