Mon 14 Sep 2009 06:01:02 AM UTC, comment #4:
The problem arises when there is more than one AbcBlock referencing the same namespace. Namespaces are shared. Each AbcBlock sets the AbcURI of the shared namespace to its own value, so the namespace ends up with the value of the last block parsed. This is wrong, and quite likely out of bounds, for previous AbcBlocks. It's a design flaw.
We should stop storing the AbcURI in the namespace because it is expected for the same namespace to have a different URI for each ABC block. Instead, each AbcBlock could have a map of namespace to AbcURI (or something similar).
I'm not going to do it before the release. It's a security bug, but since AVM2 should be disabled by default it shouldn't affect release versions.
|
Tue 18 Aug 2009 05:00:44 PM UTC, original submission:
I just tried to play this url: http://www.onelight.tv/video/3edfb569d42c51d/ and it always crashes trying to play it (as soon as i "Click to Play" it crashes, and this is using the latest trunk (checked out 20 minutes ago)
Gnash trunk
Copyright (C) 2005, 2006, 2007, 2008, 2009 Free Software Foundation, Inc.
Gnash comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of Gnash under the terms of the GNU General
Public License. For more information, see the file named COPYING.
Build options trunk
Target:
Renderer: agg - GUI: GTK - Media handler: gst
Configured with: --prefix=/usr --libdir=/usr/lib64 --sysconfdir=/etc --localstatedir=/var --mandir=/usr/man --docdir=/usr/doc/gnash-bzr --enable-gui=gtk --enable-renderer=agg --enable-jemalloc --enable-media=gst --enable-avm2
CXXFLAGS: -O0 -g -fPIC -march=core2 -pthread -W -Wall -Wcast-align -Wcast-qual -Wpointer-arith -Wreturn-type -Wnon-virtual-dtor -Wunused -fvisibility-inlines-hidden
Version: .:11430
Built against gstreamer version: 0.10.24
Linked against gstreamer version: 0.10.24
Core was generated by `/usr/bin/gtk-gnash -x 37754086 -j 520 -k 320 -u http://www.onelight.tv/js/flowp'.
Program terminated with signal 11, Segmentation fault.
[New process 15787]
[New process 15789]
#0 0x00007f0763889063 in std::string::size () from /usr/lib64/../lib64/libstdc++.so.6
(gdb) bt
#0 0x00007f0763889063 in std::string::size () from /usr/lib64/../lib64/libstdc++.so.6
#1 0x00007f076594c8eb in std::operator==<char> (__lhs=@0x1dcb600, __rhs=@0x7fff6ec92a70)
at /usr/lib64/gcc/x86_64-slamd64-linux/4.3.3/../../../../include/c++/4.3.3/bits/basic_string.h:2165
#2 0x00007f0765c24da7 in gnash::AbcBlock::locateClass (this=0x1c922d0, className=@0x7fff6ec92b90) at AbcBlock.cpp:431
#3 0x00007f0765c85162 in gnash::Machine::instantiateClass (this=0x1cb1b20, className=
{static npos = 18446744073709551615, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x7fff6ec92b90 "\030ÏÖ\001"}}) at Machine.cpp:3202
#4 0x00007f0765a20152 in gnash::SWF::SymbolClassTag::execute (this=0x1df8e00, m=0x23ed000) at swf/SymbolClassTag.h:50
#5 0x00007f0765a0aa2e in gnash::MovieClip::executeFrameTags (this=0x23ed000, frame=0, dlist=@0x23ed180, typeflags=3) at MovieClip.cpp:1188
#6 0x00007f0765a0ac57 in gnash::MovieClip::stagePlacementCallback (this=0x23ed000, initObj=0x0) at MovieClip.cpp:2026
#7 0x00007f07659dff29 in gnash::SWFMovie::stagePlacementCallback (this=0x23ed000, initObj=0x0) at SWFMovie.cpp:58
#8 0x00007f07659e94cb in gnash::movie_root::setLevel (this=0x7fff6ec940c0, num=0, movie={p_ = 0x7fff6ec92eb0}) at movie_root.cpp:302
#9 0x00007f07659e9e33 in gnash::movie_root::setRootMovie (this=0x7fff6ec940c0, movie=0x23ed000) at movie_root.cpp:201
#10 0x0000000000466251 in gnash::Gui::start (this=0x1c92180) at gui.cpp:904
#11 0x00000000004664c2 in gnash::Gui::play (this=0x1c92180) at gui.cpp:827
#12 0x00000000004797bd in menuPlay (data=0x1c92180) at gtk.cpp:2652
#13 0x00007f076401472d in g_closure_invoke () from /usr/lib64/../lib64/libgobject-2.0.so.0
#14 0x00007f076402831d in ?? () from /usr/lib64/../lib64/libgobject-2.0.so.0
#15 0x00007f07640297e8 in g_signal_emit_valist () from /usr/lib64/../lib64/libgobject-2.0.so.0
#16 0x00007f0764029ce3 in g_signal_emit () from /usr/lib64/../lib64/libgobject-2.0.so.0
#17 0x00007f076478b6ed in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#18 0x00007f076401472d in g_closure_invoke () from /usr/lib64/../lib64/libgobject-2.0.so.0
#19 0x00007f0764027c38 in ?? () from /usr/lib64/../lib64/libgobject-2.0.so.0
#20 0x00007f07640297e8 in g_signal_emit_valist () from /usr/lib64/../lib64/libgobject-2.0.so.0
#21 0x00007f0764029ce3 in g_signal_emit () from /usr/lib64/../lib64/libgobject-2.0.so.0
#22 0x00007f076478a93d in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#23 0x00007f076482fda8 in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#24 0x00007f076401472d in g_closure_invoke () from /usr/lib64/../lib64/libgobject-2.0.so.0
#25 0x00007f0764027ffc in ?? () from /usr/lib64/../lib64/libgobject-2.0.so.0
#26 0x00007f076402966a in g_signal_emit_valist () from /usr/lib64/../lib64/libgobject-2.0.so.0
#27 0x00007f0764029ce3 in g_signal_emit () from /usr/lib64/../lib64/libgobject-2.0.so.0
#28 0x00007f07649329be in ?? () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#29 0x00007f0764828713 in gtk_propagate_event () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#30 0x00007f0764829833 in gtk_main_do_event () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#31 0x00007f07644b4aec in ?? () from /usr/lib64/../lib64/libgdk-x11-2.0.so.0
#32 0x00007f0763d5f28b in g_main_context_dispatch () from /usr/lib64/../lib64/libglib-2.0.so.0
#33 0x00007f0763d62a4d in ?? () from /usr/lib64/../lib64/libglib-2.0.so.0
#34 0x00007f0763d62f7d in g_main_loop_run () from /usr/lib64/../lib64/libglib-2.0.so.0
#35 0x00007f0764829c47 in gtk_main () from /usr/lib64/../lib64/libgtk-x11-2.0.so.0
#36 0x000000000047ef64 in gnash::GtkGui::run (this=0x1c92180) at gtk.cpp:276
#37 0x0000000000473560 in gnash::Player::run (this=0x7fff6ec94560, argc=38, argv=0x7fff6ec94718, infile=@0x1c3f130, url=@0x73dcd8) at Player.cpp:497
#38 0x00000000004533b8 in main (argc=38, argv=0x7fff6ec94718) at gnash.cpp:480
|