bugGnash - The GNU Flash player - Bugs: bug #27200, Cursor position segfault

 
 

bug #27200: Cursor position segfault

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Fri 07 Aug 2009 09:06:56 AM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Bob Naugle <bobbynaugs>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 10 Aug 2009 10:32:14 AM UTC, comment #2:

Confirm fix. Thanks.

Benjamin Wolsey <bwy>
Project Member
Fri 07 Aug 2009 06:36:16 PM UTC, comment #1:

My apologies. The line that was causing this segfault was inadvertently left in from an experimental branch. The line has been removed, and the bug is now fixed.

Bob Naugle <bobbynaugs>In charge of this item.
Fri 07 Aug 2009 09:06:56 AM UTC, original submission:

The following segfaults in show_cursor when you click on

SHARE, then SEND TO A FRIEND.

I haven't looked for exactly why, but the backtrace suggested it was out-of-bounds vector access.

It seems odd that cursorRecord() returns 0 even when there are no text records, as the caller gets an invalid index. It seems more sensible to make sure the function is never called (and checking with assert(!_textRecords.empty(), which at least gives a useful error message when it crashes).

Another potential bug is that _textRecords and _recordStarts aren't the same size, which could also be asserted in that function. Again, I haven't checked.

gtk-gnash -j 448 -k 287 -U 'http://news.bbc.co.uk/2/hi/science/nature/8181233.stm' -P 'allowfullscreen=true' -P 'bgcolor=#000000' -P 'flashvars=config_settings_language=default&config=http://news.bbc.co.uk/player/emp/config/default.xml?1.3.114_2.14.10344_10753_20090720174228&playlist=http%3A%2F%2Fnews.bbc.co.uk%2Fmedia%2Femp%2F8180000%2F8182400%2F8182449.xml&embedReferer=&embedPageUrl=http://news.bbc.co.uk/2/hi/science/nature/8181233.stm&config_settings_autoPlay=false&config_settings_showPopoutButton=false&config_settings_showUpdatedInFooter=true&config_plugin_fmtjLiveStats_pageType=eav2&config_plugin_fmtjLiveStats_edition=International&preroll=http://ad.doubleclick.net/pfadx/bbccom.live.site.news/news_science_content;sectn=news;ctype=content;news=science;adsense_middle=adsense_middle;adsense_mpu=adsense_mpu;rsi=;slot=companion;sz=512x288;tile=6&companionSize=300x60&companionType=adi&companionId=bbccom_companion_8182449' -P 'height=287' -P 'id=embeddedPlayer_8182449' -P 'name=embeddedPlayer_8182449' -P 'quality=high' -P 'src=http://news.bbc.co.uk/player/emp/2.14.10344_10753/9player.swf' -P 'style=' -P 'type=application/x-shockwave-flash' -P 'width=448' -P 'wmode=default' 'http://news.bbc.co.uk/player/emp/2.14.10344_10753/9player.swf'

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bobbynaugs (Updated the item)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 10 Aug 2009 10:32:14 AM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 07 Aug 2009 06:36:16 PM UTCbobbynaugsStatusIn Progress=>Ready For Test
    Fri 07 Aug 2009 04:55:40 PM UTCbobbynaugsStatusNone=>In Progress

    Back to the top


    Powered by Savane 3.1-cleanup1