Thu 31 Jan 2008 12:34:49 PM UTC, comment #2:
Some debugging, starts with:
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x88da088 name rep, len 2 - computed total output size 10
10677] 12:48:53: DEBUG: Writing element 0x88da088, name rep, encoded size 10 to mem at 0x868fb08 (bytes left 4927)
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x8e4b9c0 name ButtonPathName0, len 48 - computed total output size 68
10677] 12:48:53: DEBUG: Writing element 0x8e4b9c0, name ButtonPathName0, encoded size 68 to mem at 0x868fb13 (bytes left 4916)
And ends with:
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x891cdd0 name site5, len 10 - computed total output size 20
10677] 12:48:53: DEBUG: Writing element 0x891cdd0, name site5, encoded size 20 to mem at 0x8690e1f (bytes left 40)
10677] 12:48:53: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*, size_t&) enter
10677] 12:48:53: DEBUG: Element 0x86eb118 name site6, len 10 - computed total output size 20
10677] 12:48:53: DEBUG: Writing element 0x86eb118, name site6, encoded size 20 to mem at 0x8690e34 (bytes left 19)
Note the 1-byte shortness at the end..
|
Thu 31 Jan 2008 10:45:14 AM UTC, original submission:
not so easy to reproduce, basically go to http://www.uptoten.com,
then get to the search engine, type 'cake' in it and press enter.
Anyway, glib detects an invalid free (and gnash is killed):
15914] 11:43:10: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*) enter
15914] 11:43:10: DEBUG: uint8_t* amf::AMF::encodeVariable(amf::Element*) enter
- glibc detected *** /extra/gnash-cvs/bin/gtk-gnash: free(): invalid next size (normal): 0x08c4a370 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb718ed65]
/lib/tls/i686/cmov/libc.so.6(cfree+0x90)[0xb7192800]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0xb734bd81]
/usr/lib/libstdc++.so.6(_ZdaPv+0x1d)[0xb734bddd]
/extra/gnash-cvs/lib/gnash/libgnashamf-cvs.so(ZN3amf3SOL9writeFileERSsS1+0x675)[0xb6e05615]
/extra/gnash-cvs/lib/gnash/libgnashamf-cvs.so(_ZN3amf3SOL9writeFileERSsPKc+0x49)[0xb6e06cb9]
/extra/gnash-cvs/lib/gnash/libgnashserver-cvs.so(_ZN5gnash18sharedobject_flushERKNS_7fn_callE+0x271)[0xb7d1ce11]
|