1123507 - Out of bound memory access in MoofReader

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Jean-Yves Avenard [:jya]]

As title states...

Box constructor will read and copy 16 bytes into a buffer 8 bytes long

Comment 1

[Jean-Yves Avenard [:jya]]

Attachment: Prevent out of bound memory access

read/write proper amount of data

Comment 2

[Jean-Yves Avenard [:jya]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/c9d2b07a108d
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/1a1a66376625

Ralph, I think this should urgently be uplifted

Comment 3

[Ralph Giles (:rillian)]

Comment on attachment 8551543 [details] [diff] [review]
Prevent out of bound memory access

I agree, this is an important one.

Approval Request Comment
[Feature/regressing bug #]: MSE
[User impact if declined]: Crashes and memory corruption from malformed videos.
[Describe test coverage new/current, TBPL]: presuming green on inbound.
[Risks and why]: Low; change is straightforward and small.
[String/UUID change made/needed]: None.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8551543 [details] [diff] [review]
Prevent out of bound memory access

Taking it even if it didn't land in m-c to be sure it is in beta 2!

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1a1a66376625

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b5727b11abfb
https://hg.mozilla.org/releases/mozilla-beta/rev/8691f7169392

Any way to test this?

Comment 7

[Jean-Yves Avenard [:jya]]

You would need to craft a fragmented MP4 using 64 bits index size.
Not sure how you could test it as such. Especially as the behaviour would depends on the OS/Compiler