bugGnash - The GNU Flash player - Bugs: bug #23331, Segfault in enumerateProperties

 
 

bug #23331: Segfault in enumerateProperties

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Fri 23 May 2008 04:42:04 PM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 24 May 2008 06:18:13 AM UTC, comment #4:

I've applied a modified patch from strk in head, which fixes this bug, passes the testsuite and seems to make sense. I'll backport if confirmed.

The bug movie (from archive.org) actually starts eventually, after opening several hundred LocalConnection objects and TextFields, then closing all the LocalConnections at once.

Benjamin Wolsey <bwy>
Project Member
Fri 23 May 2008 05:09:52 PM UTC, comment #3:

Confirmed segfault with cvs 0.8.3 pull at 2008-05-23 13:00EDT

Craig Kelley <inconnu>
Fri 23 May 2008 05:08:21 PM UTC, comment #2:

0.8.3 affected - blocker

#0 0xb792ee3d in gnash::as_object::enumerateProperties (this=0x0, env=@0x83b9be4) at /home/strk/src/gnash/gnash-0.8.3-branch/server/as_object.cpp:1106
#1 0xb7c3540e in enumerateObject (env=@0x83b9be4, obj=@0x0) at /home/strk/src/gnash/gnash-0.8.3-branch/server/vm/ASHandlers.cpp:3131
#2 0xb7c4ef81 in gnash::SWF::SWFHandlers::ActionEnum2 (thread=@0xbff07030) at /home/strk/src/gnash/gnash-0.8.3-branch/server/vm/ASHandlers.cpp:3825
#3 0xb7c348d2 in gnash::SWF::ActionHandler::execute (this=0x844a7e8, thread=@0xbff07030)
at /home/strk/src/gnash/gnash-0.8.3-branch/server/vm/ASHandlers.cpp:173
#4 0xb7c55bda in gnash::SWF::SWFHandlers::execute (this=0xb7e367d8, type=gnash::SWF::ACTION_ENUM2, thread=@0xbff07030)
at /home/strk/src/gnash/gnash-0.8.3-branch/server/vm/ASHandlers.cpp:455

Sandro Santilli <strk>
Project MemberIn charge of this item.
Fri 23 May 2008 05:01:36 PM UTC, comment #1:

This is a working command line invocation:

gtk-gnash http://www.archive.org/flow/FlowPlayerLight.swf -P
'flashvars=config={"controlBarBackgroundColor":"0x000000","loop":false,"baseURL":"http://www.archive.org/download/","showVolumeSlider":true,"controlBarGloss":"high","playList":[{"url":"Castlevania_1313/Castlevania_1313.flv"},{"url":"Castlevania_1313/Castlevania_1313_HQ.flv"},{"url":"Castlevania_1313/Castlevania_1313_IQ.flv"},{"url":"Castlevania_1313/Castlevania_1313_LQ.flv"}],"showPlayListButtons":true,"usePlayOverlay":false,"menuItems":[false,false,false,false,true,true,false],"initialScale":"fit","autoPlay":true,"autoBuffering":true,"showMenu":true,"showMuteVolumeButton":true,"showFullScreenButton":true}&'

Benjamin Wolsey <bwy>
Project Member
Fri 23 May 2008 04:42:04 PM UTC, original submission:

From archive.org (SWF9, apparently):

gtk-gnash -x 106957443 -j 320 -k 268 -u http://www.archive.org/flow/FlowPlayerLight.swf -F 41 -U http://www.archive.org/details.php?identifier=Castlevania_1313&newflash=1 -P allowfullscreen=true -P allowscriptaccess=always -P bgcolor=ffffff -P flashvars=config={"controlBarBackgroundColor":"0x000000","loop":false,"baseURL":"http://www.archive.org/download/","showVolumeSlider":true,"controlBarGloss":"high","playList":[{"url":"Castlevania_1313/Castlevania_1313.flv"},{"url":"Castlevania_1313/Castlevania_1313_HQ.flv"},{"url":"Castlevania_1313/Castlevania_1313_IQ.flv"},{"url":"Castlevania_1313/Castlevania_1313_LQ.flv"}],"showPlayListButtons":true,"usePlayOverlay":false,"menuItems":[false,false,false,false,true,true,false],"initialScale":"fit","autoPlay":true,"autoBuffering":true,"showMenu":true,"showMuteVolumeButton":true,"showFullScreenButton":true}& -P height=100% -P pluginspage=http://www.adobe.com/go/getflashplayer -P quality=high -P src=/flow/FlowPlayerLight.swf -P type=application/x-shockwave-flash -P width=100%

I'll get my "slow-gnash" debugging build finished; in the meantime here are the traces I have:

Backtrace:

