bugGnash - The GNU Flash player - Bugs: bug #32732, Assertion `std::ftell(_data) ==...

 
 

bug #32732: Assertion `std::ftell(_data) == pos' failed. in tu_file.cpp:182

Submitted by:  Sandro Santilli <strk>
Submitted on:  Wed 09 Mar 2011 10:44:58 PM UTC  
 
Category: video-ffmpegSeverity: 5 - Blocker
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 11 Mar 2011 03:59:14 PM UTC, comment #9:

Fixed by 1163866db47b0177d0dd894dc5e50ccc5cf9734b

Sandro Santilli <strk>
Project Member
Thu 10 Mar 2011 04:12:04 PM UTC, comment #8:

> Isn't 4294990684 the numerical value that string::npos evaluates to on a 32bit machine ?


No. npos is numeric_limits<unsigned int>::max(), which is 4294967295. The offset in question is thus greater than the maximum value of an unsigned int.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 10 Mar 2011 11:22:38 AM UTC, comment #7:

Ah! Then this is a simple case of buffer overflow.

I think the bug is in tu_file::seek(std::streampos pos).

On your 64-bit machine size_t is a 64-bit integer, so that the following line:

if (static_cast<size_t>(pos) > size()) return false;

actually returns false, because the file size is too large. So that's why you can't reproduce the assertion on the 64-bit machine.

On the 32-bit machine, the 64-bit integer (std::streampos) overflows in the static_cast to size_t, which is 32-bits. It then becomes a relatively small number, which is a reasonable number for a file size.

In the call to fseek, the integer again gets cast to a long (32-bit), again turning it into a small number.

A little while later the assertion compares the original streampos (a very large number) to the current file position, and lo and behold, it is not where it is supposed to be.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 10 Mar 2011 08:18:45 AM UTC, comment #6:

@bjacques is the other way around: I can only reproduce on the 32bit system, so rob's a good point.

Sandro Santilli <strk>
Project Member
Thu 10 Mar 2011 01:02:41 AM UTC, comment #5:

Sandro is only able to reproduce this issue on his 64-bit machine.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Wed 09 Mar 2011 11:05:46 PM UTC, comment #4:

Isn't 4294990684 the numerical value that string::npos evaluates to on a 32bit machine ?

Rob Savoye <rsavoye>
Project Administrator
Wed 09 Mar 2011 10:55:09 PM UTC, comment #3:

Actually, tu_file::seek() checks that the offset is less than size(), so that theory goes out the window.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Wed 09 Mar 2011 10:52:19 PM UTC, comment #2:

4294990684 seems like an unreasonably large offset. The easy way to fix would be to check that offset < stream->size().

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Wed 09 Mar 2011 10:46:43 PM UTC, comment #1:

For the record, my snow.mpg file md5: 310a5779e53cf4fa13298876aa64804c

Sandro Santilli <strk>
Project Member
Wed 09 Mar 2011 10:44:58 PM UTC, original submission:

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb7d51b70 (LWP 23388)]
0x0012d422 in __kernel_vsyscall ()
(gdb) bt
#0 0x0012d422 in __kernel_vsyscall ()
#1 0x0138d651 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2 0x01390a82 in *__GI_abort () at abort.c:92
#3 0x01386718 in *__GI___assert_fail (assertion=0xa675d6 "std::ftell(_data) == pos",
file=0xa70dfc "../../gnash-git/libbase/tu_file.cpp", line=182,
function=0xa716a0 "virtual bool gnash::tu_file::seek(std::streampos)") at assert.c:81
#4 0x00a4171b in gnash::tu_file::seek (this=0x8269d30, pos=...) at ../../gnash-git/libbase/tu_file.cpp:182
#5 0x009b672b in gnash::media::ffmpeg::MediaParserFfmpeg::seekMedia (this=0x8209800, offset=4294990684, whence=0)
at ../../gnash-git/libmedia/ffmpeg/MediaParserFfmpeg.cpp:561
#6 0x009b6b32 in gnash::media::ffmpeg::MediaParserFfmpeg::seekMediaWrapper (opaque=0x8209800, offset=4295434624,
whence=0) at ../../gnash-git/libmedia/ffmpeg/MediaParserFfmpeg.cpp:59
#7 0x02251c35 in ?? () from /usr/lib/i686/cmov/libavformat.so.52

The above was running gui/gtk-gnash easyvideo.swf with Gnash 0.8.9dev (master-19991-f07c4e9).

media.flv (loaded by easyvideo.swf) is a symlink to snow.mpg (the infamous snow plugin demo). I could not reproduce the same problem on the 64bit machine. This one is linux-lucid-x86 (the buildbot slave).

Sandro Santilli <strk>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 11 Mar 2011 03:59:14 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Thu 10 Mar 2011 02:19:24 PM UTCbjacquesStatusNone=>Ready For Test
      Assigned toNone=>bjacques

    Back to the top


    Powered by Savane 3.1-cleanup1