bugGnash - The GNU Flash player - Bugs: bug #29811, Segfault in...

 
 

bug #29811: Segfault in gnash::sound::sound_handler::fetchSamples

Submitter:  Jerry James <jjames>
Submitted:  Thu 06 May 2010 05:18:38 PM UTC
   
 
Category:  sound-gst Severity:  6 - Security
Release:  None Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 07 Mar 2011 02:34:05 PM UTC, comment #14: 

Then I will close it!

Benjamin Wolsey <bwy>
Group Member
Sat 05 Mar 2011 05:03:41 PM UTC, comment #13: 

I'm happy with closing.

Sandro Santilli <strk>
Group Member
Sat 05 Mar 2011 05:01:43 PM UTC, comment #12: 

I propose closing this as fixed if no one knows how to reproduce it. Please let me know if anyone objects.

Benjamin Wolsey <bwy>
Group Member
Sat 05 Mar 2011 12:26:59 PM UTC, comment #11: 

The launcher script is still valid, but I can't reproduce a segfault with 0.8.6, 0.8.7 or trunk.

Benjamin Wolsey <bwy>
Group Member
Fri 04 Mar 2011 04:15:50 PM UTC, comment #10: 

The URL that originally provoked the crash is no longer available.  Does somebody have it stashed away somewhere, or else another reproducer I can try?

Jerry James <jjames>
Fri 04 Mar 2011 09:37:11 AM UTC, comment #9: 

Segfaults are high security severity...

Sandro Santilli <strk>
Group Member
Fri 04 Mar 2011 09:36:50 AM UTC, comment #8: 

Please file another bug for the missing transparency. This one was for the segfault, let's call it closed.
Jerry can you confirm ?

Sandro Santilli <strk>
Group Member
Thu 03 Mar 2011 11:09:10 PM UTC, comment #7: 

The FFMPEG issue is now fixed, thanks to Benjamin.

The next problem seems to be that the video does not appear to be composited correctly onto the rest of graphics: the pixels that (presumably) should be translucent are actually opaque black.

Bastiaan Jacques <bjacques>
Group Member
Thu 03 Mar 2011 01:13:36 AM UTC, comment #6: 

I think the segfault should be fixed in master.

As for the video messages, they occur because the SWF tries to play a VP6a video, which Gstreamer is not able to play until gst-ffmpeg 0.10.12 (as yet unreleased).

As for the FFMPEG video handler, it is able to decode the image. It decodes to RGBA, which is all fine, but this code in VideoDecoderFfmpeg.cpp is dependent on PIX_FMT_RGBA being defined, and in recent ffmpeg, it is not a define but part of an enum. So video playback fails. Doh!

Bastiaan Jacques <bjacques>
Group Member
Fri 07 May 2010 04:42:13 PM UTC, comment #5: 

I'm using these versions:

gstreamer-0.10.28-2.fc12.x86_64
gnash-0.8.7-1.fc12.x86_64

I have a core dump, if that would be helpful.  It's about 61 Mbytes.

Jerry James <jjames>
Fri 07 May 2010 02:37:16 PM UTC, comment #4: 

I can't reproduce the segfault.

The backtrace shows an interesting bit:

#0  0x00000030e5c0cc4a in gnash::sound::sound_handler::fetchSamples (this=
    0x1642c00, to=0x1763000, nSamples=2048) at sound_handler.cpp:571
        is = 0x1
        wrote = <value optimized out>
        finalVolumeFact = <value optimized out>

The value for pointer `is' looks dodgy.

Bastiaan Jacques <bjacques>
Group Member
Fri 07 May 2010 06:43:26 AM UTC, comment #3: 

Sounds like an issue with your gstreamer.
Which version of it are you using? And which version of gnash ?

I'm using the ffmpeg handler so can't reproduce right now.
Bastiaan, can you ?

Sandro Santilli <strk>
Group Member
Fri 07 May 2010 04:21:23 AM UTC, comment #2: 

I ran the launcher.  It has not segfaulted.  I am seeing lots of lines like this:

(gtk-gnash:3420): GStreamer-CRITICAL **: gst_pad_alloc_buffer_full: assertion `size >= 0' failed

and one place where it says this:

error -4 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -4 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing dataerror -5 pushing

but no segfaults.

Jerry James <jjames>
Thu 06 May 2010 05:59:12 PM UTC, comment #1: 

I attach a launcher for the bug.
Works fine for me, does it still abort for you Jerry ?

(file #20472)

Sandro Santilli <strk>
Group Member
Thu 06 May 2010 05:18:38 PM UTC, original submission:  

I am running Fedora 12 on an x86_64 platform.  ABRT popped up to inform me of this crash while I was browsing the web.  I didn't notice anything happen in the browser, so this was probably some advertisement that I wasn't even paying attention to.

I have gnash-1:0.8.7-1.fc12.x86_64 installed.  This has been reported downstream as https://bugzilla.redhat.com/show_bug.cgi?id=587129.

Jerry James <jjames>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #20472:  bug29811.sh added by strk (2KiB - text/x-sh)
file #20470:  gnash_backtrace added by jjames (41KiB - application/octet-stream - Backtrace)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bwy (Posted a comment)
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by strk (Updated the item)
  • -email is unavailable- added by jjames (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-07 bwy StatusReady For Test Fixed
        Assigned toNone bjacques
        Open/ClosedOpen Closed
    2011-03-04 strk Severity3 - Normal 6 - Security
    2011-03-04 strk StatusNone Ready For Test
    2010-05-07 strk Categorysound sound-gst
    2010-05-06 strk Attached File- Added bug29811.sh, #20472
    2010-05-06 jjames Attached File- Added gnash_backtrace, #20470

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code