bugGnash - The GNU Flash player - Bugs: bug #29811, Segfault in...

 
 

bug #29811: Segfault in gnash::sound::sound_handler::fetchSamples

Submitted by:  Jerry James <jjames>
Submitted on:  Thu 06 May 2010 05:18:38 PM UTC  
 
Category: sound-gstSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 07 Mar 2011 02:34:05 PM UTC, comment #14:

Then I will close it!

Benjamin Wolsey <bwy>
Project Member
Sat 05 Mar 2011 05:03:41 PM UTC, comment #13:

I'm happy with closing.

Sandro Santilli <strk>
Project Member
Sat 05 Mar 2011 05:01:43 PM UTC, comment #12:

I propose closing this as fixed if no one knows how to reproduce it. Please let me know if anyone objects.

Benjamin Wolsey <bwy>
Project Member
Sat 05 Mar 2011 12:26:59 PM UTC, comment #11:

The launcher script is still valid, but I can't reproduce a segfault with 0.8.6, 0.8.7 or trunk.

Benjamin Wolsey <bwy>
Project Member
Fri 04 Mar 2011 04:15:50 PM UTC, comment #10:

The URL that originally provoked the crash is no longer available. Does somebody have it stashed away somewhere, or else another reproducer I can try?

Jerry James <jjames>
Fri 04 Mar 2011 09:37:11 AM UTC, comment #9:

Segfaults are high security severity...

Sandro Santilli <strk>
Project Member
Fri 04 Mar 2011 09:36:50 AM UTC, comment #8:

Please file another bug for the missing transparency. This one was for the segfault, let's call it closed.
Jerry can you confirm ?

Sandro Santilli <strk>
Project Member
Thu 03 Mar 2011 11:09:10 PM UTC, comment #7:

The FFMPEG issue is now fixed, thanks to Benjamin.

The next problem seems to be that the video does not appear to be composited correctly onto the rest of graphics: the pixels that (presumably) should be translucent are actually opaque black.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 03 Mar 2011 01:13:36 AM UTC, comment #6:

I think the segfault should be fixed in master.

As for the video messages, they occur because the SWF tries to play a VP6a video, which Gstreamer is not able to play until gst-ffmpeg 0.10.12 (as yet unreleased).

As for the FFMPEG video handler, it is able to decode the image. It decodes to RGBA, which is all fine, but this code in VideoDecoderFfmpeg.cpp is dependent on PIX_FMT_RGBA being defined, and in recent ffmpeg, it is not a define but part of an enum. So video playback fails. Doh!

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Fri 07 May 2010 04:42:13 PM UTC, comment #5:

I'm using these versions:

gstreamer-0.10.28-2.fc12.x86_64
gnash-0.8.7-1.fc12.x86_64

I have a core dump, if that would be helpful. It's about 61 Mbytes.

Jerry James <jjames>
Fri 07 May 2010 02:37:16 PM UTC, comment #4:

I can't reproduce the segfault.

The backtrace shows an interesting bit:

#0 0x00000030e5c0cc4a in gnash::sound::sound_handler::fetchSamples (this=
0x1642c00, to=0x1763000, nSamples=2048) at sound_handler.cpp:571
is = 0x1
wrote = <value optimized out>
finalVolumeFact = <value optimized out>

The value for pointer `is' looks dodgy.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Fri 07 May 2010 06:43:26 AM UTC, comment #3:

Sounds like an issue with your gstreamer.
Which version of it are you using? And which version of gnash ?

I'm using the ffmpeg handler so can't reproduce right now.
Bastiaan, can you ?

Sandro Santilli <strk>
Project Member
Fri 07 May 2010 04:21:23 AM UTC, comment #2:

I ran the launcher. It has not segfaulted. I am seeing lots of lines like this:

(gtk-gnash:3420): GStreamer-CRITICAL **: gst_pad_alloc_buffer_full: assertion `size >= 0' failed

and one place where it says this:

error -4 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -4 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing

but no segfaults.

Jerry James <jjames>
Thu 06 May 2010 05:59:12 PM UTC, comment #1:

I attach a launcher for the bug.
Works fine for me, does it still abort for you Jerry ?

(file #20472)

Sandro Santilli <strk>
Project Member
Thu 06 May 2010 05:18:38 PM UTC, original submission:

I am running Fedora 12 on an x86_64 platform. ABRT popped up to inform me of this crash while I was browsing the web. I didn't notice anything happen in the browser, so this was probably some advertisement that I wasn't even paying attention to.

I have gnash-1:0.8.7-1.fc12.x86_64 installed. This has been reported downstream as https://bugzilla.redhat.com/show_bug.cgi?id=587129.

Jerry James <jjames>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20472:  bug29811.sh added by strk (2KiB - text/x-sh)
file #20470:  gnash_backtrace added by jjames (41KiB - application/octet-stream - Backtrace)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by jjames (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 07 Mar 2011 02:34:05 PM UTCbwyStatusReady For Test=>Fixed
      Assigned toNone=>bjacques
      Open/ClosedOpen=>Closed
    Fri 04 Mar 2011 09:37:11 AM UTCstrkSeverity3 - Normal=>6 - Security
    Fri 04 Mar 2011 09:36:50 AM UTCstrkStatusNone=>Ready For Test
    Fri 07 May 2010 06:43:26 AM UTCstrkCategorysound=>sound-gst
    Thu 06 May 2010 05:59:12 PM UTCstrkAttached File-=>Added bug29811.sh, #20472
    Thu 06 May 2010 05:18:38 PM UTCjjamesAttached File-=>Added gnash_backtrace, #20470

    Back to the top


    Powered by Savane 3.1-cleanup1