1049309 - Crash in libstagefright demuxer

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Chris Pearce [:cpearce (Not reading bugmail)]]

I managed to get a fatal assert:

xul.dll!__android_log_assert(const char * cond=0x13bf29e0, const char * tag=0x00000000, const char * fmt=0x13bf29fc, ...) Line 278	C
xul.dll!stagefright::Vector<stagefright::MPEG4Source::Sample>::operator[](unsigned int index=4294967295) Line 270	C++
xul.dll!stagefright::MPEG4Source::fragmentedRead(stagefright::MediaBuffer * * out=0x07c18e20, const stagefright::MediaSource::ReadOptions * options=0x0aee4d30) Line 3433	C++
xul.dll!stagefright::MPEG4Source::read(stagefright::MediaBuffer * * out=0x07c18e20, const stagefright::MediaSource::ReadOptions * options=0x0aee4d30) Line 3086	C++
xul.dll!mp4_demuxer::MP4Demuxer::DemuxVideoSample() Line 185	C++
xul.dll!mozilla::MP4Reader::PopSample(mp4_demuxer::TrackType aTrack=kVideo) Line 423	C++
xul.dll!mozilla::MP4Reader::Seek(__int64 aTime=168980000, __int64 aStartTime=0, __int64 aEndTime=181389622, __int64 aCurrentTime=3920890) Line 699	C++
xul.dll!mozilla::MediaDecoderStateMachine::DecodeSeek() Line 2071	C++
xul.dll!nsRunnableMethodImpl<void (__thiscall mozilla::MediaDecoderStateMachine::*)(void),void,1>::Run() Line 393	C++
xul.dll!mozilla::MediaTaskQueue::Runner::Run() Line 174	C++

Bug is in MPEG4Extractor.cpp:3433:

 Sample lastSample = mCurrentSamples[mCurrentSamples.size() - 1];

mCurrentSamples.size()==0, so the array index is out of bounds.

Comment 1

[Chris Pearce [:cpearce (Not reading bugmail)]]

Looks like we can just remove that line, it looks like a no-op.

Comment 2

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

I'd already removed that somewhere. Obviously never landed the patch.

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Remove no-op code

AFAICT this line of code has no side effects, other than crashing when mCurrentSamples.size() == 0.

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/519eac773cda

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/519eac773cda