bugGnash - The GNU Flash player - Bugs: bug #26390, actionscript XMLSocket.onXML()...

 
 

bug #26390: actionscript XMLSocket.onXML() crash

Submitted by:  Ching yi, Chan <qrtt1>
Submitted on:  Wed 29 Apr 2009 12:11:59 AM UTC  
 
Category: NoneSeverity: 6 - Security
Release: trunkStatus: Fixed
Privacy: PublicAssigned to: Benjamin Wolsey <bwy>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 15 May 2009 07:53:45 AM UTC, comment #5:

we test the latest source code.
it's ok. tks.

Ching yi, Chan <qrtt1>
Fri 15 May 2009 06:58:14 AM UTC, comment #4:

Run autogen.sh, please.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Fri 15 May 2009 06:38:11 AM UTC, comment #3:

Hello Benjamin Wolsey,

I pull the source from trunk, but can not make it successly

some information is below:

qrtt1@debian:~/temp/gnash-bzr/trunk$ bzr revno
10874

libtool: link: warning: `/usr/lib/gcc/i486-linux-gnu/4.3.2/../../../../lib//libjpeg.la' seems to be moved
libtool: link: warning: `/usr/lib/gcc/i486-linux-gnu/4.3.2/../../../../lib//libgif.la' seems to be moved
libtool: link: warning: `/usr/lib/gcc/i486-linux-gnu/4.3.2/../../../../lib//libcurl.la' seems to be moved
libtool: link: warning: `/usr/lib/gcc/i486-linux-gnu/4.3.2/../../../../lib//libjpeg.la' seems to be moved
libtool: link: warning: `/usr/lib/gcc/i486-linux-gnu/4.3.2/../../../../lib//libgif.la' seems to be moved
libtool: link: warning: `/usr/lib/gcc/i486-linux-gnu/4.3.2/../../../../lib//libcurl.la' seems to be moved
ar cru .libs/libgnashasobjs.a .libs/AsBroadcaster.o .libs/Accessibility_as.o .libs/Array_as.o .libs/Boolean_as.o .libs/Camera.o .libs/ClassHierarchy.o .libs/Color_as.o .libs/ContextMenu.o .libs/CustomActions.o .libs/Date_as.o .libs/Error_as.o .libs/Global.o .libs/Key_as.o .libs/LoadVars_as.o .libs/LocalConnection_as.o .libs/Math_as.o .libs/Microphone.o .libs/Mouse_as.o .libs/NetConnection_as.o .libs/NetStream_as.o .libs/Number_as.o .libs/Object.o .libs/PlayHead.o .libs/Selection_as.o .libs/SharedObject_as.o .libs/Sound_as.o .libs/Stage_as.o .libs/System_as.o .libs/TextFormat_as.o .libs/TextSnapshot_as.o .libs/MovieClipLoader.o .libs/String_as.o .libs/XML_as.o .libs/XMLNode_as.o .libs/XMLSocket_as.o .libs/BitmapData_as.o .libs/display_pkg.o .libs/ExternalInterface_as.o .libs/external_pkg.o .libs/BevelFilter_as.o .libs/BitmapFilter_as.o .libs/DisplacementMapFilter_as.o .libs/BlurFilter_as.o .libs/ColorMatrixFilter_as.o .libs/ConvolutionFilter_as.o .libs/DropShadowFilter_as.o .libs/GlowFilter_as.o .libs/GradientBevelFilter_as.o .libs/GradientGlowFilter_as.o .libs/filters_pkg.o .libs/ColorTransform_as.o .libs/Matrix_as.o .libs/geom_pkg.o .libs/Point_as.o .libs/Rectangle_as.o .libs/Transform_as.o .libs/FileReference_as.o .libs/FileReferenceList_as.o .libs/net_pkg.o .libs/flash_pkg.o .libs/text_pkg.o .libs/TextRenderer_as.o .libs/LoadableObject.o
ranlib .libs/libgnashasobjs.a
creating libgnashasobjs.la
(cd .libs && rm -f libgnashasobjs.la && ln -s ../libgnashasobjs.la libgnashasobjs.la)
make[3]: Leaving directory `/home/qrtt1/temp/gnash-bzr/trunk/libcore/asobj'
Making all in parser
make[3]: Entering directory `/home/qrtt1/temp/gnash-bzr/trunk/libcore/parser'
