[Gnash-commit] gnash ChangeLog server/swf/tag_loaders.cpp

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/03/24 14:34:09

Modified files:
        .              : ChangeLog 
        server/swf     : tag_loaders.cpp 

Log message:
                * server/swf/tag_loaders.cpp (readPlaceActions): gracely handle
                  malformed SWF produced by some old snapshot of Ming CVS.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.2681&r2=1.2682
http://cvs.savannah.gnu.org/viewcvs/gnash/server/swf/tag_loaders.cpp?cvsroot=gnash&r1=1.80&r2=1.81

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.2681
retrieving revision 1.2682
diff -u -b -r1.2681 -r1.2682
--- ChangeLog   24 Mar 2007 12:53:42 -0000      1.2681
+++ ChangeLog   24 Mar 2007 14:34:08 -0000      1.2682
@@ -1,5 +1,7 @@
 2007-03-24 Sandro Santilli <address@hidden>
 
+       * server/swf/tag_loaders.cpp (readPlaceActions): gracely handle
+         malformed SWF produced by some old snapshot of Ming CVS.
        * testsuite/misc-ming.all/Makefile.am:
          Don't try to build tests unsupported by 
          the installed Ming version.

Index: server/swf/tag_loaders.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/swf/tag_loaders.cpp,v
retrieving revision 1.80
retrieving revision 1.81
diff -u -b -r1.80 -r1.81
--- server/swf/tag_loaders.cpp  22 Mar 2007 10:51:49 -0000      1.80
+++ server/swf/tag_loaders.cpp  24 Mar 2007 14:34:08 -0000      1.81
@@ -14,7 +14,7 @@
 // along with this program; if not, write to the Free Software
 // Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
-/* $Id: tag_loaders.cpp,v 1.80 2007/03/22 10:51:49 strk Exp $ */
+/* $Id: tag_loaders.cpp,v 1.81 2007/03/24 14:34:08 strk Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -850,6 +850,18 @@
                        }
 
                        uint32_t event_length = in->read_u32();
+                       if ( in->get_tag_end_position()-in->get_position() <  
event_length )
+                       {
+                               IF_VERBOSE_MALFORMED_SWF(
+                               log_swferror("swf_event::read(), "
+                                       "even_length = %u, but only %u bytes 
left "
+                                       "to the end of current tag."
+                                       " Breaking for safety.",
+                                       event_length, 
in->get_tag_end_position()-in->get_position());
+                               );
+                               break;
+                       }
+
                        uint8 ch = key::INVALID;
 
                        if (flags & (1 << 17))  // has keypress event