bugGnash - The GNU Flash player - Bugs: bug #22039, Segfault in sharedobject_getlocal...

 
 

bug #22039: Segfault in sharedobject_getlocal on restart

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Thu 17 Jan 2008 11:00:35 AM UTC  
 
Category: NoneSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Rob Savoye <rsavoye>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 31 Jan 2008 01:03:39 PM UTC, comment #5:

this segfault was fixed, returning always the same in-memory object might also not be a blocker, and we have automated testing for it anyway...

Sandro Santilli <strk>
Project Member
Tue 22 Jan 2008 10:45:15 AM UTC, comment #4:

So, news:

1) Yes, SharedObject returned by getLocal needs be static,
and there should be a new one for every key

2) I fixed gnash to register the 'static' so it doesn't segfault

3) Gnash still fails in returning the same object for
any key, representing a SECURITY issue, as any getLocal
call, by any movie would return the same object, no
matter the key...

Sandro Santilli <strk>
Project Member
Tue 22 Jan 2008 10:19:29 AM UTC, comment #3:

The culprit is a static GcResource:

static boost::intrusive_ptr<SharedObject> obj = new SharedObject();

That's in SharedObject.getLocal() code.

Does it need to be a static ?
Do subsequent calls to getLocal() retrive the same object ?
I'm going to add tests for it in actionscript.all/SharedObject.as

Sandro Santilli <strk>
Project Member
Tue 22 Jan 2008 03:24:01 AM UTC, comment #2:

oh, btw, this movie is swf v9, so it's nice it works at all. My guess is that's what's causing the memory corruption.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Tue 22 Jan 2008 03:21:56 AM UTC, comment #1:

This appears to be caused by memory corruption outside the LSO code. The second time the getlocal() is called, the object is corrupted, so gnash seg faults.

Rob Savoye <rsavoye>
Project AdministratorIn charge of this item.
Thu 17 Jan 2008 11:00:35 AM UTC, original submission:

Restarting this movie:

http://www.goovies.co.uk/pulp.swf

Causes a segfault with this backtrace:

#0 0x00002b43c4350267 in std::string::assign () from /usr/lib64/libstdc++.so.6
#1 0x00002b43c244cbb9 in gnash::sharedobject_getlocal (fn=@0x7fffe8c22130)
at /usr/lib/gcc/x86_64-mandriva-linux-gnu/4.2.2/../../../../include/c++/4.2.2/bits/basic_string.h:491
#2 0x00002b43c2345ab5 in gnash::builtin_function::operator() (this=0xbd0fc0,
fn=@0x7fffe8c22130) at ../../server/builtin_function.h:83
#3 0x00002b43c24e783b in gnash::call_method (method=@0x7fffe8c222d0,
env=0x2aaaac06f1e0, this_ptr=0xbd0bf0, nargs=<value optimized out>,
first_arg_bottom_index=6) at action.cpp:155
#4 0x00002b43c24a3178 in gnash::SWF::SWFHandlers::ActionCallMethod (
thread=@0x7fffe8c22920) at ASHandlers.cpp:3346
#5 0x00002b43c24e2553 in gnash::ActionExec::operator() (this=0x7fffe8c22920)
at ActionExec.cpp:344
#6 0x00002b43c23a50d9 in gnash::swf_function::operator() (
this=0x2aaaac08e860, fn=@0x7fffe8c22ce0) at swf_function.cpp:270
#7 0x00002b43c24e783b in gnash::call_method (method=@0x7fffe8c22dc0,
env=0x2aaaac06f1e0, this_ptr=0x2aaaac06f050, nargs=<value optimized out>,
first_arg_bottom_index=0) at action.cpp:155
#8 0x00002b43c24a803c in gnash::SWF::SWFHandlers::ActionCallFunction (
thread=@0x7fffe8c23380) at ASHandlers.cpp:2610
#9 0x00002b43c24e2553 in gnash::ActionExec::operator() (this=0x7fffe8c23380)
at ActionExec.cpp:344

I think this is a separate bug from the ones reported.

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by rsavoye (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 31 Jan 2008 01:03:39 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Tue 22 Jan 2008 10:45:14 AM UTCstrkStatusNone=>Ready For Test
    Tue 22 Jan 2008 03:21:56 AM UTCrsavoyeAssigned toNone=>rsavoye

    Back to the top


    Powered by Savane 3.1-cleanup1