/bin/sh ../../libtool --tag=CXX --mode=compile g++ -DHAVE_CONFIG_H -I. -I../.. -I../../libnet -I../../backend -I../../libcore -I../../libcore/swf -I../../libcore/parser -I../../libcore/vm -I../../libcore/asobj -I../../libbase -I../../libmedia -I../../libsound -I../../libamf -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -I/usr/include/freetype2 -pthread -I/usr/include/gstreamer-0.10 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/libxml2 -I../../libmedia/gst -g -O2 -pthread -W -Wall -Wcast-align -Wcast-qual -Wpointer-arith -Wreturn-type -Wnon-virtual-dtor -Wunused -fvisibility-inlines-hidden -MT abc_block.lo -MD -MP -MF .deps/abc_block.Tpo -c -o abc_block.lo abc_block.cpp
mkdir .libs
g++ -DHAVE_CONFIG_H -I. -I../.. -I../../libnet -I../../backend -I../../libcore -I../../libcore/swf -I../../libcore/parser -I../../libcore/vm -I../../libcore/asobj -I../../libbase -I../../libmedia -I../../libsound -I../../libamf -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -I/usr/include/freetype2 -pthread -I/usr/include/gstreamer-0.10 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/libxml2 -I../../libmedia/gst -g -O2 -pthread -W -Wall -Wcast-align -Wcast-qual -Wpointer-arith -Wreturn-type -Wnon-virtual-dtor -Wunused -fvisibility-inlines-hidden -MT abc_block.lo -MD -MP -MF .deps/abc_block.Tpo -c abc_block.cpp -fPIC -DPIC -o .libs/abc_block.o
abc_block.cpp: In member function ‘bool gnash::abc::Trait::finalize(gnash::abc_block, gnash::asClass, bool)’:
abc_block.cpp:40: error: ‘class gnash::asClass’ has no member named ‘getName’
abc_block.cpp:67: error: ‘class gnash::asClass’ has no member named ‘addValue’
abc_block.cpp:73: error: ‘class gnash::asClass’ has no member named ‘addMethod’
abc_block.cpp:80: error: ‘class gnash::asClass’ has no member named ‘addGetter’
abc_block.cpp:87: error: ‘class gnash::asClass’ has no member named ‘addSetter’
abc_block.cpp:94: error: ‘class gnash::asClass’ has no member named ‘addMemberClass’
abc_block.cpp:102: error: ‘class gnash::asClass’ has no member named ‘addSlotFunction’
abc_block.cpp: In member function ‘bool gnash::abc::Trait::finalize_mbody(gnash::abc_block, gnash::asMethod)’:
abc_block.cpp:139: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:147: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:154: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:161: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:168: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:176: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp: In member function ‘bool gnash::abc::Trait::read(gnash::SWFStream, gnash::abc_block)’:
abc_block.cpp:256: error: ‘class gnash::asClass’ has no member named ‘getName’
abc_block.cpp: In member function ‘void gnash::abc_block::prepare(gnash::Machine*)’:
abc_block.cpp:313: error: ‘initPrototype’ is not a member of ‘gnash::asClass’
abc_block.cpp:316: error: ‘initPrototype’ is not a member of ‘gnash::asClass’
abc_block.cpp:319: error: incomplete type ‘gnash::asMethod’ used in nested name specifier
abc_block.cpp: In member function ‘bool gnash::abc_block::read_method_infos()’:
abc_block.cpp:760: error: ‘class gnash::ClassHierarchy’ has no member named ‘newMethod’
