Sat 13 Jul 2013 10:17:28 PM UTC, comment #6:
I've committed a testcase in e93616f79c that will show (if you try to) that an empty action should not hide a later, non-empty action.
As for the fix, I realised it is silly to read a further byte, and then to create an empty action buffer, if the event length is zero.
Fixed in 9a68f3e0.
|
Sat 29 Oct 2011 06:37:47 PM UTC, comment #2:
Analysis:
In readPlaceActions(SWFStream& in), when event_length is first read, it is zero. A key press event is detected, so event_length is reduced by one. event_length is unsigned, so it becomes a very large number. This amount is then passed on to action_buffer::read(), leading, if you are lucky, to an abort.
|
Sat 29 Oct 2011 04:53:34 PM UTC, original submission:
Downstream bug is https://bugzilla.redhat.com/show_bug.cgi?id=702348 ; although my backtrace is a bit different.
STR: gui/gnash http://ads.standartnews.com/www/images/fibank_berbo_yes_728x90_wo_cyr.swf
Note the value of event_length in the below trace.
#3 0x0000003f7162ef62 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4 0x00007ffff7b37fe5 in gnash::action_buffer::read (this=0x7fffed4c1150, in=..., endPos=4294975083) at ../../../gnash/libcore/parser/action_buffer.cpp:52
startPos = 7788
_PRETTY_FUNCTION_ = "void gnash::action_buffer::read(gnash::SWFStream&, long unsigned int)"
size = 32767
buf = 0x7fffed4c1150 ""
#5 0x00007ffff79fbe95 in gnash::SWF::PlaceObject2Tag::readPlaceActions (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:178
flags = 26889728
action = {_M_ptr = 0x7fffed4c1150}
total_known_events = 19
event_length = 4294967295
ch = gnash::key::INVALID
s_code_bits = {gnash::event_id::LOAD, gnash::event_id::ENTER_FRAME, gnash::event_id::UNLOAD, gnash::event_id::MOUSE_MOVE, gnash::event_id::MOUSE_DOWN,
gnash::event_id::MOUSE_UP, gnash::event_id::KEY_DOWN, gnash::event_id::KEY_UP, gnash::event_id::DATA, gnash::event_id::INITIALIZE, gnash::event_id::PRESS,
gnash::event_id::RELEASE, gnash::event_id::RELEASE_OUTSIDE, gnash::event_id::ROLL_OVER, gnash::event_id::ROLL_OUT, gnash::event_id::DRAG_OVER,
gnash::event_id::DRAG_OUT, gnash::event_id::KEY_PRESS, gnash::event_id::CONSTRUCT}
movie_version = 8
reserved = 0
all_event_flags = 2048
#6 0x00007ffff79fc355 in gnash::SWF::PlaceObject2Tag::readPlaceObject2 (this=0x7fffed426430, in=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:299
No locals.
#7 0x00007ffff79fcc65 in gnash::SWF::PlaceObject2Tag::read (this=0x7fffed426430, in=..., tag=gnash::SWF::PLACEOBJECT2)
at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:439
No locals.
#8 0x00007ffff79fce9d in gnash::SWF::PlaceObject2Tag::loader (in=..., tag=gnash::SWF::PLACEOBJECT2, m=...) at ../../gnash/libcore/swf/PlaceObject2Tag.cpp:482
_PRETTY_FUNCTION_ =
"static void gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, const gnash::RunResources&)"
ch = {px = 0x7fffed426430}
#9 0x00007ffff7b3d140 in gnash::SWFParser::read (this=0x7fffe99bba60, bytes=40079) at ../../../gnash/libcore/parser/SWFParser.cpp:96
lf = 0x7ffff79fce04 <gnash::SWF::PlaceObject2Tag::loader(gnash::SWFStream&, gnash::SWF::TagType, gnash::movie_definition&, gnash::RunResources const&)>
startPos = 7701
tagLoaders = @0x7ffff4b564f0
#10 0x00007ffff7b4284f in gnash::SWFMovieDefinition::read_all_swf (this=0x7fffed49b000) at ../../../gnash/libcore/parser/SWFMovieDefinition.cpp:477
_PRETTY_FUNCTION_ = "void gnash::SWFMovieDefinition::read_all_swf()"
startPos = 21
|