[Gnash-commit] gnash ChangeLog server/rect.cpp server/rect.h s...

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/05/14 08:54:20

Modified files:
        .              : ChangeLog 
        server         : rect.cpp rect.h 
        server/parser  : movie_def_impl.cpp 

Log message:
                * server/rect.{cpp,h} (read): check for min/max values swapped
                  reporting SWF malformation and setting the rect to NULL if
                  that happens.
                * server/parser/movie_def_impl.cpp (readHeader): report SWF
                  malformation if movie bounds were malformed.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.3184&r2=1.3185
http://cvs.savannah.gnu.org/viewcvs/gnash/server/rect.cpp?cvsroot=gnash&r1=1.8&r2=1.9
http://cvs.savannah.gnu.org/viewcvs/gnash/server/rect.h?cvsroot=gnash&r1=1.17&r2=1.18
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/movie_def_impl.cpp?cvsroot=gnash&r1=1.68&r2=1.69

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.3184
retrieving revision 1.3185
diff -u -b -r1.3184 -r1.3185
--- ChangeLog   14 May 2007 05:17:18 -0000      1.3184
+++ ChangeLog   14 May 2007 08:54:19 -0000      1.3185
@@ -1,3 +1,11 @@
+2007-05-14 Sandro Santilli <address@hidden>
+
+       * server/rect.{cpp,h} (read): check for min/max values swapped
+         reporting SWF malformation and setting the rect to NULL if
+         that happens.
+       * server/parser/movie_def_impl.cpp (readHeader): report SWF
+         malformation if movie bounds were malformed.
+
 2007-05-14 Zou Lunkai <address@hidden>
 
        * testsuite/misc-ming.all/: displaylist_depths_test9.c, Makefile.am

Index: server/rect.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/rect.cpp,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -b -r1.8 -r1.9
--- server/rect.cpp     6 Dec 2006 12:48:51 -0000       1.8
+++ server/rect.cpp     14 May 2007 08:54:19 -0000      1.9
@@ -36,11 +36,23 @@
        float ymin = (float) in->read_sint(nbits);
        float ymax = (float) in->read_sint(nbits);
 
-       // TODO: check for swapper X or Y values,
-       //       or an assertion will fail !
+       // Check for swapped X or Y values
+       if (xmax < xmin || ymax < ymin)
+       {
+               // We set invalid rectangles to NULL, but we might instead
+               // want to actually swap the values IFF the proprietary player
+               // does so. TODO: check it out.
+               IF_VERBOSE_MALFORMED_SWF(
+               log_swferror("Invalid rectangle: xmin=%g xmax=%g "
+                       "ymin=%g ymax=%g. Read as Null.",
+                       xmin, xmax, ymin, ymax);
+               );
+               _range.setNull();
+               return;
+       }
+
        _range.setTo(xmin, ymin, xmax, ymax);
 
-//             IF_DEBUG(log_msg("rect::read() nbits = %d\n", nbits));
 }
 
 // Debug spew.

Index: server/rect.h
===================================================================
RCS file: /sources/gnash/gnash/server/rect.h,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -b -r1.17 -r1.18
--- server/rect.h       24 Apr 2007 12:01:55 -0000      1.17
+++ server/rect.h       14 May 2007 08:54:20 -0000      1.18
@@ -17,7 +17,7 @@
 // 
 //
 
-/* $Id: rect.h,v 1.17 2007/04/24 12:01:55 udog Exp $ */
+/* $Id: rect.h,v 1.18 2007/05/14 08:54:20 strk Exp $ */
 
 #ifndef GNASH_RECT_H
 #define GNASH_RECT_H
@@ -98,6 +98,23 @@
                _range.setWorld();
        }
 
+       /// Read a bit-packed rectangle from an SWF stream
+       //
+       /// Format of the bit-packed rectangle is:
+       ///
+       ///     bits  | name  | description
+       ///     ------+-------+-------------------------
+       ///       5   | nbits | number of bits used in subsequent values
+       ///     nbits | xmin  | minimum X value
+       ///     nbits | xmax  | maximum X value
+       ///     nbits | ymin  | minimum Y value
+       ///     nbits | ymax  | maximum Y value
+       ///
+       /// If max values are less then min values the SWF is malformed;
+       /// in this case this method will raise an swf_error and set the
+       /// rectangle to the NULL rectangle. See is_null().
+       ///     
+       ///
        void    read(stream* in);
 
        void    print() const;

Index: server/parser/movie_def_impl.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/movie_def_impl.cpp,v
retrieving revision 1.68
retrieving revision 1.69
diff -u -b -r1.68 -r1.69
--- server/parser/movie_def_impl.cpp    2 May 2007 18:19:02 -0000       1.68
+++ server/parser/movie_def_impl.cpp    14 May 2007 08:54:20 -0000      1.69
@@ -458,6 +458,15 @@
        _str.reset(new stream(_in.get()));
 
        m_frame_size.read(_str.get());
+       // If the rect is malformed, rect::read would already 
+       // print an error. We check again here just to give 
+       // the error are better context.
+       if ( m_frame_size.is_null() )
+       {
+               IF_VERBOSE_MALFORMED_SWF(
+               log_swferror("non-finite movie bounds");
+               );
+       }
        m_frame_rate = _str->read_u16() / 256.0f;
        m_frame_count = _str->read_u16();