abc_block.cpp:761: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:768: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:769: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:783: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:804: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:823: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:823: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:833: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp: In member function ‘bool gnash::abc_block::read_instances()’:
abc_block.cpp:919: error: ‘class gnash::asClass’ has no member named ‘setSuper’
abc_block.cpp:935: error: ‘class gnash::asClass’ has no member named ‘isFinal’
abc_block.cpp:941: error: ‘class gnash::asClass’ has no member named ‘isInterface’
abc_block.cpp:952: error: ‘class gnash::asClass’ has no member named ‘setSuper’
abc_block.cpp:960: error: ‘class gnash::asClass’ has no member named ‘setSealed’
abc_block.cpp:962: error: ‘class gnash::asClass’ has no member named ‘setFinal’
abc_block.cpp:964: error: ‘class gnash::asClass’ has no member named ‘setInterface’
abc_block.cpp:966: error: ‘class gnash::asClass’ has no member named ‘setDynamic’
abc_block.cpp:977: error: ‘class gnash::asClass’ has no member named ‘getSuper’
abc_block.cpp:978: error: ‘class gnash::asClass’ has no member named ‘getSuper’
abc_block.cpp:979: error: ‘class gnash::asClass’ has no member named ‘setProtectedNs’
abc_block.cpp:1003: error: ‘class gnash::asClass’ has no member named ‘pushInterface’
abc_block.cpp:1016: error: ‘class gnash::asClass’ has no member named ‘setConstructor’
abc_block.cpp: In member function ‘bool gnash::abc_block::read_classes()’:
abc_block.cpp:1056: error: ‘class gnash::asClass’ has no member named ‘setStaticConstructor’
abc_block.cpp: In member function ‘bool gnash::abc_block::read_scripts()’:
abc_block.cpp:1104: error: ‘class gnash::asClass’ has no member named ‘setConstructor’
abc_block.cpp:1105: error: ‘class gnash::asClass’ has no member named ‘setSuper’
abc_block.cpp:1120: error: ‘class gnash::asClass’ has no member named ‘_traits’
abc_block.cpp: In member function ‘bool gnash::abc_block::read_method_bodies()’:
abc_block.cpp:1141: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:1151: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:1158: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:1164: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp:1169: error: ‘asException’ was not declared in this scope
abc_block.cpp:1169: error: ‘pExcept’ was not declared in this scope
abc_block.cpp:1169: error: ‘class gnash::ClassHierarchy’ has no member named ‘newException’
abc_block.cpp: In member function ‘bool gnash::abc_block::read(gnash::SWFStream&)’:
abc_block.cpp:1274: error: invalid use of incomplete type ‘struct gnash::asMethod’
abc_block.h:41: error: forward declaration of ‘struct gnash::asMethod’
abc_block.cpp: In member function ‘gnash::asClass* gnash::abc_block::locateClass(const std::string&)’:
abc_block.cpp:1304: error: ‘class gnash::asClass’ has no member named ‘getName’
abc_block.cpp:1320: error: ‘class gnash::asClass’ has no member named ‘getName’
abc_block.cpp:1321: error: ‘class gnash::asClass’ has no member named ‘getName’
make[3]: *** [abc_block.lo] Error 1
make[3]: Leaving directory `/home/qrtt1/temp/gnash-bzr/trunk/libcore/parser'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/home/qrtt1/temp/gnash-bzr/trunk/libcore'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/qrtt1/temp/gnash-bzr/trunk'
make: *** [all] Error 2

