[Gnash-commit] gnash ChangeLog server/parser/movie_def_impl.cpp

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/01/30 11:05:13

Modified files:
        .              : ChangeLog 
        server/parser  : movie_def_impl.cpp 

Log message:
                * server/parser/movie_def_impl.cpp (incrementLoadedFrames):
                  handle malformed SWF containing more SHOWFRAME then expected;
                  (readHeader): allocate more slots for actions to make 
malformed
                  SWF handling easier.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.2195&r2=1.2196
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/movie_def_impl.cpp?cvsroot=gnash&r1=1.58&r2=1.59

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.2195
retrieving revision 1.2196
diff -u -b -r1.2195 -r1.2196
--- ChangeLog   30 Jan 2007 10:52:15 -0000      1.2195
+++ ChangeLog   30 Jan 2007 11:05:13 -0000      1.2196
@@ -1,5 +1,9 @@
 2007-01-30 Sandro Santilli <address@hidden>
 
+       * server/parser/movie_def_impl.cpp (incrementLoadedFrames):
+         handle malformed SWF containing more SHOWFRAME then expected;
+         (readHeader): allocate more slots for actions to make malformed
+         SWF handling easier.
        * server/asobj/: NetConnection.cpp, NetStream.cpp:
          Cleanups and robustness improvements.
        * server/parser/movie_def_impl.cpp (read_all_swf):

Index: server/parser/movie_def_impl.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/movie_def_impl.cpp,v
retrieving revision 1.58
retrieving revision 1.59
diff -u -b -r1.58 -r1.59
--- server/parser/movie_def_impl.cpp    30 Jan 2007 10:25:21 -0000      1.58
+++ server/parser/movie_def_impl.cpp    30 Jan 2007 11:05:13 -0000      1.59
@@ -481,8 +481,10 @@
        // TODO: This seems dangerous, check closely
        if(m_frame_count == 0) m_frame_count++;
        
-       m_playlist.resize(m_frame_count);
-       m_init_action_list.resize(m_frame_count);
+       // Allocate 1 more then the expected slots
+       // for actions, to make handling malformed SWF easier.
+       m_playlist.resize(m_frame_count+1);
+       m_init_action_list.resize(m_frame_count+1);
 
        IF_VERBOSE_PARSE(
                m_frame_size.print();
@@ -931,6 +933,20 @@
        boost::mutex::scoped_lock lock(_frames_loaded_mutex);
 
        ++_frames_loaded;
+       if ( _frames_loaded > m_frame_count )
+       {
+               IF_VERBOSE_MALFORMED_SWF(
+                       log_swferror("number of SHOWFRAME tags "
+                               "in SWF stream '%s' (" SIZET_FMT
+                               ") exceeds "
+                               "the advertised number in header ("
+                               SIZET_FMT ").",
+                               get_url().c_str(), _frames_loaded,
+                               m_frame_count);
+               );
+               m_playlist.resize(_frames_loaded+1);
+               m_init_action_list.resize(_frames_loaded+1);
+       }
 
 #ifdef DEBUG_FRAMES_LOAD
        log_msg("Loaded frame %u/%u",