[Gnash-commit] gnash ChangeLog server/parser/button_character_...

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  08/04/21 16:39:16

Modified files:
        .              : ChangeLog 
        server/parser  : button_character_def.cpp 

Log message:
        Check 'next_action_offset' field in DEFINEBUTTON2 action records.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.6338&r2=1.6339
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/button_character_def.cpp?cvsroot=gnash&r1=1.33&r2=1.34

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.6338
retrieving revision 1.6339
diff -u -b -r1.6338 -r1.6339
--- ChangeLog   21 Apr 2008 12:06:51 -0000      1.6338
+++ ChangeLog   21 Apr 2008 16:39:15 -0000      1.6339
@@ -1,5 +1,10 @@
 2008-04-21 Sandro Santilli <address@hidden>
 
+       * server/parser/button_character_def.cpp (readDefineButton2):
+         Check 'next_action_offset' field in DEFINEBUTTON2 action records.
+
+2008-04-21 Sandro Santilli <address@hidden>
+
        * testsuite/server/: ClassSizes.cpp, Makefile.am:
          Add a simple prog to report common class sizes.
          It's not a real test so won't be run, but will

Index: server/parser/button_character_def.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/button_character_def.cpp,v
retrieving revision 1.33
retrieving revision 1.34
diff -u -b -r1.33 -r1.34
--- server/parser/button_character_def.cpp      21 Apr 2008 11:27:45 -0000      
1.33
+++ server/parser/button_character_def.cpp      21 Apr 2008 16:39:16 -0000      
1.34
@@ -62,7 +62,7 @@
        }
 
        IF_VERBOSE_PARSE (
-       log_parse(_("   button actions for conditions %x"), m_conditions); // 
@@ need more info about which actions
+       log_parse(_("   button actions for conditions 0x%x"), m_conditions); // 
@@ need more info about which actions
        );
 
        // Read actions.
@@ -404,7 +404,18 @@
                {
                        in->ensureBytes(2);
                        unsigned next_action_offset = in->read_u16();
+                       if ( next_action_offset )
+                       {
                        next_action_pos = in->get_position() + 
next_action_offset - 2;
+                               if ( next_action_pos > tagEndPosition )
+                               {
+                                       IF_VERBOSE_MALFORMED_SWF(
+                                       log_swferror(_("Next action offset (%u) 
in Button2ActionConditions points past the end of tag"),
+                                               next_action_offset);
+                                       );
+                                       next_action_pos = tagEndPosition;
+                               }
+                       }
 
                        unsigned long endActionPos = next_action_offset ? 
next_action_pos : tagEndPosition;
 
@@ -416,16 +427,6 @@
                                break;
                        }
 
-                       //was: in->get_position() >= in->get_tag_end_position()
-                       if ( next_action_pos >= in->get_tag_end_position() )
-                       {
-                               IF_VERBOSE_MALFORMED_SWF(
-                               log_swferror(_("Next action offset (%u) in 
Button2ActionConditions points past the end of tag"),
-                                       next_action_offset);
-                               );
-                               break;
-                       }
-
                        // seek to next action.
                        in->set_position(next_action_pos);
                }