bugGnash - The GNU Flash player - Bugs: bug #24651, 10/26/08 trunk fails with...

 
 

bug #24651: 10/26/08 trunk fails with "double free or corruption" with some youtube

Submitted by:  Dongxu Li <butdiene>
Submitted on:  Sun 26 Oct 2008 12:18:53 PM UTC  
 
Category: video-ffmpegSeverity: 6 - Security
Release: NoneStatus: Invalid
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 03 Nov 2008 04:44:19 PM UTC, comment #3:

Let's close it then for now, unless it happens with a release shipped with an up-to-date distribution there's no point in
looking for any workaround.

Sandro Santilli <strk>
Project Member
Fri 31 Oct 2008 11:22:06 PM UTC, comment #2:

I upgraded ffmpeg to -svn, this exception is gone

so, this is probably a ffmpeg bug and already fixed upstream.

Dongxu Li <butdiene>
Sun 26 Oct 2008 09:30:52 PM UTC, comment #1:

I'm on a 64bit too, and can't reproduce.
Gnash built against ffmpeg: Lavc1d.51.38.0

Sandro Santilli <strk>
Project Member
Sun 26 Oct 2008 12:18:53 PM UTC, original submission:

$ gnash --version
Gnash trunk

Copyright (C) 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
Gnash comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of Gnash under the terms of the GNU General
Public License. For more information, see the file named COPYING.

Build options trunk
Target:
Renderer: agg - GUI: GTK - Media handler: ffmpeg
Configured with: --prefix=/usr --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --disable-cygnal --disable-docbook --enable-ghelp --enable-npapi --disable-kparts --disable-i810-lod-bias --enable-gui=gtk --with-npapi-plugindir=/opt/netscape/plugins --enable-renderer=agg --enable-media=ffmpeg --with-ffmpeg-incl=/usr/include --libdir=/usr/lib64 --build=x86_64-pc-linux-gnu
CXXFLAGS: -O3 -march=native -fomit-frame-pointer -fexpensive-optimizations -pipe -pthread -pthread -W -Wall -Wcast-align -Wcast-qual -Wpointer-arith -Wreturn-type -Wnon-virtual-dtor -Wunused -fvisibility-inlines-hidden

$ gnash.sh http://www.youtube.com/watch?v=7fH3HIAlHzA
+ export GST_DEBUG=2
+ GST_DEBUG=2
+ '[' 'xhttp://www.youtube.com/watch?v=7fH3HIAlHzA' = x ']'
+ url='http://www.youtube.com/watch?v=7fH3HIAlHzA'
++ wget --quiet -O - 'http://www.youtube.com/watch?v=7fH3HIAlHzA'
++ grep -F watch_fullscreen
++ cut -d '?' -f 2
++ cut -d '"' -f1
++ sed -e 's/ /%20/g'
+ var='fs=1&vq=None&video_id=7fH3HIAlHzA&l=183&sk=Yl7dYcPvsobUazwPXS4qAR6ye3924pPkC&fmt_map=&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G&hl=en&plid=AARaJRjkTsJxSZYXAAAAoAAAAAA&title=卓依婷---路边的野花不要采'\'';'
+ echo 'var=fs=1&vq=None&video_id=7fH3HIAlHzA&l=183&sk=Yl7dYcPvsobUazwPXS4qAR6ye3924pPkC&fmt_map=&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G&hl=en&plid=AARaJRjkTsJxSZYXAAAAoAAAAAA&title=卓依婷---路边的野花不要采'\'';'
var=fs=1&vq=None&video_id=7fH3HIAlHzA&l=183&sk=Yl7dYcPvsobUazwPXS4qAR6ye3924pPkC&fmt_map=&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G&hl=en&plid=AARaJRjkTsJxSZYXAAAAoAAAAAA&title=卓依婷---路边的野花不要采';
+ gtk-gnash -v -F 2 -U http://www.youtube.com -P 'flashvars=fs=1&vq=None&video_id=7fH3HIAlHzA&l=183&sk=Yl7dYcPvsobUazwPXS4qAR6ye3924pPkC&fmt_map=&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G&hl=en&plid=AARaJRjkTsJxSZYXAAAAoAAAAAA&title=卓依婷---路边的野花不要采'\'';' http://www.youtube.com/player2.swf
31215:139944338528128] 04:59:38 SECURITY: Checking security of URL 'http://www.youtube.com/player2.swf'
31215:139944338528128] 04:59:38 SECURITY: Load from host http://www.youtube.com granted (default)
31215:1113991504] 04:59:38 UNIMPLEMENTED: LanguageCode in DefineFont (2 or 3)
31215:139944338528128] 04:59:39 ERROR: No Video info in video definition
31215:139944338528128] 04:59:39 ERROR: No export symbol LogWindow found in movie http://www.youtube.com/player2.swf. Frames loaded 1/1
31215:139944338528128] 04:59:39 ERROR: No export symbol LogWindowScrollbar found in movie http://www.youtube.com/player2.swf. Frames loaded 1/1
31215:139944338528128] 04:59:39 ERROR: MovieClip.attachAudio([undefined]): first arg doesn't cast to an object
31215:139944338528128] 04:59:39 UNIMPLEMENTED: MovieClip.attachAudio() - TESTING
31215:139944338528128] 04:59:39 SECURITY: Checking security of URL 'http://www.youtube.com/get_video?video_id=7fH3HIAlHzA&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G'
31215:139944338528128] 04:59:39 SECURITY: Load from host http://www.youtube.com granted (default)
31215:139944338528128] 04:59:39 SECURITY: Connecting to movie: http://www.youtube.com/get_video?video_id=7fH3HIAlHzA&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G
31215:139944338528128] 04:59:39 SECURITY: Checking security of URL 'http://www.youtube.com/get_video?video_id=7fH3HIAlHzA&t=OEgsToPDskLSMQRrpT8hcYjTbpaUEo6G'
31215:139944338528128] 04:59:39 SECURITY: Load from host http://www.youtube.com granted (default)
31215:1094293840] 04:59:39 ERROR: Corrupt FLV: Meta tag unterminated!
31215:1094293840] 04:59:39 ERROR: Corrupt FLV: previous tag size record (0) unexpected (actual size: 623)
[swscaler @ 0x7f473c25ae60]No accelerated colorspace conversion found.
31215:139944338528128] 04:59:39 ERROR: AMF0 read: premature end of input reading String type
31215:139944338528128] 04:59:39 ERROR: Could not convert FLV metatag to as_value, but will try passing it anyway. It's an [object(gnash::Array_as):0x7f473c17e5a0]

