bugGnash - The GNU Flash player - Bugs: bug #42372, integer overflow from RTMP.cpp:1162

 
 

bug #42372: integer overflow from RTMP.cpp:1162

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Thu 15 May 2014 08:58:15 PM UTC  
 
Category: coreSeverity: 3 - Normal
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 16 May 2014 12:09:55 PM UTC, comment #5:

Polish added in 46367cd4cd4.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 15 May 2014 11:24:42 PM UTC, comment #4:

Given that the protocol mandates 32-bit timestamp sizes and presumably also the ms granularity, any timestamp source would eventually overflow.

In 45d6c4aaf0 I have attempted to let the overflow happen, avoiding undefined behaviour.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 15 May 2014 10:14:33 PM UTC, comment #3:

Actually, the previous comment assumes the system in question has 100 ticks per second. And even then, I miscalculated the uptime: it's actually 66 days, so the overflow is not as huge.

Not that this changes the nature of the problem, of course.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 15 May 2014 10:02:03 PM UTC, comment #2:

The problem seems to be here that getUptime() returns the uptime in milliseconds, whereas a system's uptime in ms necessarily overflows a 32-bit integer in under 50 days. In this case, the system has an uptime of over two years.

The calculated value is being used as a timestamp in RTMP messages. I wonder if we could use another source for timestamping.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 15 May 2014 08:59:35 PM UTC, comment #1:

I can't reproduce the error with ubsan. Possibly because I use a different architechture, or perhaps because my curl installation lacks RTMP support.

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.
Thu 15 May 2014 08:58:15 PM UTC, original submission:

Ubsan reported the following error, see http://gnashdev.org:8010/builders/rawhide-linux-i386/builds/332/steps/make_anal_verbose/logs/stdio :

RTMP.cpp:1162:22: runtime error: signed integer overflow: 570358355 * 1000 cannot be represented in type 'long int'

Gabriele produced this stacktrace: https://paste.debian.net/plain/99725

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #31387:  42372 added by gg0 (36KiB - application/octet-stream - backtrace)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gg0 (Updated the item)
  • -unavailable- added by bjacques (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 16 May 2014 12:09:55 PM UTCbjacquesStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 16 May 2014 10:43:55 AM UTCgg0Attached File-=>Added 42372, #31387
    Thu 15 May 2014 11:24:42 PM UTCbjacquesStatusNone=>Ready For Test
      Assigned toNone=>bjacques

    Back to the top


    Powered by Savane 3.1-cleanup1