bugGnash - The GNU Flash player - Bugs: bug #22314, segfault in sound_handler_SDL

 
 

bug #22314: segfault in sound_handler_SDL

Submitted by:  Sandro Santilli <strk>
Submitted on:  Thu 14 Feb 2008 02:06:08 PM UTC  
 
Category: sound-sdlSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Benjamin Wolsey <bwy>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 15 Sep 2008 02:43:33 PM UTC, comment #8:

It seems I don't get it now. Thanks.

Sandro Santilli <strk>
Project Member
Mon 15 Sep 2008 02:20:20 PM UTC, comment #7:

I've committed a check for that case. Do you still get the segfault?

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Mon 15 Sep 2008 02:13:20 PM UTC, comment #6:

No, I get the segfault too occasionally. Seems to be mixing sounds that have been deleted.

It's very hard to reproduce for me, but it when it happens it's after a thread switch. Sound deletion is mutex protected, but there's nothing to stop mixSoundData accessing sounds after they've been deleted.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Mon 15 Sep 2008 01:46:13 PM UTC, comment #5:

How did this get fixed ?
Maybe memory errors now that libamf isn't used anymore ?
Anyway, I still get a segfault on exit...

Sandro Santilli <strk>
Project Member
Mon 15 Sep 2008 01:08:07 PM UTC, comment #4:

Seems fixed to me.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Thu 04 Sep 2008 10:37:55 AM UTC, comment #3:

assigned to bjacques, currently head-down in sound_handler

Sandro Santilli <strk>
Project Member
Thu 04 Sep 2008 10:13:28 AM UTC, comment #2:

valgrind reports:

==9101== Invalid read of size 4
==9101== at 0x40CA167: gnash::media::SDL_sound_handler::mixSoundData(gnash::media::sound_data&, unsigned char*, unsigned) (stl_list.h:583)
==9101== by 0x40CB170: gnash::media::SDL_sound_handler::sdl_audio_callback(void, unsigned char, int) (sound_handler_sdl.cpp:841)
==9101== by 0x56D06E3: (within /usr/lib/libSDL-1.2.so.0.11.1)
==9101== by 0x56D81AA: (within /usr/lib/libSDL-1.2.so.0.11.1)
==9101== by 0x5724BBC: (within /usr/lib/libSDL-1.2.so.0.11.1)
==9101== by 0x45ED4FA: start_thread (in /lib/tls/i686/cmov/libpthread-2.7.so)
==9101== by 0x4CF0E5D: clone (in /lib/tls/i686/cmov/libc-2.7.so)
==9101== Address 0x2c is not stack'd, malloc'd or (recently) free'd

Sandro Santilli <strk>
Project Member
Thu 04 Sep 2008 10:09:15 AM UTC, comment #1:

This seems to work to get there:

gui/gtk-gnash http://flash.uptoten.com/load3_82.swf -F 2 -U http://www.uptoten.com/kids/kidsgames-races-honey.html -P flashvars='PageID=651&LanguageDir=en&'

Segfault with trunk after you select the character.

Sandro Santilli <strk>
Project Member
Thu 14 Feb 2008 02:06:08 PM UTC, original submission:

http://www.uptoten.com/kids/kidsgames-races-honey.html
The main movie in that page enters a kind of infinite load movie loop..

Again, it's not easy to fetch a standalone movie from taht site.

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 15 Sep 2008 02:43:33 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Mon 15 Sep 2008 02:20:20 PM UTCbwyStatusNone=>Ready For Test
      Assigned tobjacques=>bwy
    Thu 04 Sep 2008 10:38:13 AM UTCstrkCategoryNone=>sound-sdl
      Summaryinfinite loop ?=>segfault in sound_handler_SDL
    Thu 04 Sep 2008 10:37:55 AM UTCstrkAssigned tostrk=>bjacques
    Thu 04 Sep 2008 10:09:15 AM UTCstrkSeverity4 - Important=>6 - Security
      Assigned toNone=>strk

    Back to the top


    Powered by Savane 3.1-cleanup1