bugGnash - The GNU Flash player - Bugs: bug #24653, Segfault in plugin

 
 

bug #24653: Segfault in plugin

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Sun 26 Oct 2008 01:05:12 PM UTC  
 
Category: pluginSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 04 Mar 2009 09:05:46 PM UTC, comment #6:

For the record, bjacques found this:
https://bugzilla.mozilla.org/show_bug.cgi?id=320888
(plugin's NewStream func is called twice)

Sandro Santilli <strk>
Project Member
Tue 03 Mar 2009 10:38:13 AM UTC, comment #5:

There was a probable fix on 2009-03-02.

Benjamin Wolsey <bwy>
Project Member
Wed 11 Feb 2009 11:02:10 AM UTC, comment #4:

Since I've upgraded the browser, here's new version:

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6

Still crashes.

Sandro Santilli <strk>
Project Member
Wed 21 Jan 2009 10:59:56 AM UTC, comment #3:

Ok, I confirm it happens for me with:

- Epiphany 2.24.1 (64bit)
- Firefox 1.9.0.5 (64bit)

Sandro Santilli <strk>
Project Member
Wed 21 Jan 2009 10:56:20 AM UTC, comment #2:

Note that at least for the X problem, we can improve
predictability by XSyncing any X operation so that it happens
sincronously. The error message coming from X suggests to
pass --xsync (or was it --sync?) to argv, but gnash eats those
and doesn't let them go up to Gui initialization.
There might be another way to force that from within the Gtk
gui but I don't know it.

Sandro Santilli <strk>
Project Member
Wed 21 Jan 2009 10:48:31 AM UTC, comment #1:

Sometimes the symptom is an X-window error, not what's described below.

http://www.tagesschau.de is the most reliable crash for me, whenever the small video widget appears at the top right (certain times of day only).

Benjamin Wolsey <bwy>
Project Member
Sun 26 Oct 2008 01:05:12 PM UTC, original submission:

Shutting down the plugin with xulrunner1.9 results in an illegal read.

The handlePlayerRequestWrapper is still called after the plugin has been destroyed with NPP_Destroy, as valgrind shows.

It might be a xulrunner bug, or perhaps we aren't removing the g_io_channel watch properly. It's a security bug if it's our fault.

It's not a problem with pre-xulrunner epiphany.

==6002==
==6002== Invalid read of size 4
==6002== at 0x1F8F7C68: nsPluginInstance::handlePlayerRequests(_GIOChannel*, GIOCondition) (plugin.cpp:739)
==6002== by 0x1F8F7EA6: nsPluginInstance::handlePlayerRequestsWrapper(_GIOChannel, GIOCondition, nsPluginInstance) (plugin.cpp:728)
==6002== by 0xAA5F8D1: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.1800.1)
==6002== by 0xAA6305C: (within /usr/lib64/libglib-2.0.so.0.1800.1)
==6002== by 0xAA6321A: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.1800.1)
==6002== by 0x77C685C: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x77C6B9F: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x78B807C: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x787638B: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x77C6C70: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x763BEC2: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x6E7E15B: XRE_main (in /usr/lib64/xulrunner-1.9/libxul.so)
==6002== Address 0x1c8b46e8 is 160 bytes inside a block of size 192 free'd
==6002== at 0x4C1FB6D: operator delete(void*) (vg_replace_malloc.c:342)
==6002== by 0x1F8F8274: nsPluginInstance::~nsPluginInstance() (plugin.cpp:478)
==6002== by 0x1F8F6179: NS_DestroyPluginInstance(nsPluginInstanceBase*) (plugin.cpp:406)
==6002== by 0x1F8FBAA5: NPP_Destroy (npp_gate.cpp:67)
==6002== by 0x76B9D1B: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x70BE6CE: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002== by 0x70BE85F: (within /usr/lib64/xulrunner-

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 12 Mar 2009 10:55:36 PM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Tue 03 Mar 2009 09:24:56 AM UTCstrkStatusConfirmed=>Ready For Test
    Wed 21 Jan 2009 10:56:20 AM UTCstrkStatusNone=>Confirmed
    Tue 18 Nov 2008 04:38:23 PM UTCstrkCategoryNone=>plugin

    Back to the top


    Powered by Savane 3.1-cleanup1