bugGnash - The GNU Flash player - Bugs: bug #24379, off-by-one error in meta tag...

 
 

bug #24379: off-by-one error in meta tag parsing in FLVParser.cpp

Submitted by:  Jason Woofenden <jasonwoof>
Submitted on:  Thu 25 Sep 2008 07:48:50 PM UTC  
 
Category: videoSeverity: 3 - Normal
Release: trunkStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 26 Sep 2008 11:28:32 AM UTC, comment #1:

I committed a patch fixing the off-by-one problem w/out any
change on how FLVParser parses the body (just fixed the size
of the buffer parsed later).

Didn't commit your patch for error messages and such, maybe
you'll have a chance to further clean it up before, using
the correct sizes might help.

IIRC YouTUbe MetaData injector did have something like:

  1. x 00 0# ##

Even with a byte less we'd likely still find 2 bytes, and not
being 0000. See if you can confirm now that you have more correct sizes.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Thu 25 Sep 2008 07:48:50 PM UTC, original submission:

FLVParser.cpp reads in 12 bytes for the FLV tag header, then the code for parsing a meta tag, reads what's past that, and parses for AMF.

Trouble is that the header is only 11 bytes, so the part of the buffer that is parsed for AMF starts one byte late, and ends one byte late. The AMF parsing code in there is written to work without the first byte (it assumes it's type "string" which it should always be).

Youtube compounds this problem a little, by failing to end their AMF with object at the end of the OnMetadata tag of their flv files with the proper terminator (0x000009).

Gnash behaves properly in the front-end, but spits out a weird error message about a string being cut short.

I'm attaching a patch that prints out more accurate error messages which actually explain what's happening, not the weird thing about the string being cut short.

Someone still needs to fix the FLV header parsing and get this right bytes to be parsed by AMF (and fix the AMF parser to expect a type byte at the begining)

Jason Woofenden <jasonwoof>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #16570:  youtube_amf_end.diff added by jasonwoof (876B - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by jasonwoof (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 25 Oct 2008 08:34:05 AM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 26 Sep 2008 11:28:32 AM UTCstrkStatusNone=>Ready For Test
      Assigned toNone=>strk
    Thu 25 Sep 2008 07:48:50 PM UTCjasonwoofAttached File-=>Added youtube_amf_end.diff, #16570

    Back to the top


    Powered by Savane 3.1-cleanup1