bugGnash - The GNU Flash player - Bugs: bug #21674, Zzuf segfault

 
 

bug #21674: Zzuf segfault

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Thu 29 Nov 2007 08:28:55 PM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 30 Nov 2007 11:13:44 AM UTC, comment #1:

Ok, this is a problem with shape_character_def used in DEFINEFONT* tags, for which we don't support a real line style, but just a number which tells us wheter or not to render a glyph (right Udo ?)

When I added consistency checks there Udo suggested me that for paths of a glyph shape the style doesn't need to point to a real line style, but it's semantic is just 0 for "hide" or 1 for "render".

When it comes to compute bounds then we should know wheter or not it's a glyph or a normal shape as that semantic change (I hate that, btw).

For now I just checked size of the "styles" vector.
If it's empty we'll assume that m_line can at most be 1,
revealing the shape is a glyph and thus considering line thickness as zero.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 29 Nov 2007 08:28:55 PM UTC, original submission:

Another zzuf crasher (attached), SWF4/frog.swf zzuf seed 1017.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1082132816 (LWP 9693)]
0x00002b37035751fd in gnash::shape_character_def::compute_bound (this=0x91b690, r=0x91b6f8) at shape_character_def.cpp:1087
1087 if ( p.m_line ) thickness = m_line_styles[p.m_line-1].get_width();
(gdb) bt
#0 0x00002b37035751fd in gnash::shape_character_def::compute_bound (this=0x91b690, r=0x91b6f8) at shape_character_def.cpp:1087
#1 0x00002b3703577c30 in gnash::shape_character_def::read (this=0x91b690, in=0x9081f0, tag_type=10, with_style=false, m=0x907e10)
at shape_character_def.cpp:506
#2 0x00002b37034cb900 in gnash::font::readDefineFont (this=0x917950, in=0x9081f0, m=0x907e10) at font.cpp:248

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14510:  crasher1017.swf added by bwy (384KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 30 Nov 2007 12:20:44 PM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 30 Nov 2007 11:13:44 AM UTCstrkStatusNone=>Ready For Test
      Carbon-Copy-=>Added udog
    Fri 30 Nov 2007 08:26:44 AM UTCstrkAssigned toNone=>strk
    Thu 29 Nov 2007 08:28:55 PM UTCbwyAttached File-=>Added crasher1017.swf, #14510

    Back to the top


    Powered by Savane 3.1-cleanup1