#0 gnash::as_object::enumerateProperties (this=0x0, env=@0x91bef8)
at /home/benjamin/Download/gnash/server/as_object.cpp:1106
#1 0x00002b2daf8eae60 in gnash::SWF::SWFHandlers::ActionEnum2 (
thread=<value optimized out>)
at /home/benjamin/Download/gnash/server/vm/ASHandlers.cpp:3772
#2 0x00002b2daf8ee68b in gnash::SWF::SWFHandlers::execute (
this=<value optimized out>, type=<value optimized out>,
thread=@0x7ffffbac5240)
at /home/benjamin/Download/gnash/server/vm/ASHandlers.cpp:449
#3 0x00002b2daf928c4e in gnash::ActionExec::operator() (this=0x7ffffbac5240)
at /home/benjamin/Download/gnash/server/vm/ActionExec.cpp:346
#4 0x00002b2daf7cb7e8 in gnash::swf_function::operator() (this=0xd47890,
fn=@0x7ffffbac55c0)
at /home/benjamin/Download/gnash/server/swf_function.cpp:303
#5 0x00002b2daf92ef0f in gnash::call_method (method=<value optimized out>,
env=0x91bef8, this_ptr=0x1f4f770, nargs=2, first_arg_bottom_index=101,
super=0x22a3d50) at /home/benjamin/Download/gnash/server/vm/action.cpp:91
#6 0x00002b2daf8fe82e in gnash::SWF::SWFHandlers::ActionCallMethod (
thread=@0x7ffffbac5d40)
at /home/benjamin/Download/gnash/server/vm/ASHandlers.cpp:3611
#7 0x00002b2daf8ee68b in gnash::SWF::SWFHandlers::execute (
this=<value optimized out>, type=<value optimized out>,
thread=@0x7ffffbac5d40)

Valgrind:

==25461== Invalid read of size 8
==25461== at 0x536EBB4: gnash::as_object::enumerateProperties(gnash::as_environment&) const (as_object.cpp:1106)
==25461== by 0x5517E5F: gnash::SWF::SWFHandlers::ActionEnum2(gnash::ActionExec&) (ASHandlers.cpp:3772)
==25461== by 0x551B68A: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:449)
==25461== by 0x5555C4D: gnash::ActionExec::operator()() (ActionExec.cpp:346)
==25461== by 0x53F87E7: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:303)
==25461== by 0x555BF0E: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int, gnash::as_object*) (action.cpp:91)
==25461== by 0x552B82D: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (ASHandlers.cpp:3611)
==25461== by 0x551B68A: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:449)
==25461== by 0x5555C4D: gnash::ActionExec::operator()() (ActionExec.cpp:346)
==25461== by 0x53F87E7: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:303)
==25461== by 0x555BF0E: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int, gnash::as_object*) (action.cpp:91)
==25461== by 0x552B82D: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (ASHandlers.cpp:3611)
==25461== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==25461==
==25461== Process terminating with default action of signal 11 (SIGSEGV)
==25461== Access not within mapped region at address 0x0
==25461== at 0x536EBB4: gnash::as_object::enumerateProperties(gnash::as_environment&) const (as_object.cpp:1106)
==25461== by 0x5517E5F: gnash::SWF::SWFHandlers::ActionEnum2(gnash::ActionExec&) (ASHandlers.cpp:3772)
==25461== by 0x551B68A: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:449)
==25461== by 0x5555C4D: gnash::ActionExec::operator()() (ActionExec.cpp:346)
==25461== by 0x53F87E7: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:303)
==25461== by 0x555BF0E: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int, gnash::as_object*) (action.cpp:91)
==25461== by 0x552B82D: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (ASHandlers.cpp:3611)
==25461== by 0x551B68A: gnash::SWF::SWFHandlers::execute(gnash::SWF::action_type, gnash::ActionExec&) const (ASHandlers.cpp:449)
==25461== by 0x5555C4D: gnash::ActionExec::operator()() (ActionExec.cpp:346)
==25461== by 0x53F87E7: gnash::swf_function::operator()(gnash::fn_call const&) (swf_function.cpp:303)
==25461== by 0x555BF0E: gnash::call_method(gnash::as_value const&, gnash::as_environment, gnash::as_object, int, int, gnash::as_object*) (action.cpp:91)
==25461== by 0x552B82D: gnash::SWF::SWFHandlers::ActionCallMethod(gnash::ActionExec&) (ASHandlers.cpp:3611)

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by inconnu (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 27 May 2008 06:10:07 AM UTCbwyOpen/ClosedOpen=>Closed
    Tue 27 May 2008 06:10:06 AM UTCbwyStatusReady For Test=>Fixed
    Sat 24 May 2008 06:18:13 AM UTCbwyStatusIn Progress=>Ready For Test
    Fri 23 May 2008 05:12:28 PM UTCstrkStatusConfirmed=>In Progress
      Assigned toNone=>strk
    Fri 23 May 2008 05:08:21 PM UTCstrkStatusNone=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup1