bugGnash - The GNU Flash player - Bugs: bug #27279, Crash in std::string::size ()

 
 

bug #27279: Crash in std::string::size ()

Submitted by:  Ed Martin <edman007>
Submitted on:  Tue 18 Aug 2009 05:00:44 PM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Benjamin Wolsey <bwy>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 08 Feb 2010 03:57:14 PM UTC, comment #6:

No response.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Sun 15 Nov 2009 03:45:54 PM UTC, comment #5:

Should be fixed now.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Mon 14 Sep 2009 06:01:02 AM UTC, comment #4:

The problem arises when there is more than one AbcBlock referencing the same namespace. Namespaces are shared. Each AbcBlock sets the AbcURI of the shared namespace to its own value, so the namespace ends up with the value of the last block parsed. This is wrong, and quite likely out of bounds, for previous AbcBlocks. It's a design flaw.

We should stop storing the AbcURI in the namespace because it is expected for the same namespace to have a different URI for each ABC block. Instead, each AbcBlock could have a map of namespace to AbcURI (or something similar).

I'm not going to do it before the release. It's a security bug, but since AVM2 should be disabled by default it shouldn't affect release versions.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Mon 31 Aug 2009 05:45:27 AM UTC, comment #3:

See bug #27350 for a testcase and backtrace.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Fri 21 Aug 2009 10:09:51 AM UTC, comment #2:

It happens when Gnash loops through all namespaces and expects to find their names in the AbcBlock's string pool. It gets to a namespace whose index points to an element greater than the size of the pool.

It's not a very pretty thing to do, but as far as I can see the name should be there. Needs more investigation.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Tue 18 Aug 2009 05:25:58 PM UTC, comment #1:

Thanks, I'll look at it when I can. It's AVM2 code though, so it won't run even when the crash is fixed.

Benjamin Wolsey <bwy>
Project MemberIn charge of this item.
Tue 18 Aug 2009 05:00:44 PM UTC, original submission:

I just tried to play this url: http://www.onelight.tv/video/3edfb569d42c51d/ and it always crashes trying to play it (as soon as i "Click to Play" it crashes, and this is using the latest trunk (checked out 20 minutes ago)

Gnash trunk

Copyright (C) 2005, 2006, 2007, 2008, 2009 Free Software Foundation, Inc.
Gnash comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of Gnash under the terms of the GNU General
Public License. For more information, see the file named COPYING.

Build options trunk
Target:
Renderer: agg - GUI: GTK - Media handler: gst
Configured with: --prefix=/usr --libdir=/usr/lib64 --sysconfdir=/etc --localstatedir=/var --mandir=/usr/man --docdir=/usr/doc/gnash-bzr --enable-gui=gtk --enable-renderer=agg --enable-jemalloc --enable-media=gst --enable-avm2
CXXFLAGS: -O0 -g -fPIC -march=core2 -pthread -W -Wall -Wcast-align -Wcast-qual -Wpointer-arith -Wreturn-type -Wnon-virtual-dtor -Wunused -fvisibility-inlines-hidden
Version: .:11430
Built against gstreamer version: 0.10.24
Linked against gstreamer version: 0.10.24

Core was generated by `/usr/bin/gtk-gnash -x 37754086 -j 520 -k 320 -u http://www.onelight.tv/js/flowp'.
Program terminated with signal 11, Segmentation fault.
[New process 15787]
[New process 15789]
#0 0x00007f0763889063 in std::string::size () from /usr/lib64/../lib64/libstdc++.so.6
(gdb) bt
#0 0x00007f0763889063 in std::string::size () from /usr/lib64/../lib64/libstdc++.so.6
#1 0x00007f076594c8eb in std::operator==<char> (__lhs=@0x1dcb600, __rhs=@0x7fff6ec92a70)
at /usr/lib64/gcc/x86_64-slamd64-linux/4.3.3/../../../../include/c++/4.3.3/bits/basic_string.h:2165
#2 0x00007f0765c24da7 in gnash::AbcBlock::locateClass (this=0x1c922d0, className=@0x7fff6ec92b90) at AbcBlock.cpp:431
#3 0x00007f0765c85162 in gnash::Machine::instantiateClass (this=0x1cb1b20, className=
{static npos = 18446744073709551615, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x7fff6ec92b90 "\030ÏÖ\001"}}) at Machine.cpp:3202
#4 0x00007f0765a20152 in gnash::SWF::SymbolClassTag::execute (this=0x1df8e00, m=0x23ed000) at swf/SymbolClassTag.h:50
#5 0x00007f0765a0aa2e in gnash::MovieClip::executeFrameTags (this=0x23ed000, frame=0, dlist=@0x23ed180, typeflags=3) at MovieClip.cpp:1188
#6 0x00007f0765a0ac57 in gnash::MovieClip::stagePlacementCallback (this=0x23ed000, initObj=0x0) at MovieClip.cpp:2026
#7 0x00007f07659dff29 in gnash::SWFMovie::stagePlacementCallback (this=0x23ed000, initObj=0x0) at SWFMovie.cpp:58
#8 0x00007f07659e94cb in gnash::movie_root::setLevel (this=0x7fff6ec940c0, num=0, movie={p_ = 0x7fff6ec92eb0}) at movie_root.cpp:302
#9 0x00007f07659e9e33 in gnash::movie_root::setRootMovie (this=0x7fff6ec940c0, movie=0x23ed000) at movie_root.cpp:201
#10 0x0000000000466251 in gnash::Gui::start (this=0x1c92180) at gui.cpp:904
#11 0x00000000004664c2 in gnash::Gui::play (this=0x1c92180) at gui.cpp:827
#12 0x00000000004797bd in menuPlay (data=0x1c92180) at gtk.cpp:2652
#13 0x00007f076401472d in g_closure_invoke () from /usr/lib64/../lib64/libgobject-2.0.so.0
#14 0x00007f076402831d in ?? () from /usr/lib64/../lib64/libgobject-2.0.so.0
#15 0x00007f07640297e8 in g_signal_emit_valist () from /usr/lib64/../lib64/libgobject-2.0.so.0
#16 0x00007f0764029ce3 in g_signal_emit () from /usr/lib64/../lib64/libgobject-2.0.so.0
#17 0x00007f076478b6ed in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#18 0x00007f076401472d in g_closure_invoke () from /usr/lib64/../lib64/libgobject-2.0.so.0
#19 0x00007f0764027c38 in ?? () from /usr/lib64/../lib64/libgobject-2.0.so.0
#20 0x00007f07640297e8 in g_signal_emit_valist () from /usr/lib64/../lib64/libgobject-2.0.so.0
#21 0x00007f0764029ce3 in g_signal_emit () from /usr/lib64/../lib64/libgobject-2.0.so.0
#22 0x00007f076478a93d in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#23 0x00007f076482fda8 in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#24 0x00007f076401472d in g_closure_invoke () from /usr/lib64/../lib64/libgobject-2.0.so.0
#25 0x00007f0764027ffc in ?? () from /usr/lib64/../lib64/libgobject-2.0.so.0
#26 0x00007f076402966a in g_signal_emit_valist () from /usr/lib64/../lib64/libgobject-2.0.so.0
#27 0x00007f0764029ce3 in g_signal_emit () from /usr/lib64/../lib64/libgobject-2.0.so.0
#28 0x00007f07649329be in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#29 0x00007f0764828713 in gtk_propagate_event () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#30 0x00007f0764829833 in gtk_main_do_event () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#31 0x00007f07644b4aec in ?? () from /usr/lib64/../lib64/libgdk-x11-2.0.so.0
#32 0x00007f0763d5f28b in g_main_context_dispatch () from /usr/lib64/../lib64/libglib-2.0.so.0
#33 0x00007f0763d62a4d in ?? () from /usr/lib64/../lib64/libglib-2.0.so.0
#34 0x00007f0763d62f7d in g_main_loop_run () from /usr/lib64/../lib64/libglib-2.0.so.0
#35 0x00007f0764829c47 in gtk_main () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#36 0x000000000047ef64 in gnash::GtkGui::run (this=0x1c92180) at gtk.cpp:276
#37 0x0000000000473560 in gnash::Player::run (this=0x7fff6ec94560, argc=38, argv=0x7fff6ec94718, infile=@0x1c3f130, url=@0x73dcd8) at Player.cpp:497
#38 0x00000000004533b8 in main (argc=38, argv=0x7fff6ec94718) at gnash.cpp:480

Ed Martin <edman007>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by edman007 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 08 Feb 2010 03:57:14 PM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Sun 15 Nov 2009 03:45:54 PM UTCbwyStatusNone=>Ready For Test
    Mon 31 Aug 2009 05:45:27 AM UTCbwyCarbon-Copy-=>Added tgc
    Tue 18 Aug 2009 05:25:58 PM UTCbwySeverity3 - Normal=>6 - Security
      Assigned toNone=>bwy

    Back to the top


    Powered by Savane 3.1-cleanup1