bugGnash - The GNU Flash player - Bugs: bug #22288, Assert fail in fill_style.cpp:219

 
 

bug #22288: Assert fail in fill_style.cpp:219

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Mon 11 Feb 2008 05:31:01 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 12 Feb 2008 08:49:57 AM UTC, comment #2:

The first problem was in shape_character_def::read, which lacked any ensureBytes / ensureBits checks, so read right out of the tag.

ensureBytes uses unsigned values for bytes left, so when it's already outside the tag it's checking, it doesn't notice. That's why the call to ensureBytes in gnash::fill_style::read didn't fail.

Benjamin Wolsey <bwy>
Project Member
Mon 11 Feb 2008 05:38:04 PM UTC, comment #1:

The problem is most likely in
SWF::tag_type stream::open_tag

Where tag boundaries are computed.
THe assertion you see is a consistency check
in teh stack of opened tags.
The stack is populated by open_tag.

There, a signed length is used, please add debugging
there as it's either a negative value or a so large
to overflow an unsigned long..

Sandro Santilli <strk>
Project Member
Mon 11 Feb 2008 05:31:01 PM UTC, original submission:

It's not immediately clear to me why this fails, as there is a call to ensureBytes(2) just before the read_u16() that fails:

#2 0x00002ac6e968768f in __assert_fail () from /lib64/libc.so.6
#3 0x00002ac6e721adad in gnash::stream::read (this=0x9c8090,
buf=0x407ff910 "��\177@", count=2) at stream.cpp:58
#4 0x00002ac6e721ae61 in gnash::stream::read_u16 (this=0x1e36)
at stream.cpp:263
#5 0x00002ac6e720e866 in gnash::fill_style::read (this=0x407ffbb0,
in=0x9c8090, tag_type=22, md=0x9c9cf0, pOther=0x0) at fill_style.cpp:219
#6 0x00002ac6e72bc906 in read_fill_styles (styles=@0xa194e8, in=0x9c8090,
tag_type=22, m=0x9c9cf0) at shape_character_def.cpp:104
#7 0x00002ac6e72bdc9c in gnash::shape_character_def::read (this=0xa194d0,
in=0x9c8090, tag_type=22, with_style=true, m=0x9c9cf0)
at shape_character_def.cpp:472
#8 0x00002ac6e71cd6dc in gnash::SWF::tag_loaders::define_shape_loader (
in=0x9c8090, tag=gnash::SWF::DEFINESHAPE2, m=0x9c9cf0)
at swf/tag_loaders.cpp:792

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15023:  panda.zzuf.688.swf added by bwy (172KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 12 Feb 2008 08:55:24 AM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Tue 12 Feb 2008 08:49:57 AM UTCbwyStatusNone=>Ready For Test
    Mon 11 Feb 2008 05:31:01 PM UTCbwyAttached File-=>Added panda.zzuf.688.swf, #15023

    Back to the top


    Powered by Savane 3.1-cleanup1