Opened 9 years ago

Closed 8 years ago

#6353 closed bug (fixed)

Trying to download 3gp file crashes appserver

Reported by: pulkomandy Owned by: korli
Priority: normal Milestone: R1
Component: Servers/app_server Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: yes Platform: All

Description

This is haiku hrev37652 and Web+ hrev535.

Downloading this file : http://homepage.ntlworld.com/hoyle.peter/video/elevated.3gp crashes app_server in DrawState::Transform().

Attachments (3)

1.JPG (122.9 KB) - added by Coldfirex 8 years ago.
2.JPG (30.9 KB) - added by Coldfirex 8 years ago.
CountGlyphs.diff (583 bytes) - added by stimut 8 years ago.

Download all attachments as: .zip

Change History (12)

comment:1 Changed 8 years ago by Coldfirex

Can confirm under hrev39551 gcc2hybrid under virtualbox 3.2.10. kdl attached.

Changed 8 years ago by Coldfirex

Attachment: 1.JPG added

Changed 8 years ago by Coldfirex

Attachment: 2.JPG added

comment:2 Changed 8 years ago by stimut

Component: Applications/WebPositiveServers/app_server

In ServerWindow::_DispatchViewDrawingMessage(), in the case for AS_DRAW_STRING_WITH_OFFSETS, on line 2785, the string length rather than the number of UTF8 glyphs is used. This would often be OK except when printing funky characters like in the linked .3gp file above. Since some of the characters will be multibyte, the string length will be longer than the number of glyhs, which means we call ConvertToScreenForDrawing with values beyond the end of the locations array, causing the access violation and the crash.

It is only a simple one line fix, which I have attached.

Changed 8 years ago by stimut

Attachment: CountGlyphs.diff added

comment:3 Changed 8 years ago by stimut

Has a Patch: set

comment:4 Changed 8 years ago by stippi

Absolutely correct findings. Thanks a bunch! You could check if the same mistake is done for the ServerPicture code path (should be in ServerWindow also), both code paths have yet to be refactored so no code is duplicated. I would appreciate if someone could apply this patch, otherwise I may get to it tonight.

comment:5 Changed 8 years ago by stimut

No worries.

I've had a look at the ServerPicture code path but it doesn't seem to have the same problem since it doesn't have to deal with the AS_DRAW_STRINGS_WITH_OFFSETS case and so doesn't seem to care if the string contains multi-byte characters or not.

comment:6 Changed 8 years ago by stimut

Just a friendly reminder that this patch hasn't been committed yet...

comment:7 Changed 8 years ago by korli

Owner: changed from stippi to korli
Status: newassigned

comment:8 Changed 8 years ago by stippi

Thanks korli! The problem is that I would usually apply such patches when I am in Linux or Haiku, but at the moment, I am working in Windows all the time, mostly since Eclipse and everything else is a bit more zippy than in Linux, and I don't have a convenient way to quickly apply some patches from Windows when I read my mail. And then I forget about this stuff... sorry stimut!

comment:9 Changed 8 years ago by korli

Resolution: fixed
Status: assignedclosed

Tested OK. Applied in hrev40310.

Note: See TracTickets for help on using tickets.