bugGnash - The GNU Flash player - Bugs: bug #24653, Segfault in plugin

 
 

bug #24653: Segfault in plugin

Submitter:  Benjamin Wolsey <bwy>
Submitted:  Sun 26 Oct 2008 01:05:12 PM UTC
   
 
Category:  plugin Severity:  6 - Security
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 04 Mar 2009 09:05:46 PM UTC, comment #6: 

For the record, bjacques found this:
https://bugzilla.mozilla.org/show_bug.cgi?id=320888
(plugin's NewStream func is called twice)

Sandro Santilli <strk>
Group Member
Tue 03 Mar 2009 10:38:13 AM UTC, comment #5: 

There was a probable fix on 2009-03-02.

Benjamin Wolsey <bwy>
Group Member
Wed 11 Feb 2009 11:02:10 AM UTC, comment #4: 

Since I've upgraded the browser, here's new version:

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6

Still crashes.

Sandro Santilli <strk>
Group Member
Wed 21 Jan 2009 10:59:56 AM UTC, comment #3: 

Ok, I confirm it happens for me with:

- Epiphany 2.24.1 (64bit)
- Firefox 1.9.0.5 (64bit)

Sandro Santilli <strk>
Group Member
Wed 21 Jan 2009 10:56:20 AM UTC, comment #2: 

Note that at least for the X problem, we can improve
predictability by XSyncing any X operation so that it happens
sincronously. The error message coming from X suggests to
pass --xsync (or was it --sync?) to argv, but gnash eats those
and doesn't let them go up to Gui initialization.
There might be another way to force that from within the Gtk
gui but I don't know it.

Sandro Santilli <strk>
Group Member
Wed 21 Jan 2009 10:48:31 AM UTC, comment #1: 

Sometimes the symptom is an X-window error, not what's described below.

http://www.tagesschau.de is the most reliable crash for me, whenever the small video widget appears at the top right (certain times of day only).

Benjamin Wolsey <bwy>
Group Member
Sun 26 Oct 2008 01:05:12 PM UTC, original submission:  

Shutting down the plugin with xulrunner1.9 results in an illegal read.

The handlePlayerRequestWrapper is still called after the plugin has been destroyed with NPP_Destroy, as valgrind shows.

It might be a xulrunner bug, or perhaps we aren't removing the g_io_channel watch properly. It's a security bug if it's our fault.

It's not a problem with pre-xulrunner epiphany.

==6002==
==6002== Invalid read of size 4
==6002==    at 0x1F8F7C68: nsPluginInstance::handlePlayerRequests(_GIOChannel*, GIOCondition) (plugin.cpp:739)
==6002==    by 0x1F8F7EA6: nsPluginInstance::handlePlayerRequestsWrapper(_GIOChannel*, GIOCondition, nsPluginInstance*) (plugin.cpp:728)
==6002==    by 0xAA5F8D1: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.1800.1)
==6002==    by 0xAA6305C: (within /usr/lib64/libglib-2.0.so.0.1800.1)
==6002==    by 0xAA6321A: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.1800.1)
==6002==    by 0x77C685C: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x77C6B9F: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x78B807C: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x787638B: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x77C6C70: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x763BEC2: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x6E7E15B: XRE_main (in /usr/lib64/xulrunner-1.9/libxul.so)
==6002==  Address 0x1c8b46e8 is 160 bytes inside a block of size 192 free'd
==6002==    at 0x4C1FB6D: operator delete(void*) (vg_replace_malloc.c:342)
==6002==    by 0x1F8F8274: nsPluginInstance::~nsPluginInstance() (plugin.cpp:478)
==6002==    by 0x1F8F6179: NS_DestroyPluginInstance(nsPluginInstanceBase*) (plugin.cpp:406)
==6002==    by 0x1F8FBAA5: NPP_Destroy (npp_gate.cpp:67)
==6002==    by 0x76B9D1B: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x70BE6CE: (within /usr/lib64/xulrunner-1.9/libxul.so)
==6002==    by 0x70BE85F: (within /usr/lib64/xulrunner-

Benjamin Wolsey <bwy>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Updated the item)
  • -email is unavailable- added by bwy (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-03-12 bwy StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2009-03-03 strk StatusConfirmed Ready For Test
    2009-01-21 strk StatusNone Confirmed
    2008-11-18 strk CategoryNone plugin

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code