[Gnash-commit] gnash ChangeLog server/parser/movie_def_impl.h ...

[Benjamin Wolsey]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Benjamin Wolsey <bwy>   08/05/13 07:55:01

Modified files:
        .              : ChangeLog 
        server/parser  : movie_def_impl.h 
        server/swf     : tag_loaders.cpp 

Log message:
                * server/swf/tag_loaders.cpp: minor cleanups, typo corrections,
                  include used headers.
                * server/parser/movie_def_impl.h: log malformed SWF and return
                  when more than one JPEGTABLES tag present. Fixes bug #23201.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.6593&r2=1.6594
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/movie_def_impl.h?cvsroot=gnash&r1=1.72&r2=1.73
http://cvs.savannah.gnu.org/viewcvs/gnash/server/swf/tag_loaders.cpp?cvsroot=gnash&r1=1.198&r2=1.199

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.6593
retrieving revision 1.6594
diff -u -b -r1.6593 -r1.6594
--- ChangeLog   12 May 2008 14:02:20 -0000      1.6593
+++ ChangeLog   13 May 2008 07:54:59 -0000      1.6594
@@ -1,3 +1,10 @@
+2008-05-13 Benjamin Wolsey <address@hidden>
+
+       * server/swf/tag_loaders.cpp: minor cleanups, typo corrections,
+         include used headers.
+       * server/parser/movie_def_impl.h: log malformed SWF and return
+         when more than one JPEGTABLES tag present. Fixes bug #23201.
+
 2008-05-12 Sandro Santilli <address@hidden>
 
        * server/asobj/NetStreamFfmpeg.cpp (pausePlayback): detach aux

Index: server/parser/movie_def_impl.h
===================================================================
RCS file: /sources/gnash/gnash/server/parser/movie_def_impl.h,v
retrieving revision 1.72
retrieving revision 1.73
diff -u -b -r1.72 -r1.73
--- server/parser/movie_def_impl.h      21 Apr 2008 11:27:45 -0000      1.72
+++ server/parser/movie_def_impl.h      13 May 2008 07:55:00 -0000      1.73
@@ -476,7 +476,17 @@
        /// images (JPEG images without the table info).
        void    set_jpeg_loader(std::auto_ptr<jpeg::input> j_in)
        {
-           assert(m_jpeg_in.get() == NULL);
+           if (m_jpeg_in.get())
+           {
+               /// There should be only one JPEGTABLES tag in an SWF (see: 
+               /// http://www.m2osw.com/en/swf_alexref.html#tag_jpegtables)
+               /// Discard any subsequent attempts to set the jpeg loader
+               /// to avoid crashing on very malformed SWFs. (No conclusive 
tests
+               /// for pp behaviour, though one version also crashes out on the
+               /// malformed SWF that triggers this assert in Gnash).
+               log_swferror(_("More than one JPEGTABLES tag found: not 
resetting JPEG loader"));
+               return;
+           }
            m_jpeg_in = j_in;
        }
 

Index: server/swf/tag_loaders.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/swf/tag_loaders.cpp,v
retrieving revision 1.198
retrieving revision 1.199
diff -u -b -r1.198 -r1.199
--- server/swf/tag_loaders.cpp  7 May 2008 09:15:17 -0000       1.198
+++ server/swf/tag_loaders.cpp  13 May 2008 07:55:01 -0000      1.199
@@ -59,6 +59,8 @@
 #include <zlib.h>
 #endif
 #include <map>
+#include <limits>
+#include <cassert>
 
 namespace gnash {
 
@@ -214,8 +216,8 @@
        else
        {
            IF_VERBOSE_MALFORMED_SWF(
-               log_swferror(_("frame_label_loader end position " SIZET_FMT ", "
-                              "read up to " SIZET_FMT),
+               log_swferror(_("frame_label_loader end position %d, "
+                              "read up to %d"),
                             end_tag, curr_pos);
            );
        }
@@ -235,16 +237,16 @@
         log_parse(_("  jpeg_tables_loader"));
     );
 
-    unsigned long currPos = in->get_position();
-    unsigned long endPos = in->get_tag_end_position();
+    const unsigned long currPos = in->get_position();
+    const unsigned long endPos = in->get_tag_end_position();
 
     assert(endPos >= currPos);
 
-    unsigned int jpegHeaderSize = endPos-currPos;
+    const unsigned long jpegHeaderSize = endPos - currPos;
 
     if ( ! jpegHeaderSize )
     {
-        log_debug(_("No bytes to read in JPEGTABLES tag at offset %lu"), 
currPos);
+        log_debug(_("No bytes to read in JPEGTABLES tag at offset %d"), 
currPos);
     }
 
     std::auto_ptr<jpeg::input> j_in;
@@ -259,7 +261,7 @@
        // of gnash::stream::read(), so this is not a problem.
        //
         std::auto_ptr<tu_file> ad( StreamAdapter::getFile(*in, 
std::numeric_limits<unsigned long>::max()) );
-        //  transfer ownerhip to the jpeg::input
+        //  transfer ownership to the jpeg::input
         j_in.reset(jpeg::input::create_swf_jpeg2_header_only(ad.release(), 
jpegHeaderSize, true));
 
     }