bugGnash - The GNU Flash player - Bugs: bug #31044, memory corruption in XMLNode

 
 

bug #31044: memory corruption in XMLNode

Submitted by:  Torstein <kvikende>
Submitted on:  Wed 15 Sep 2010 02:16:32 PM UTC  
 
Category: NoneSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 02 Nov 2013 08:57:41 AM UTC, comment #5:

Ok got it, it's not marking the parent, but the parent's object.
I don't really understand why that's needed and don't see a testcase in the commit but I know calling setReachable multiple times for an as_object doesn't hurt so no problem for me.

Sandro Santilli <strk>
Project Member
Fri 01 Nov 2013 09:36:59 PM UTC, comment #4:

This bug was supposedly fixed by http://git.savannah.gnu.org/cgit/gnash.git/commit/?id=38be50cecc4648289d7a4820ad188ee7d2db4ab2

But the introduced parent-mark is in contraddition with XMLNode_a class documentation (in the header file) that says:

/// 3. The top node of an XML tree is always accessible in ActionScript, either
/// as an XML_as or a user-created XMLNode_as.
/// 4. XMLNodes consequently mark their children as reachable, but not their
/// parent.

Memory management for XMLNode object seems to be really confusing.
See also bug #40439

Sandro Santilli <strk>
Project Member
Wed 13 Oct 2010 03:09:15 PM UTC, comment #3:

A run with valgrind here showed lots of issues but none with XML (all with ffmpeg and sdl sound).

Sandro Santilli <strk>
Project Member
Mon 27 Sep 2010 08:13:50 AM UTC, comment #2:

Should be fixed in trunk. It seems the object associated with a parent node was getting deleted.

Benjamin Wolsey <bwy>
Project Member
Fri 17 Sep 2010 02:16:29 PM UTC, comment #1:

This is a memory corruption from accessing a deleted DisplayObject from XMLNode_parentNode, valgrind shows. I've misplaced my valgrind report.

Benjamin Wolsey <bwy>
Project Member
Wed 15 Sep 2010 02:16:32 PM UTC, original submission:

Hello.

I am running Firefox 4.0 Beta 5 on Fedora 13 x64 with the Gnash plug in installed.

When visiting http://code.bocoup.com/audio-data-api/flash-vs-html5/ you'll hear the late Michael Jackson play and watch him dance. However, on the right there's a button and a scrollable area. Press the play button in the scrollable area and Gnash seg. faults according to Fedora's ABRT.

Downstream bug report: https://bugzilla.redhat.com/show_bug.cgi?id=633395

Note: Due to my unfamiliarity with Savannah I managed to report this as a support ticket instead of a bug. Link: https://savannah.gnu.org/support/?107478

Sorry for that.

Torstein <kvikende>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21465:  gnashbacktrace.txt added by kvikende (232KiB - text/plain - Back trace from ABRT)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by kvikende (Submitted the item)
  • -unavailable- added by kvikende
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 12 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 02 Nov 2013 08:57:41 AM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 01 Nov 2013 09:36:59 PM UTCstrkStatusFixed=>Ready For Test
      Open/ClosedClosed=>Open
    Wed 13 Oct 2010 03:09:15 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Mon 27 Sep 2010 08:13:50 AM UTCbwyStatusConfirmed=>Ready For Test
    Fri 17 Sep 2010 02:16:29 PM UTCbwySeverity3 - Normal=>6 - Security
      StatusNone=>Confirmed
      SummaryA flash file causes seg fault #0 0x00000000016851b2 in ?? ()=>memory corruption in XMLNode
    Wed 15 Sep 2010 02:16:32 PM UTCkvikendeAttached File-=>Added gnashbacktrace.txt, #21465
      Carbon-Copy-=>Added kvikende

    Back to the top


    Powered by Savane 3.1-cleanup1