bugGnash - The GNU Flash player - Bugs: bug #21924, Segfault playing...

 
 

bug #21924: Segfault playing actionscript.all/SharedObject-v{6,7,8}.swf

Submitted by:  Sandro Santilli <strk>
Submitted on:  Tue 01 Jan 2008 11:12:32 AM UTC  
 
Category: ActionScriptSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Rob Savoye <rsavoye>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sat 05 Jan 2008 04:44:35 PM UTC, comment #7:

Eh, of course I prefer disable completely (or two users on the same host might end up contending SharedObject files...).
Good the big warning/error/security message.

Sandro Santilli <strk>
Project Member
Sat 05 Jan 2008 04:36:55 PM UTC, comment #6:

I think that would be appropriate. We should document that the path used for SOLSafeDir must exist, and if it doesn't, we print a big warning message, and only use /tmp for .sol files, or disable this completely. I prefer using /tmp.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Sat 05 Jan 2008 04:33:33 PM UTC, comment #5:

Yes, SOLSafe dir path.
Only using an existing one is also fine, but we then should
output a clear message about it, maybe disabling SharedObject as a whole if the SOLSafe dir is not a directory (would automatically implement the disable as a whole feature).

Sandro Santilli <strk>
Project Member
Sat 05 Jan 2008 03:39:46 PM UTC, comment #4:

You mean for dirs in the SOLSafe Dir path ? All directories do get created, but only the ones specified in SharedObject::getLocal(). This coould be extended to cover the directories in the SOLSafeDir, but I'd think instead we should require you can only use an existing directory for .sol files.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Sat 05 Jan 2008 10:17:28 AM UTC, comment #3:

Segfault fixed, next is the SharedObject dir not being properly created (mkdir is not enough, all parents dirs should be created when non-existing).

This is what I get running SharedObject-v{6,7,8}.swf:

31443] 11:16:59: ERROR: Couldn't create directory for .sol files: /home/strk/.gnash/SharedObjects/level1
No such file or directory
31443] 11:16:59: DEBUG: The rootdir is: /
level1

of course I don't have a ~/.gnash dir at all, but would
expect it to be created.

Sandro Santilli <strk>
Project Member
Tue 01 Jan 2008 11:17:15 AM UTC, comment #2:

Do we really need to serialize the object in memory in that function ? Writing to the file directly would make the code much simpler...

Sandro Santilli <strk>
Project Member
Tue 01 Jan 2008 11:14:38 AM UTC, comment #1:

The culprint seems here (short allocation):

==31934== Invalid write of size 1
==31934== at 0x4024BB4: memcpy (mc_replace_strmem.c:402)
==31934== by 0x480427F: amf::SOL::writeFile(std::string&, std::string&) (sol.cpp:237)
==31934== by 0x4805918: amf::SOL::writeFile(std::string&, char const*) (sol.cpp:199)
==31934== by 0x42E4F8F: gnash::sharedobject_flush(gnash::fn_call const&) (SharedObject.cpp:225)
...
==31934== Address 0x58f3798 is 0 bytes after a block of size 16 alloc'd
==31934== at 0x4022F14: operator new[](unsigned) (vg_replace_malloc.c:268)
==31934== by 0x480405E: amf::SOL::writeFile(std::string&, std::string&) (sol.cpp:226)
==31934== by 0x4805918: amf::SOL::writeFile(std::string&, char const*) (sol.cpp:199)
==31934== by 0x42E4F8F: gnash::sharedobject_flush(gnash::fn_call const&) (SharedObject.cpp:225)

Sandro Santilli <strk>
Project Member
Tue 01 Jan 2008 11:12:32 AM UTC, original submission:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1231345984 (LWP 31886)]
0xb77db22f in amf::SOL::writeFile (this=0xbf9edabc, filespec=@0xbf9edb28,
name=@0xbf9eda64) at /home/strk/src/gnash/gnash-head/libamf/sol.cpp:232
232 int outsize = el->getName().size() + el->getLength() + 5;
(gdb) bt
#0 0xb77db22f in amf::SOL::writeFile (this=0xbf9edabc, filespec=@0xbf9edb28,
name=@0xbf9eda64) at /home/strk/src/gnash/gnash-head/libamf/sol.cpp:232
#1 0xb77dc919 in amf::SOL::writeFile (this=0xbf9edabc, filespec=@0xbf9edb28,
name=0x80b14b4 "settings")
at /home/strk/src/gnash/gnash-head/libamf/sol.cpp:199
#2 0xb7da3f90 in gnash::sharedobject_flush (fn=@0xbf9edbdc)
at /home/strk/src/gnash/gnash-head/server/asobj/SharedObject.cpp:225
#3 0xb7bdc28b in gnash::builtin_function::operator() (this=0x80b47e8,
fn=@0xbf9edbdc)

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rsavoye (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 05 Jan 2008 10:17:28 AM UTCstrkStatusConfirmed=>Fixed
      Open/ClosedOpen=>Closed
    Tue 01 Jan 2008 11:17:15 AM UTCstrkAssigned toNone=>rsavoye

    Back to the top


    Powered by Savane 3.1-cleanup1