Bug 12793 - Crash playing a swf file (because of missing NULL ptr check)
Summary: Crash playing a swf file (because of missing NULL ptr check)
Status: RESOLVED FIXED
Alias: None
Product: swfdec
Classification: Unclassified
Component: library (show other bugs)
Version: unspecified
Hardware: x86 (IA32) All
: high normal
Assignee: swfdec ml
QA Contact: swfdec ml
URL: http://www.leroutier.net/floss/swfdec...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-10-13 02:31 UTC by Stéphane Loeuillet
Modified: 2007-10-14 02:42 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Stéphane Loeuillet 2007-10-13 02:31:50 UTC
Trying to play a swf file on my harddrive, I had a crash.
Looking at gdb's output, I saw that :

SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
SWFDEC: FIXME: swfdec_pattern.c(446): swfdec_pattern_do_parse: CAIRO_EXTEND_PAD is not yet implemented
SWFDEC: WARN : swfdec_shape_parser.c(279): swfdec_shape_parser_finish: fillstyle 0 has no path
SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
SWFDEC: FIXME: swfdec_pattern.c(446): swfdec_pattern_do_parse: CAIRO_EXTEND_PAD is not yet implemented
SWFDEC: WARN : swfdec_shape_parser.c(279): swfdec_shape_parser_finish: fillstyle 0 has no path
SWFDEC: FIXME: swfdec_pattern.c(446): swfdec_pattern_do_parse: CAIRO_EXTEND_PAD is not yet implemented
SWFDEC: FIXME: swfdec_pattern.c(446): swfdec_pattern_do_parse: CAIRO_EXTEND_PAD is not yet implemented
SWFDEC: WARN : swfdec_shape_parser.c(279): swfdec_shape_parser_finish: fillstyle 0 has no path
SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
SWFDEC: FIXME: swfdec_sound.c(254): tag_func_sound_stream_head: playback codec 2 doesn't match sound codec 0
[New Thread -1236038768 (LWP 14016)]
[Thread -1227646064 (LWP 14015) exited]

(swfplay:14010): Swfdec-CRITICAL **: swfdec_buffer_queue_pull: assertion `length > 0' failed

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1223689344 (LWP 14010)]
0xb7f46add in swfdec_sound_get_decoded (sound=0x81a4770, format=0x8203d80) at swfdec_sound.c:205
205       SWFDEC_LOG ("after decoding, got %u samples, should get %u and skip %u", 
(gdb) p tmp
$1 = (SwfdecBuffer *) 0x0

The code does :
  SWFDEC_LOG ("after decoding, got %u samples, should get %u and skip %u", 
      tmp->length / sample_bytes, n_samples, sound->skip);

tmp->length is the culprit.
but tmp is used more and more after that so perhaps a small if (!tmp) is not enough.

Attaching a link to the file once it has been uploaded
Comment 1 Benjamin Otte 2007-10-14 02:42:01 UTC
Thanks, fixed in 9ee02d87b2f6837237a717b3b6232ebe7ec63c63


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.