bugGnash - The GNU Flash player - Bugs: bug #22188, memory corruption in...

 
 

bug #22188: memory corruption in SharedObject.flush()

Submitted by:  Sandro Santilli <strk>
Submitted on:  Thu 31 Jan 2008 10:45:14 AM UTC  
 
Category: ActionScriptSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 11 Feb 2008 09:50:52 AM UTC, comment #6:

No, I don't believe so. Unless some changes are made to the AMF class without them being propagated to sol.cpp, that is....

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Mon 11 Feb 2008 07:57:27 AM UTC, comment #5:

The fix is effective for this specific case, but I don't
understand the magic numbers added to the size computer,
can it be it will still fail on other heavy SharedObject
use ?

Sandro Santilli <strk>
Project Member
Sun 10 Feb 2008 01:32:35 PM UTC, comment #4:

The SWF plays tolerably with my optimized build. I've committed a fix for this bug.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Sun 10 Feb 2008 05:08:38 AM UTC, comment #3:

Gnash bloats the CPU so much on that page I can't manage to even type something in the "search" box.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 31 Jan 2008 12:34:49 PM UTC, comment #2:

Some debugging, starts with:
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x88da088 name rep, len 2 - computed total output size 10
10677] 12:48:53: DEBUG: Writing element 0x88da088, name rep, encoded size 10 to mem at 0x868fb08 (bytes left 4927)
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x8e4b9c0 name ButtonPathName0, len 48 - computed total output size 68
10677] 12:48:53: DEBUG: Writing element 0x8e4b9c0, name ButtonPathName0, encoded size 68 to mem at 0x868fb13 (bytes left 4916)

And ends with:

10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x891cdd0 name site5, len 10 - computed total output size 20
10677] 12:48:53: DEBUG: Writing element 0x891cdd0, name site5, encoded size 20 to mem at 0x8690e1f (bytes left 40)
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x86eb118 name site6, len 10 - computed total output size 20
10677] 12:48:53: DEBUG: Writing element 0x86eb118, name site6, encoded size 20 to mem at 0x8690e34 (bytes left 19)

Note the 1-byte shortness at the end..

Sandro Santilli <strk>
Project Member
Thu 31 Jan 2008 11:27:40 AM UTC, comment #1:

With my last memory boundary checking commit the segfault
turns into an assertion failure.

The quick url to get there is:
http://www.uptoten.com/kids/uptoten-features-search-searchpage.html

The assertion is:
/libamf/sol.cpp:266: bool amf::SOL::writeFile(const std::string&, const std::string&): Assertion `ptr+outsize < endPtr' failed.

Sandro Santilli <strk>
Project Member
Thu 31 Jan 2008 10:45:14 AM UTC, original submission:

not so easy to reproduce, basically go to http://www.uptoten.com,
then get to the search engine, type 'cake' in it and press enter.

Anyway, glib detects an invalid free (and gnash is killed):

15914] 11:43:10: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*) enter
15914] 11:43:10: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*) enter

      • glibc detected *** /extra/gnash-cvs/bin/gtk-gnash: free(): invalid next size (normal): 0x08c4a370 ***

======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb718ed65]
/lib/tls/i686/cmov/libc.so.6(cfree+0x90)[0xb7192800]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0xb734bd81]
/usr/lib/libstdc++.so.6(_ZdaPv+0x1d)[0xb734bddd]
/extra/gnash-cvs/lib/gnash/libgnashamf-cvs.so(ZN3amf3SOL9writeFileERSsS1+0x675)[0xb6e05615]
/extra/gnash-cvs/lib/gnash/libgnashamf-cvs.so(_ZN3amf3SOL9writeFileERSsPKc+0x49)[0xb6e06cb9]
/extra/gnash-cvs/lib/gnash/libgnashserver-cvs.so(_ZN5gnash18sharedobject_flushERKNS_7fn_callE+0x271)[0xb7d1ce11]

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 11 Feb 2008 09:50:51 AM UTCbjacquesStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Sun 10 Feb 2008 01:32:35 PM UTCbjacquesStatusNone=>Ready For Test
      Assigned toNone=>bjacques

    Back to the top


    Powered by Savane 3.1-cleanup1