bugGnash - The GNU Flash player - Bugs: bug #27478, flvdumper crashes with SIGABRT

 
 

bug #27478: flvdumper crashes with SIGABRT

Submitted by:  Ildar Isaev <iisaev>
Submitted on:  Fri 18 Sep 2009 12:30:49 PM UTC  
 
Category: utilitiesSeverity: 3 - Normal
Release: trunkStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 18 Oct 2009 04:35:55 PM UTC, comment #1:

Thanks for the report!

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Fri 18 Sep 2009 12:30:49 PM UTC, original submission:

It is possible to create an input file (see the attach) which causes flvdumper (from gnash-0.8.6) to crash after receiving SIGABRT due to the assertion failure in boost.

This is how gdb output looks:

user@machine:$ gdb --args <gnash_inst_dir>/bin/flvdumper -a exploit_1
...
This GDB was configured as "i486-linux-gnu"...
(gdb) run
Starting program: /space/iisaev/avalanche/bzr_gnash/trunk/inst/bin/flvdumper -a exploit_1
[Thread debugging using libthread_db enabled]
FLV File type: Video
FLV Version: 1 (should always be 1)
FLV Header size: 589824 (should always be 9)
FLV Previous Tag Size was: 0
No properties
FLV Tag size is: 10485764
FLV Tag type is: MetaData
flvdumper: /usr/include/boost/shared_ptr.hpp:315: T* boost::shared_ptr<T>::operator->() const [with T = amf::Element]: Assertion `px != 0' failed.
[New Thread 0x409f6160 (LWP 5002)]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x409f6160 (LWP 5002)]
0x4001e430 in __kernel_vsyscall ()
(gdb) bt
#0 0x4001e430 in __kernel_vsyscall ()
#1 0x4022c6d0 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0x4022e098 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0x402255ce in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#4 0x4004ddfe in amf::Flv::decodeMetaData (this=0xbf82d61c, buf=0x9d00000 "", size=10485760)
at /usr/include/boost/shared_ptr.hpp:315
#5 0x0804cdb5 in main at flvdumper.cpp:281
(gdb) up
#1 0x4022c6d0 in raise () from /lib/tls/i686/cmov/libc.so.6
(gdb) up
#2 0x4022e098 in abort () from /lib/tls/i686/cmov/libc.so.6
(gdb) up
#3 0x402255ce in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
(gdb) up
#4 0x4004ddfe in amf::Flv::decodeMetaData (this=0xbf82d61c, buf=0x9d00000 "", size=10485760)
at /usr/include/boost/shared_ptr.hpp:315
315 BOOST_ASSERT(px != 0);
(gdb) list
310 return *px;
311 }
312
313 T * operator-> () const // never throws
314 {
315 BOOST_ASSERT(px != 0);
316 return px;
317 }
318
319 T * get() const // never throws

The same bug may be reproduced on the version from the trunk.

Ildar Isaev <iisaev>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #18733:  exploit_1 added by iisaev (712B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by iisaev (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 18 Oct 2009 04:35:55 PM UTCbjacquesOpen/ClosedOpen=>Closed
      StatusNone=>Fixed
      Assigned toNone=>bjacques
    Fri 18 Sep 2009 12:30:49 PM UTCiisaevAttached File-=>Added exploit_1, #18733

    Back to the top


    Powered by Savane 3.1-cleanup1