bugGnash - The GNU Flash player - Bugs: bug #23650, OOB preloading local registers

 
 

bug #23650: OOB preloading local registers

Submitted by:  Sandro Santilli <strk>
Submitted on:  Fri 20 Jun 2008 02:47:11 PM UTC  
 
Category: ActionScriptSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 23 Jun 2008 09:25:07 AM UTC, comment #2:

Applied, added test (swfmill-based) and committed.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sat 21 Jun 2008 08:12:32 AM UTC, comment #1:

The attached patch simplifies registers use, fixes the OOB
and gives better compatibility too.
Will need to produce a proper swfmill-based test for
the testsuite to go with it.

(file #15894)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Fri 20 Jun 2008 02:47:11 PM UTC, original submission:

When DefineFunction2 advertises less local registers
then required to preload some of them, gnash tries to access
unallocated memory.
Testcase attached.
Need to find out if the preload takes effect at all or not
to fix it correctly.

Sandro Santilli <strk>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15894:  safeRegisters.patch added by strk (11KiB - application/octet-stream)
file #15884:  preload_no_regs.swf added by strk (305B - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 23 Jun 2008 09:25:07 AM UTCstrkStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Sat 21 Jun 2008 08:12:32 AM UTCstrkAttached File-=>Added safeRegisters.patch, #15894
    Fri 20 Jun 2008 02:47:11 PM UTCstrkAttached File-=>Added preload_no_regs.swf, #15884

    Back to the top


    Powered by Savane 3.1-cleanup1