[Gnash-commit] [SCM] Gnash branch, master, updated. release_0_8_9_final-1982-g66b47f4

[Bastiaan Jacques]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Gnash".

The branch, master has been updated
       via  66b47f411a7f7151c55319a6a3d1782409404cc6 (commit)
      from  58ca7e6ec563f76dc1cf3ea29c6864bdf6d2f421 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
http://git.savannah.gnu.org/cgit//commit/?id=66b47f411a7f7151c55319a6a3d1782409404cc6


commit 66b47f411a7f7151c55319a6a3d1782409404cc6
Author: Bastiaan Jacques <address@hidden>
Date:   Thu May 15 01:47:08 2014 +0200

    Don't call read_sint with a zero bit count, yielding a negative bit shift, 
which is an undefined operation.

diff --git a/libcore/SWFStream.cpp b/libcore/SWFStream.cpp
index 2767fe2..f64ed43 100644
--- a/libcore/SWFStream.cpp
+++ b/libcore/SWFStream.cpp
@@ -191,7 +191,7 @@ unsigned SWFStream::read_uint(unsigned short bitcount)
 int
 SWFStream::read_sint(unsigned short bitcount)
 {
-    //assert(bitcount <= 32); // already asserted in read_uint
+    assert(bitcount > 0);
 
     boost::int32_t value = boost::int32_t(read_uint(bitcount));
 
diff --git a/libcore/swf/ShapeRecord.cpp b/libcore/swf/ShapeRecord.cpp
index 9e362de..9c72cd4 100644
--- a/libcore/swf/ShapeRecord.cpp
+++ b/libcore/swf/ShapeRecord.cpp
@@ -404,17 +404,22 @@ ShapeRecord::read(SWFStream& in, SWF::TagType tag, 
movie_definition& m,
                 }
                 in.ensureBits(5);
                 int num_move_bits = in.read_uint(5);
-                in.ensureBits(2 * num_move_bits);
-                int move_x = in.read_sint(num_move_bits);
-                int move_y = in.read_sint(num_move_bits);
+                if (num_move_bits > 0) {
+                    in.ensureBits(2 * num_move_bits);
+                    int move_x = in.read_sint(num_move_bits);
+                    int move_y = in.read_sint(num_move_bits);
     
-                x = move_x;
-                y = move_y;
-    
-                // Set the beginning of the path.
-                current_path.ap.x = x;
-                current_path.ap.y = y;
+                    x = move_x;
+                    y = move_y;
     
+                    // Set the beginning of the path.
+                    current_path.ap.x = x;
+                    current_path.ap.y = y;
+                } else {
+                    IF_VERBOSE_MALFORMED_SWF(
+                        log_swferror(_("Shape move-to missing destination"));
+                    );
+                }
 #if SHAPE_LOG
                 IF_VERBOSE_PARSE(
                     log_parse(_("  Shape read: moveto %d %d"), x, y);

-----------------------------------------------------------------------

Summary of changes:
 libcore/SWFStream.cpp       |    2 +-
 libcore/swf/ShapeRecord.cpp |   23 ++++++++++++++---------
 2 files changed, 15 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
Gnash