bugGnash - The GNU Flash player - Bugs: bug #32985, SIGSEGV in TagLoadersTable::get()

 
 

bug #32985: SIGSEGV in TagLoadersTable::get()

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Sun 03 Apr 2011 01:16:29 PM UTC
   
 
Category:  core Severity:  6 - Security
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  strk
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 08 Apr 2011 06:52:32 PM UTC, comment #1: 

3d603f00aa4be917fb6e43f2e265de885127f441 took solution (1)

Sandro Santilli <strk>
Group Member
Sun 03 Apr 2011 01:16:29 PM UTC, original submission:  

STR: see bug #32579.


Core was generated by `/home/bastiaan/gnash/obj-master-optim/gui/.libs/lt-gtk-gnash http://cdn.widgets'.
Program terminated with signal 11, Segmentation fault.
#0  _M_begin (this=0x65726168)
    at /usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_tree.h:499
499                  (this->_M_impl._M_header._M_parent);

Thread 2 (Thread 0xb77e58a0 (LWP 18534)):
#0  0x00f2e416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x44301fe6 in nanosleep () from /lib/libpthread.so.0
No symbol table info available.
#2  0x00e377b3 in gnashSleep (useconds=1000000) at /home/bastiaan/gnash/master/libbase/GnashSleep.h:42
        m = 1000000
        t = {tv_sec = 1, tv_nsec = 0}
#3  gnash::(anonymous namespace)::CurlSession::~CurlSession (this=0xe8c200, __in_chrg=<optimized out>) at /home/bastiaan/gnash/master/libbase/curl_adapter.cpp:251
        code = <optimized out>
        retries = 1
#4  0x4418eb81 in __run_exit_handlers () from /lib/libc.so.6
No symbol table info available.
#5  0x4418ec0d in exit () from /lib/libc.so.6
No symbol table info available.
#6  0x4417543b in __libc_start_main () from /lib/libc.so.6
No symbol table info available.
#7  0x080644f1 in _start ()
No symbol table info available.

Thread 1 (Thread 0x7ac6b70 (LWP 18555)):
#0  _M_begin (this=0x65726168) at /usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_tree.h:499
No locals.
#1  find (__k=<synthetic pointer>, this=0x65726168) at /usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_tree.h:1539
No locals.
#2  find (__x=<synthetic pointer>, this=0x65726168) at /usr/lib/gcc/i686-redhat-linux/4.6.0/../../../../include/c++/4.6.0/bits/stl_map.h:752
No locals.
#3  gnash::SWF::TagLoadersTable::get (this=0x65726168, t=gnash::SWF::DEFINESPRITE, lf=@0x7ac5efc) at /home/bastiaan/gnash/master/libcore/swf/TagLoadersTable.cpp:31
        it = <optimized out>
#4  0x00332779 in gnash::SWFParser::read (this=0x7ac60c0, bytes=39182) at /home/bastiaan/gnash/master/libcore/parser/SWFParser.cpp:94
        lf = 0
#5  0x003399e9 in gnash::SWFMovieDefinition::read_all_swf (this=0xb34891f0) at /home/bastiaan/gnash/master/libcore/parser/SWFMovieDefinition.cpp:476
        __PRETTY_FUNCTION__ = "void gnash::SWFMovieDefinition::read_all_swf()"
        floaded = 0
        parser = {_stream = @0xb3489108, _md = 0xb34891f0, _runResources = @0x9471e48, _bytesRead = 66896, _tagOpen = true, _endRead = 104717, _nextTagEnd = 12, _tag = gnash::SWF::DEFINESPRITE}
        left = 39182
#6  0x00339fea in gnash::SWFMovieLoader::execute (ml=..., md=0xb34891f0) at /home/bastiaan/gnash/master/libcore/parser/SWFMovieDefinition.cpp:123
No locals.
#7  0x0033b080 in operator()<void (*)(gnash::SWFMovieLoader&, gnash::SWFMovieDefinition*), boost::_bi::list0> (a=<synthetic pointer>, f=@0xb348959c, this=0xb34895a0) at /usr/include/boost/bind/bind.hpp:313
No locals.
#8  operator() (this=0xb348959c) at /usr/include/boost/bind/bind_template.hpp:20
No locals.
#9  boost::detail::thread_data<boost::_bi::bind_t<void, void (*)(gnash::SWFMovieLoader&, gnash::SWFMovieDefinition*), boost::_bi::list2<boost::reference_wrapper<gnash::SWFMovieLoader>, boost::_bi::value<gnash::SWFMovieDefinition*> > > >::run (this=0xb3489498) at /usr/include/boost/thread/detail/thread.hpp:61
No locals.
#10 0x0097144d in thread_proxy () from /usr/lib/libboost_thread-mt.so.1.46.0
No symbol table info available.
#11 0x442fac8d in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#12 0x442368fe in clone () from /lib/libc.so.6
No symbol table info available.


The problem is that RunResources are shared with the movie (definition/root) by class Player, but _runResources is destroyed when Player is, while the movie definition has a longer lifetime due to being reference counted (and apparently something else holding a reference).

This bug can be fixed in a number of ways:
1) Destroy the movie root completely in the Player destructor.
2) Transfer ownership of the RunResources to the movie root.
3) Hold the RunResources in a shared_ptr.
4) ...

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-04-08 bjacques StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2011-04-08 strk Severity3 - Normal 6 - Security
        StatusNone Ready For Test
        Assigned toNone strk

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code