bugGnash - The GNU Flash player - Bugs: bug #22319, bitcount assertion failure

 
 

bug #22319: bitcount assertion failure

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Fri 15 Feb 2008 11:55:37 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 16 Feb 2008 08:30:35 AM UTC, comment #1:

I've to say I'm not sure a bit count greater then 32 should
be a real malformation actually. That assertion used to be for a limit of 24, I rised it when found a real-world movie failing that.

Those bits reading function are usually for delta coordinates
in twips, which si the offset (x,y) next point is from previous.
A 32 bit number is most likely always enough.

So, yes please go by check nbits in text_character_def
and log the MALFORMED SWF, we'll be easier for users
to prove it wrong for real-world movies.

I guess there are a lot of cases in which nbits are not
checked though, so another way might be turning the assertion
checking in gnash::stream to an exception....

Sandro Santilli <strk>
Project Member
Fri 15 Feb 2008 11:55:37 AM UTC, original submission:

lt-gtk-gnash: stream.cpp:86: unsigned int gnash::stream::read_uint(short unsigned int): Zusicherung »bitcount <= 32« nicht erfüllt.

glyph_bits (text_character_def.cpp:27) is greater than 32, triggers assertion failure when text_glyph_record::read calls read_uint.

The most obvious answer seems to be to check in text_character_def that the value is no greater than 32.

#3 0x00002b5b28efb727 in gnash::stream::read_uint (this=0x9c83c0, bitcount=73)
at stream.cpp:86
#4 0x00002b5b28efb75b in gnash::stream::read_sint (this=0x2a20,
bitcount=<value optimized out>) at stream.cpp:166
#5 0x00002b5b28efd611 in gnash::text_glyph_record::read (this=0x9ffe40,
in=0x9c83c0, glyph_count=35, glyph_bits=<value optimized out>,
advance_bits=<value optimized out>) at text.cpp:79
#6 0x00002b5b28f8f70f in gnash::text_character_def::read (this=0xa9b0c0,
in=0x9c83c0, tag_type=11, m=0x9c9d00) at text_character_def.cpp:152

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15042:  pulp.cut.zzuf.639.swf added by bwy (10KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 17 Feb 2008 08:33:09 AM UTCbwyOpen/ClosedOpen=>Closed
    Sun 17 Feb 2008 08:33:08 AM UTCbwyStatusNone=>Fixed
    Fri 15 Feb 2008 11:55:37 AM UTCbwyAttached File-=>Added pulp.cut.zzuf.639.swf, #15042

    Back to the top


    Powered by Savane 3.1-cleanup1