bugGnash - The GNU Flash player - Bugs: bug #32950, segfault in...

 
 

bug #32950: segfault in ActionHandler::execute()

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Tue 29 Mar 2011 11:06:57 PM UTC
   
 
Category:  core Severity:  3 - Normal
Release:  0.8.9 Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 31 Mar 2011 02:29:59 PM UTC, comment #9: 

Automated test added by Sandro in:
c7d1deae6e1234830584027efc16c12679afc398
c8ddc95abf782cc2fb9d35a663f5a2e106d86e10 56eb2493484f560d952dacbffa74b6e740355b21

Bastiaan Jacques <bjacques>
Group Member
Thu 31 Mar 2011 01:13:38 PM UTC, comment #8: 

It is plausible that the allocation does in fact happen for 256 items, but that 256th object would not be default-constructed. So then Gnash calling a function pointer that is not initialised (because the constructor was not called) would still segfault.

Anyway, the bug is 100% reproducible, so regress-testing should be easy. The only part that needs some work is to create a SWF with an opcode == 255, and then to have the testsuite run it.

Bastiaan Jacques <bjacques>
Group Member
Thu 31 Mar 2011 01:05:58 PM UTC, comment #7: 

Actually I've no idea how this could be regress tested.
I guess many system would allocate 256 items anyway,
even if only 255 are asked for.
Weird that static analisys tools didn't catch this.

Sandro Santilli <strk>
Group Member
Thu 31 Mar 2011 12:53:50 PM UTC, comment #6: 

I'll keep this open for discussing a potential regression test.

Bastiaan Jacques <bjacques>
Group Member
Thu 31 Mar 2011 12:47:06 PM UTC, comment #5: 

Can't reproduce the crash with the fix.

Hicham HAOUARI <hichamhaouari>
Group Member
Wed 30 Mar 2011 08:31:12 PM UTC, comment #4: 

Works for me. Planning to add regress testing for this ?

Sandro Santilli <strk>
Group Member
Wed 30 Mar 2011 06:57:35 AM UTC, comment #3: 

was in 0.8.9 too, right ? (in case we want to call for a 0.8.10 from branch for this, if it accumulates with others...)

Sandro Santilli <strk>
Group Member
Wed 30 Mar 2011 01:45:37 AM UTC, comment #2: 

Fixed in c2913487c8053ab649eae6a069e43b97b050712d.

Bastiaan Jacques <bjacques>
Group Member
Tue 29 Mar 2011 11:10:10 PM UTC, comment #1: 

The gnash invocation in the original submission didn't quite come out right, you'll want to right-click and "select all" to get it.

Bastiaan Jacques <bjacques>
Group Member
Tue 29 Mar 2011 11:06:57 PM UTC, original submission:  


gui/gnash http://media.easyads.bg/templates_flash/468x60.swf -P "flashvars=url=http://media.easyads.bg/displayads_click.php&framerate=25&inner=http://media.easyads.bg/ads/display_ads/296/296_322db3d54772328ef2a8fc349ecd772b.swf&params=md5checksum=K-ewtDKH0kSQ8A5oMX7BkHvTZoud8pRYjTexHFg8-9nZhklHspC8hfvMY_dZYgujsmEPUk3knboENt-2pOCMILXL59tAiWq07DyTDf3aURFYMlpZrVovynBCz1ZYHd53YE9WR586zv0tTAkVpgj0KqAgBOq0WLrDTp53yeViFSfEVbt-zZ_V6VfjB2nUBZP2BRwOddlTzmgMlwycZCdkustQcY6t_fcecCLexOrVKGQ,"


Immediately prior to the crash, the following message is printed:

ERROR: Unsupported action handler invoked, code at pc is 0xfe

#1  0x00342a31 in gnash::SWF::ActionHandler::execute (this=0xb7aa4bf4, thread=...)
    at /home/bastiaan/gnash/master/libcore/vm/ASHandlers.cpp:240
No locals.
#2  0x0034667f in gnash::SWF::SWFHandlers::execute (this=0x4d12b8, type=255, thread=...)
    at /home/bastiaan/gnash/master/libcore/vm/ASHandlers.cpp:433
No locals.
#3  0x0035a2b6 in gnash::ActionExec::operator() (this=0xbfffce20)
    at /home/bastiaan/gnash/master/libcore/vm/ActionExec.cpp:255
        action_id = 255 '\377'
        guardedChar = 0x1e
        codeVersion = 6
        __PRETTY_FUNCTION__ = "void gnash::ActionExec::operator()()"
        ash = @0x4d12b8
        clock = {<gnash::VirtualClock> = {_vptr.VirtualClock = 0x4ca9f8}, _startTime =
    1301439096970}
#4  0x001ddf07 in gnash::GlobalCode::execute (this=0xb7734b70)
    at /home/bastiaan/gnash/master/libcore/vm/ExecutableCode.h:73
        exec = {<boost::noncopyable_::noncopyable> = {<No data fields>}, code = @0xb7aabf78,
          env = @0xb7dce500, retval = 0x0, _withStack = std::vector of length 0, capacity 0,
          _scopeStack = std::vector of length 0, capacity 0, _func = 0x0, _this_ptr =
    0xbfffdeec, _initialStackSize = 0, _originalTarget = 0xb7dce3e0, _origExecSWFVersion = 8,
          _tryList = empty std::list, _returning = false, _abortOnUnload = true, pc = 28,
          next_pc = 44, stop_pc = 51}
#5  0x001d0a62 in gnash::movie_root::processActionQueue (this=0xbfffd1d8, lvl=2)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:1330
#6  0x001d0e1c in processActionQueue (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:1411
No locals.
#7  gnash::movie_root::processActionQueue (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:1400
No locals.
#8  0x001d60b0 in gnash::movie_root::advanceMovie (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:898
No locals.
#9  0x001db528 in gnash::movie_root::advance (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:832
        elapsed = <optimized out>
...


ActionHandler::execute() is trying to execute a _callback which is 0.

Originally reported at https://bugzilla.redhat.com/show_bug.cgi?id=691699

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by hichamhaouari (Posted a comment)
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-31 bjacques Open/ClosedOpen Closed
    2011-03-31 bjacques Severity6 - Security 3 - Normal
        StatusReady For Test Fixed
    2011-03-30 strk Releasemaster 0.8.9
    2011-03-30 bjacques StatusConfirmed Ready For Test
        Assigned toNone bjacques

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code