[Gnash-commit] [bug #32950] segfault in ActionHandler::execute()

[Bastiaan Jacques]

URL:
  <http://savannah.gnu.org/bugs/?32950>

                 Summary: segfault in ActionHandler::execute()
                 Project: Gnash - The GNU Flash player
            Submitted by: bjacques
            Submitted on: Wed 30 Mar 2011 01:06:57 AM CEST
                Category: core
                Severity: 6 - Security
                 Release: master
                  Status: Confirmed
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:


gui/gnash http://media.easyads.bg/templates_flash/468x60.swf -P
"flashvars=url=http://media.easyads.bg/displayads_click.php&framerate=25&inner=http://media.easyads.bg/ads/display_ads/296/296_322db3d54772328ef2a8fc349ecd772b.swf&params=md5checksum=K-ewtDKH0kSQ8A5oMX7BkHvTZoud8pRYjTexHFg8-9nZhklHspC8hfvMY_dZYgujsmEPUk3knboENt-2pOCMILXL59tAiWq07DyTDf3aURFYMlpZrVovynBCz1ZYHd53YE9WR586zv0tTAkVpgj0KqAgBOq0WLrDTp53yeViFSfEVbt-zZ_V6VfjB2nUBZP2BRwOddlTzmgMlwycZCdkustQcY6t_fcecCLexOrVKGQ,";


Immediately prior to the crash, the following message is printed:

ERROR: Unsupported action handler invoked, code at pc is 0xfe

#1  0x00342a31 in gnash::SWF::ActionHandler::execute (this=0xb7aa4bf4,
thread=...)
    at /home/bastiaan/gnash/master/libcore/vm/ASHandlers.cpp:240
No locals.
#2  0x0034667f in gnash::SWF::SWFHandlers::execute (this=0x4d12b8, type=255,
thread=...)
    at /home/bastiaan/gnash/master/libcore/vm/ASHandlers.cpp:433
No locals.
#3  0x0035a2b6 in gnash::ActionExec::operator() (this=0xbfffce20)
    at /home/bastiaan/gnash/master/libcore/vm/ActionExec.cpp:255
        action_id = 255 '\377'
        guardedChar = 0x1e
        codeVersion = 6
        __PRETTY_FUNCTION__ = "void gnash::ActionExec::operator()()"
        ash = @0x4d12b8
        clock = {<gnash::VirtualClock> = {_vptr.VirtualClock = 0x4ca9f8},
_startTime = 
    1301439096970}
#4  0x001ddf07 in gnash::GlobalCode::execute (this=0xb7734b70)
    at /home/bastiaan/gnash/master/libcore/vm/ExecutableCode.h:73
        exec = {<boost::noncopyable_::noncopyable> = {<No data fields>}, code
= @0xb7aabf78, 
          env = @0xb7dce500, retval = 0x0, _withStack = std::vector of length
0, capacity 0, 
          _scopeStack = std::vector of length 0, capacity 0, _func = 0x0,
_this_ptr = 
    0xbfffdeec, _initialStackSize = 0, _originalTarget = 0xb7dce3e0,
_origExecSWFVersion = 8, 
          _tryList = empty std::list, _returning = false, _abortOnUnload =
true, pc = 28, 
          next_pc = 44, stop_pc = 51}
#5  0x001d0a62 in gnash::movie_root::processActionQueue (this=0xbfffd1d8,
lvl=2)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:1330
#6  0x001d0e1c in processActionQueue (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:1411
No locals.
#7  gnash::movie_root::processActionQueue (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:1400
No locals.
#8  0x001d60b0 in gnash::movie_root::advanceMovie (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:898
No locals.
#9  0x001db528 in gnash::movie_root::advance (this=0xbfffd1d8)
    at /home/bastiaan/gnash/master/libcore/movie_root.cpp:832
        elapsed = <optimized out>
...


ActionHandler::execute() is trying to execute a _callback which is 0.

Originally reported at https://bugzilla.redhat.com/show_bug.cgi?id=691699




    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?32950>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/