bugGnash - The GNU Flash player - Bugs: bug #32950, segfault in...

 
 

bug #32950: segfault in ActionHandler::execute()

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Tue 29 Mar 2011 11:06:57 PM UTC  
 
Category: coreSeverity: 3 - Normal
Release: 0.8.9Status: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Thu 31 Mar 2011 02:29:59 PM UTC, comment #9:

Automated test added by Sandro in:
c7d1deae6e1234830584027efc16c12679afc398
c8ddc95abf782cc2fb9d35a663f5a2e106d86e10 56eb2493484f560d952dacbffa74b6e740355b21

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 31 Mar 2011 01:13:38 PM UTC, comment #8:

It is plausible that the allocation does in fact happen for 256 items, but that 256th object would not be default-constructed. So then Gnash calling a function pointer that is not initialised (because the constructor was not called) would still segfault.

Anyway, the bug is 100% reproducible, so regress-testing should be easy. The only part that needs some work is to create a SWF with an opcode == 255, and then to have the testsuite run it.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 31 Mar 2011 01:05:58 PM UTC, comment #7:

Actually I've no idea how this could be regress tested.
I guess many system would allocate 256 items anyway,
even if only 255 are asked for.
Weird that static analisys tools didn't catch this.

Sandro Santilli <strk>
Project Member
Thu 31 Mar 2011 12:53:50 PM UTC, comment #6:

I'll keep this open for discussing a potential regression test.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 31 Mar 2011 12:47:06 PM UTC, comment #5:

Can't reproduce the crash with the fix.

Hicham HAOUARI <hichamhaouari>
Project Member
Wed 30 Mar 2011 08:31:12 PM UTC, comment #4:

Works for me. Planning to add regress testing for this ?

Sandro Santilli <strk>
Project Member
Wed 30 Mar 2011 06:57:35 AM UTC, comment #3:

was in 0.8.9 too, right ? (in case we want to call for a 0.8.10 from branch for this, if it accumulates with others...)

Sandro Santilli <strk>
Project Member
Wed 30 Mar 2011 01:45:37 AM UTC, comment #2:

Fixed in c2913487c8053ab649eae6a069e43b97b050712d.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Tue 29 Mar 2011 11:10:10 PM UTC, comment #1:

The gnash invocation in the original submission didn't quite come out right, you'll want to right-click and "select all" to get it.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Tue 29 Mar 2011 11:06:57 PM UTC, original submission:

Immediately prior to the crash, the following message is printed:

ERROR: Unsupported action handler invoked, code at pc is 0xfe

ActionHandler::execute() is trying to execute a _callback which is 0.

Originally reported at https://bugzilla.redhat.com/show_bug.cgi?id=691699

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by hichamhaouari (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bjacques (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 31 Mar 2011 02:29:59 PM UTCbjacquesOpen/ClosedOpen=>Closed
    Thu 31 Mar 2011 12:53:50 PM UTCbjacquesSeverity6 - Security=>3 - Normal
      StatusReady For Test=>Fixed
    Wed 30 Mar 2011 06:57:35 AM UTCstrkReleasemaster=>0.8.9
    Wed 30 Mar 2011 01:45:37 AM UTCbjacquesStatusConfirmed=>Ready For Test
      Assigned toNone=>bjacques

    Back to the top


    Powered by Savane 3.1-cleanup1