Ching yi, Chan <qrtt1>
Thu 14 May 2009 04:13:56 PM UTC, comment #2:

The GC was cleaning up the XML object prototype. It should be fixed with revision 10874.

Please report any other bugs you find with XMLSocket, as we don't have many automated tests for it!

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Thu 14 May 2009 03:51:50 PM UTC, comment #1:

Thank you for this excellent bug report. It is a GC problem, fix should come soon.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Wed 29 Apr 2009 12:11:59 AM UTC, original submission:

We find the problem that XMLSocket.onXML() will crash
when XMLSocket_as.cpp call new XML_as(xmlin)

two attachments submition:

1. sample.swf (implements XMLSocket.onXML() to receive data)
2. s2.c (a simple socket server to send "<xml></xml>")

gdb bt messages:
========================================================================================
Starting program: /home/qrtt1/app/gnash-bzr/bin/gtk-gnash sample.swf
[Thread debugging using libthread_db enabled]
[New Thread 0xb64e7a20 (LWP 5528)]
[New Thread 0xb635bb90 (LWP 5534)]
[New Thread 0xb4652b90 (LWP 5535)]
[Thread 0xb4652b90 (LWP 5535) exited]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb64e7a20 (LWP 5528)]
0xb71cd754 in std::runtime_error::~runtime_error () from /usr/lib/libstdc++.so.6
(gdb) bt
#0 0xb71cd754 in std::runtime_error::~runtime_error () from /usr/lib/libstdc++.so.6
#1 0xb7963898 in ~ActionTypeError (this=0xa0e6408) at ../../libbase/GnashException.h:44
#2 0xb7971abc in gnash::as_value::set_as_object (this=0xbfa8dcc4, obj=0xa0e6408) at as_value.cpp:1140
#3 0xb7971ba9 in as_value (this=0xbfa8dcc4, obj=0xa0e6408) at as_value.cpp:1826
#4 0xb796a0ad in as_object (this=0xb3d0ca80, proto=0xa0e6408) at as_object.cpp:1078
#5 0xb7add914 in XML_as (this=0xb3d0ca38, xml=@0xbfa8ddd8) at XML_as.cpp:101
#6 0xb7ae6949 in xmlsocket_onData (fn=@0xbfa8deb0) at XMLSocket_as.cpp:376
#7 0xb79631e0 in gnash::builtin_function::operator() (this=0xb3d0a628, fn=@0xbfa8deb0) at ../../libcore/builtin_function.h:102
#8 0xb7ae7d67 in gnash::XMLSocket_as::checkForIncomingData (this=0xb3d0aaf8) at ../../libcore/as_function.h:73
#9 0xb7ae8c53 in gnash::XMLSocket_as::advanceState (this=0xffffffff) at XMLSocket_as.cpp:76
#10 0xb79bbe02 in gnash::movie_root::executeAdvanceCallbacks (this=0xbfa8e1d0) at /usr/include/c++/4.3/bits/stl_function.h:525
#11 0xb79bed26 in gnash::movie_root::advance (this=0xbfa8e1d0) at movie_root.cpp:1035
#12 0x0807883d in gnash::Gui::advanceMovie (this=0x9f63250) at gui.cpp:946
#13 0xb729a906 in ?? () from /usr/lib/libglib-2.0.so.0
#14 0x09f63250 in ?? ()
#15 0x0a0e3d50 in ?? ()
#16 0xbfa8dff8 in ?? ()
#17 0xb7299a28 in ?? () from /usr/lib/libglib-2.0.so.0
#18 0xb7315804 in ?? () from /usr/lib/libglib-2.0.so.0
#19 0x0a0e3d50 in ?? ()
#20 0xbfa8e008 in ?? ()
#21 0xb7315240 in ?? () from /usr/lib/libglib-2.0.so.0
#22 0xb7315240 in ?? () from /usr/lib/libglib-2.0.so.0
#23 0xbfa8e03c in ?? ()
#24 0xbfa8e058 in ?? ()
#25 0xb729a1d8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
Backtrace stopped: frame did not save the PC

libstdc++:
test in debian:
qrtt1@debian:~/Desktop$ dpkg --list |grep libstdc
ii libstdc++6 4.3.2-1.1 The GNU Standard C++ Library v3
ii libstdc++6-4.3-dev 4.3.2-1.1 The GNU Standard C++ Library v3 (development files)

test in ubuntu:
chenpoming@chenpoming-laptop:~/App/gnash-trunk/bin$ dpkg --list |grep libstdc
ii libstdc++6 4.3.2-1ubuntu12 The GNU Standard C++ Library v3
ii libstdc++6-4.3-dev 4.3.2-1ubuntu12 The GNU Standard C++ Library v3 (development

gnash revision:

qrtt1@debian:~/temp/gnash-bzr/trunk$ bzr log|head
------------------------------------------------------------
revno: 10851
committer: Markus Gothe <nietzsche@lysator.liu.se>
branch nick: trunk
timestamp: Sun 2009-04-26 23:31:52 +0200
message:
revert back to HAS_PYTHON so I don't break anyting
------------------------------------------------------------

configuration args:
--prefix=/home/qrtt1/app/gnash-bzr --enable-debugger --enable-gui=gtk

Ching yi, Chan <qrtt1>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #18048:  s2.c added by qrtt1 (1KiB - text/x-csrc)
file #18049:  sample.swf added by qrtt1 (619B - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by qrtt1 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 15 May 2009 08:09:20 AM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Thu 14 May 2009 04:14:07 PM UTCbwySeverity3 - Normal=>6 - Security
    Thu 14 May 2009 04:13:56 PM UTCbwyStatusConfirmed=>Ready For Test
    Thu 14 May 2009 03:51:50 PM UTCbwyStatusNone=>Confirmed
      Assigned toNone=>bwy
    Wed 29 Apr 2009 12:11:59 AM UTCqrtt1Attached File-=>Added s2.c, #18048
      Attached File-=>Added sample.swf, #18049

    Back to the top


    Powered by Savane 3.1-cleanup1