      • glibc detected *** gtk-gnash: double free or corruption (out): 0x00000000022199f0 ***

======= Backtrace: =========
/lib/libc.so.6[0x7f4751d4e148]
/lib/libc.so.6(cfree+0x76)[0x7f4751d50936]
/usr/lib64/gnash/libgnashmedia-trunk.so(_ZN5gnash5media18VideoDecoderFfmpeg12frameToImageEP14AVCodecContextRK7AVFrame+0x13c)[0x7f47544732cc]
/usr/lib64/gnash/libgnashmedia-trunk.so(_ZN5gnash5media18VideoDecoderFfmpeg6decodeEPKhj+0x8d)[0x7f475447358d]
/usr/lib64/gnash/libgnashmedia-trunk.so(_ZN5gnash5media18VideoDecoderFfmpeg3popEv+0x45)[0x7f4754473695]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash12NetStream_as20decodeNextVideoFrameEv+0x82)[0x7f4753e5f552]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash12NetStream_as20getDecodedVideoFrameEj+0x7b)[0x7f4753e61f4b]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash12NetStream_as17refreshVideoFrameEb+0x74)[0x7f4753e62254]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash12NetStream_as7advanceEv+0xdd)[0x7f4753e6447d]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash12NetStream_as14advanceWrapperERKNS_7fn_callE+0x2b)[0x7f4753e645bb]
/usr/lib64/gnash/libgnashcore-trunk.so[0x7f4753d3cef5]
/usr/lib64/gnash/libgnashcore-trunk.so(ZN5gnash11call_methodERKNS_8as_valueEPNS_14as_environmentEPNS_9as_objectESt8auto_ptrISt6vectorIS0_SaIS0_EEES6+0x97)[0x7f4753f4d657]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash5Timer7executeEv+0x16f)[0x7f4753e22b1f]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash5Timer15executeAndResetEv+0x10)[0x7f4753e22dc0]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash10movie_root13executeTimersEv+0x1a1)[0x7f4753d8d2a1]
/usr/lib64/gnash/libgnashcore-trunk.so(_ZN5gnash10movie_root7advanceEv+0x3f)[0x7f4753d92d1f]
gtk-gnash(_ZN5gnash3Gui12advanceMovieEv+0x36)[0x42fdb6]
/usr/lib/libglib-2.0.so.0[0x7f4752a6c1fb]
/usr/lib/libglib-2.0.so.0[0x7f4752a6b554]
/usr/lib/libglib-2.0.so.0[0x7f4752a6d305]
/usr/lib/libglib-2.0.so.0(g_main_loop_run+0x1f5)[0x7f4752a6d875]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main+0xa7)[0x7f475354ee17]
gtk-gnash(_ZN5gnash6GtkGui3runEv+0xe)[0x442ace]
gtk-gnash(ZN5gnash6Player3runEiPPcRKSsS4+0x600)[0x43a470]
gtk-gnash(main+0xcd)[0x42420d]
/lib/libc.so.6(__libc_start_main+0xe6)[0x7f4751cf21d6]
gtk-gnash[0x422479]
======= Memory map: ========
00400000-004ea000 r-xp 00000000 08:03 3147760 /usr/bin/gtk-gnash
006ea000-006ec000 r--p 000ea000 08:03 3147760 /usr/bin/gtk-gnash
006ec000-006ed000 rw-p 000ec000 08:03 3147760 /usr/bin/gtk-gnash
006ed000-006ee000 rw-p 006ed000 00:00 0
01f92000-02272000 rw-p 01f92000 00:00 0 [heap]
40b99000-40b9a000 ---p 40b99000 00:00 0
