bugGnash - The GNU Flash player - Bugs: bug #22150, action_buffer.h:84 assertion...

 
 

bug #22150: action_buffer.h:84 assertion failure

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Mon 28 Jan 2008 05:20:23 PM UTC  
 
Category: parserSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 29 Jan 2008 10:15:33 PM UTC, comment #5:

This specific case is fixed by checking opcode length
against crossing code segment boundaries.
Still, I'm pretty sure aborts are around the corner, you
should find other easily.

Basically, it's enough to attempt a read of a float
from 1 bytes off the end of the segment to access
arbitrary memory...

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 29 Jan 2008 07:38:41 AM UTC, comment #4:

confirmed, sorry, used the wrong testcase.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 29 Jan 2008 07:33:36 AM UTC, comment #3:

This still fails for me. I get:

18139] 08:22:16: ERROR: Undefined or null string passed to ActionSubString, returning undefined
18139] 08:22:16: fs_callback(0x9ef480): shov-enu false
lt-gtk-gnash: ../../server/parser/action_buffer.h:84: uint8_t gnash::action_buffer::operator[](size_t) const: Assertion »off < m_buffer.size()« failed

and the same backtrace.

Benjamin Wolsey <bwy>
Project Member
Mon 28 Jan 2008 08:38:34 PM UTC, comment #2:

This one seems fixed as well.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 28 Jan 2008 05:22:09 PM UTC, comment #1:

Sorry, file #14890.

Benjamin Wolsey <bwy>
Project Member
Mon 28 Jan 2008 05:20:23 PM UTC, original submission:

This is relocated from bug #22141.

File #14980:

#2 0x00002b2c95eb068f in __assert_fail () from /lib64/libc.so.6
#3 0x00002b2c93af24f8 in gnash::SWF::SWFHandlers::ActionPushData (
thread=@0x7fff175f7e80) at ../../server/parser/action_buffer.h:84
#4 0x00002b2c93b2e4c3 in gnash::ActionExec::operator() (this=0x7fff175f7e80)
at ActionExec.cpp:344
#5 0x00002b2c939b9571 in gnash::GlobalCode::execute (
this=<value optimized out>) at ../server/vm/ExecutableCode.h:77
#6 0x00002b2c939b30c5 in gnash::movie_root::processActionQueue (
this=0x9d8780, lvl=<value optimized out>) at movie_root.cpp:1305
#7 0x00002b2c939b314d in gnash::movie_root::processActionQueue (this=0x9d8780)
at movie_root.cpp:1372
#8 0x00002b2c939b5420 in gnash::movie_root::setRootMovie (this=0x9d8780,
movie=0x9ef620) at movie_root.cpp:167
#9 0x00000000004342a1 in gnash::Gui::start (this=0x702a30) at gui.cpp:692

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 30 Jan 2008 05:17:08 AM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Tue 29 Jan 2008 10:15:33 PM UTCstrkStatusIn Progress=>Ready For Test
    Tue 29 Jan 2008 07:38:41 AM UTCstrkStatusReady For Test=>In Progress
    Mon 28 Jan 2008 08:38:34 PM UTCstrkCategoryNone=>parser
      StatusNone=>Ready For Test
      Assigned toNone=>strk

    Back to the top


    Powered by Savane 3.1-cleanup1