bugGnash - The GNU Flash player - Bugs: bug #23185, action_buffer assertion failure

 
 

bug #23185: action_buffer assertion failure

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Tue 06 May 2008 04:38:17 PM UTC  
 
Category: NoneSeverity: 5 - Blocker
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Benjamin Wolsey <bwy>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 07 May 2008 10:09:17 AM UTC, comment #3:

Confirm fixed, but should this be a MALFORMED SWF
rather then an ERROR ?

Sandro Santilli <strk>
Project Member
Wed 07 May 2008 09:45:08 AM UTC, comment #2:

So, we throw an exception on illegal access, catch it in SWFHandlers::execute, which should stop reading/executing and continue playing the SWF.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Tue 06 May 2008 07:45:17 PM UTC, comment #1:

There are a few problems with out-of-bounds access in action_buffer, and practically no checking. The operator[] catches external out-of-bounds access, and the .at()s I added catch some others.

Extending the checking to all reads (not necessarily using .at()) is easy enough, but what should we do on failure? Aborting is probably not right. The pp exits (without segfault / abort) on some of these cases, which probably isn't right either.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Tue 06 May 2008 04:38:17 PM UTC, original submission:

lt-gtk-gnash: ../../server/parser/action_buffer.h:84: uint8_t gnash::action_buffer::operator[](size_t) const: Assertion »off < m_buffer.size()« failed.

#3 0x00002b18e378ee00 in gnash::action_buffer::operator[] ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#4 0x00002b18e376b124 in gnash::SWF::SWFHandlers::ActionDefineFunction2 ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#5 0x00002b18e3769eba in gnash::SWF::ActionHandler::execute ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#6 0x00002b18e3778e37 in gnash::SWF::SWFHandlers::execute ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#7 0x00002b18e37af65a in gnash::ActionExec::operator() ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#8 0x00002b18e35d50bc in gnash::GlobalCode::execute ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#9 0x00002b18e35c8184 in gnash::movie_root::processActionQueue ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so
#10 0x00002b18e35c825c in gnash::movie_root::processActionQueue ()
from /home/benjamin/Downloads/gnash/server/.libs/libgnashserver-cvs.so

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15621:  cut.snoopy_click.zzuf.s875.swf added by bwy (10KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 07 May 2008 10:20:23 AM UTCbwyStatusReady For Test=>Fixed
      Assigned toNone=>bwy
      Open/ClosedOpen=>Closed
    Wed 07 May 2008 09:45:08 AM UTCbwyStatusNone=>Ready For Test
    Tue 06 May 2008 04:38:17 PM UTCbwyAttached File-=>Added cut.snoopy_click.zzuf.s875.swf, #15621

    Back to the top


    Powered by Savane 3.1-cleanup1