bugGnash - The GNU Flash player - Bugs: bug #21848, Segfault on writing shared object

 
 

bug #21848: Segfault on writing shared object

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Wed 19 Dec 2007 06:45:07 AM UTC  
 
Category: coreSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Rob Savoye <rsavoye>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 27 Dec 2007 07:58:33 AM UTC, comment #7:

I can confirm the fix.

Benjamin Wolsey <bwy>
Project Member
Thu 20 Dec 2007 10:50:34 AM UTC, comment #6:

The default should be a fixed dir, something under ~/.gnash/
most likely. Also, the core lib should check for '.' and '/'
characters in the user-provided shared object name.

Sandro Santilli <strk>
Project Member
Thu 20 Dec 2007 05:46:58 AM UTC, comment #5:

I also added support for an .gnashrc file option, SOLSafeDir, to set a directory for writing and reading .sol files. The default is the current directory only.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Wed 19 Dec 2007 07:43:12 PM UTC, comment #4:

I managed to grab the swf, and turned it into a simplified test cases. It appeared the problem was encoding "undefined" values for strings and numbers into AMF. This is now handled correctly in HEAD. Now I'll work on the security aspects of SOL files, but that's a task, and not a bug yet.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Wed 19 Dec 2007 03:25:54 PM UTC, comment #3:

Do you have a link to the original URL so I can reproduce this ? For me, just the swf file does nothing at all.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Wed 19 Dec 2007 03:23:40 PM UTC, comment #2:

The existing plan is to use both .gnashrc settings, and to use those to enforce a sandbox for now, something like ~/.gnash/sandbox.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Wed 19 Dec 2007 06:57:39 AM UTC, comment #1:

By the way, would it be worth having a '.gnash' directory to keep SOL files and the gnashrc file together, in the same way that other applications have them?

Having .sol files scattered all over the place isn't ideal (although it might make people realize how much tracking information gets stored).

Benjamin Wolsey <bwy>
Project Member
Wed 19 Dec 2007 06:45:07 AM UTC, original submission:

The attached movie (doesn't work very well either) causes a segfault when it tries to write a shared object file (click 'Save'). Backtrace:

#0 amf::swapBytes (word=0x0, size=8) at amf.cpp:155
#1 0x00002b463ac6376b in amf::AMF::encodeVariable (
this=<value optimized out>, el=0x975d60) at amf.cpp:932
#2 0x00002b463ac684f9 in amf::SOL::writeFile (this=0x2b46357f9b00,
filespec=<value optimized out>, name=@0x7fff75bbd0c0) at sol.cpp:218
#3 0x00002b463ac68b64 in amf::SOL::writeFile (this=0x2b46357f9b00,
filespec=@0x975038, name=0x2b46355897b2 "settings") at sol.cpp:189
#4 0x00002b463549c62d in gnash::sharedobject_flush (fn=<value optimized out>)
at SharedObject.cpp:159

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14660:  shared_object.swf added by bwy (3KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rsavoye (Posted a comment)
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 27 Dec 2007 07:58:33 AM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 19 Dec 2007 07:43:12 PM UTCrsavoyeStatusNone=>Ready For Test
    Wed 19 Dec 2007 08:50:44 AM UTCstrkCategoryNone=>core
      Severity3 - Normal=>6 - Security
      Assigned toNone=>rsavoye
    Wed 19 Dec 2007 06:45:07 AM UTCbwyAttached File-=>Added shared_object.swf, #14660

    Back to the top


    Powered by Savane 3.1-cleanup1