bugGnash - The GNU Flash player - Bugs: bug #21902, Quote "?" in gtk-gnash...

 
 

bug #21902: Quote "?" in gtk-gnash parameter list when starting from plugin

Submitted by:  Ken Whedbee <bigwheel>
Submitted on:  Fri 28 Dec 2007 07:51:02 PM UTC  
 
Category: pluginSeverity: 6 - Security
Release: NoneStatus: Invalid
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 06 Jan 2008 05:28:06 PM UTC, comment #4:

Go ahead and close the bug report. I wrote a small test program with execv, calling /usr/local/bin/gtk-gnash with parameters, and it worked correctly. (BTW, I checked and /usr/local/bin/gtk-gnash was in fact a binary executable. I even added some debug lines to plugin/plugin.cpp, and they showed up, so I know I am running the right code.)

I am going to rebuild my version of firefox, and update some of its dependent packages like nspr (netscape portable runtime), and see if that fixes my problem.

Thanks for your help!

Ken Whedbee <bigwheel>
Sat 05 Jan 2008 09:45:58 AM UTC, comment #3:

The thing is that the firefox plugin should not use 'csh' to execute the process, but 'execv'.
Also, can you check the file type of /usr/local/bin/gtk-gnash ?
Could it be it's a libtool shell script ? That would happen if you manually copied files from buil dir to install dir.

Sandro Santilli <strk>
Project Member
Sun 30 Dec 2007 05:57:26 PM UTC, comment #2:

Well, in the bug description I have the gtk-gnash string as reported in the
verbose logging to stdout. See "Starting process: /usr/local/bin/gtk-gnash ..."
Following this line in the logging to stdout is the error "Invalid argument: Invalid argument".

If I cut-and-paste the gtk-gnash string to another terminal window (running csh), I
get the same error. If I escape the "?" in the string with "\", the gtk-gnash line will
execute properly from a csh prompt.

Ken Whedbee <bigwheel>
Sun 30 Dec 2007 09:56:51 AM UTC, comment #1:

This is scary, shell characters are no problem on Linux...
is it a difference in execv(2) ?

If that character has a meaning it's likely not enough just to
quote that alone, sounds like you can execute arbitrary code
on your host by pointing your browser to a webpage, can you ?

Sandro Santilli <strk>
Project Member
Fri 28 Dec 2007 07:51:02 PM UTC, original submission:

The gnash plugin to firefox will startup gtk-gnash as a sub-process and pass parameters to it. Any "?" embedded in the string should be quoted with a "\", or otherwise you will get the error "Invalid argument: Invalid argument"

FreeBSD 6.2
Firefox 2.0.r2,1
Gnash 0.8.1

Starting process: /usr/local/bin/gtk-gnash -v -x 12603875 -j 160 -k 600 -u http://m1.2mdn.net/1162702/160x600-orange.swf?clickTag=http%3A//ad.doubleclick.net/click%253Bh%3Dv8/3636/3/0/%252a/r%253B166233069%253B0-0%253B0%253B23088736%253B2321-160/600%253B23992388/24010241/1%253B%253B%257Esscs%253D%253fhttp%3A//www.bose.com/controller%3Fevent%3DDTC_LINKS_TARGET_EVENT%26DTCLinkID%3D7479%26fulsourceid%3DFI381648%26src%3DFI381648 -U http://ad.doubleclick.net/adi/N950.Earthlink/B2481293.4;sz=160x600;ord=2837069? -P allowscriptaccess=never -P bgcolor=# -P height=600 -P quality=high -P src=http://m1.2mdn.net/1162702/160x600-orange.swf?clickTag=http%3A//ad.doubleclick.net/click%253Bh%3Dv8/3636/3/0/%252a/r%253B166233069%253B0-0%253B0%253B23088736%253B2321-160/600%253B23992388/24010241/1%253B%253B%257Esscs%253D%253fhttp%3A//www.bose.com/controller%3Fevent%3DDTC_LINKS_TARGET_EVENT%26DTCLinkID%3D7479%26fulsourceid%3DFI381648%26src%3DFI381648 -P swliveconnect=0 -P type=application/x-shockwave-flash -P width=160 -P wmode=opaque -

Ken Whedbee <bigwheel>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bigwheel (Submitted the item)
  • -unavailable- added by bigwheel
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 08 Jan 2008 05:12:40 PM UTCstrkStatusNone=>Invalid
      Open/ClosedOpen=>Closed
    Sun 30 Dec 2007 09:56:51 AM UTCstrkSeverity3 - Normal=>6 - Security
    Fri 28 Dec 2007 07:51:02 PM UTCbigwheelCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1