40b9a000-4139a000 rw-p 40b9a000 00:00 0
4139a000-4139b000 ---p 4139a000 00:00 0
4139b000-41b9b000 rw-p 4139b000 00:00 0
41e62000-41e63000 ---p 41e62000 00:00 0
41e63000-42663000 rw-p 41e63000 00:00 0
7f473818e000-7f473a0c7000 r--p 00000000 08:03 587688 /usr/share/fonts/opendesktop-fonts/odosung.ttc
7f473a0c7000-7f473c000000 r--p 00000000 08:03 587688 /usr/share/fonts/opendesktop-fonts/odosung.ttc
7f473c000000-7f473c2d5000 rw-p 7f473c000000 00:00 0
7f473c2d5000-7f4740000000 ---p 7f473c2d5000 00:00 0
7f4741bbc000-7f4741c72000 rw-p 7f4741bbc000 00:00 0
7f4741c72000-7f4741c76000 r-xp 00000000 08:03 376018 /lib64/libnss_dns-2.7.so
7f4741c76000-7f4741e76000 ---p 00004000 08:03 376018 /lib64/libnss_dns-2.7.so
7f4741e76000-7f4741e77000 r--p 00004000 08:03 376018 /lib64/libnss_dns-2.7.so
7f4741e77000-7f4741e78000 rw-p 00005000 08:03 376018 /lib64/libnss_dns-2.7.so
7f4741e8d000-7f4741e9d000 rw-s 00000000 00:07 2621462 /SYSV00000401 (deleted)
7f4741e9d000-7f4741ea5000 rw-s 00000000 00:0c 669 /dev/snd/pcmC0D0p
7f4741ea5000-7f4741ea6000 rw-s 81000000 00:0c 669 /dev/snd/pcmC0D0p
7f4741ea6000-7f4741ea7000 r--s 80000000 00:0c 669 /dev/snd/pcmC0D0p
7f4741ea7000-7f4741ea8000 rw-s 00000000 00:07 2588693 /SYSV00000400 (deleted)
7f4741ea8000-7f4741eaa000 rw-p 7f4741ea8000 00:00 0
7f4741eaa000-7f4741eb1000 r--s 00000000 08:03 399901 /usr/lib64/gconv/gconv-modules.cache
7f4741eb1000-7f4741eb2000 rw-p 7f4741eb1000 00:00 0
7f4741eb2000-7f4741f12000 rw-s 00000000 00:07 2555928 /SYSV00000000 (deleted)
7f4741f12000-7f4743e4b000 r--p 00000000 08:03 587688 /usr/share/fonts/opendesktop-fonts/odosung.ttc
7f4743e4b000-7f4743e5c000 r--p 00000000 08:03 2835476 /usr/share/fonts/mathematica-fonts/Vera.ttf
7f4743e5c000-7f4743e5e000 r-xp 00000000 08:03 579812 /usr/lib64/pango/1.6.0/modules/pango-basic-fc.so
7f4743e5e000-7f474405d000 ---p 00002000 08:03 579812 /usr/lib64/pango/1.6.0/modules/pango-basic-fc.so
7f474405d000-7f474405e000 r--p 00001000 08:03 579812 /us/home/dli/bin/gnash.sh: line 12: 31215 Aborted gtk-gnash -v -F 2 -U http://www.youtube.com -P "flashvars=${var}" http://www.youtube.com/player2.swf

Dongxu Li <butdiene>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bjacques (Updated the item)
  • -unavailable- added by butdiene (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 03 Nov 2008 04:44:19 PM UTCstrkStatusWorks For Me=>Invalid
      Open/ClosedOpen=>Closed
    Sun 26 Oct 2008 09:30:52 PM UTCstrkStatusNone=>Works For Me
    Sun 26 Oct 2008 12:22:06 PM UTCbjacquesCategoryNone=>video-ffmpeg
      Severity3 - Normal=>6 - Security

    Back to the top


    Powered by Savane 3.1-cleanup1