The default bug view has changed. See this FAQ.

Android AudioDataDecoder uses audio_specific_config without checking its size

RESOLVED FIXED in Firefox 38

Status

()

Core
Audio/Video
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: kinetik, Assigned: kinetik)

Tracking

Trunk
mozilla38
Points:
---

Firefox Tracking Flags

(firefox38 fixed)

Details

(URL)

Attachments

(1 attachment)

(Assignee)

Description

2 years ago
AudioDataDecoder's constructor assumes the audio_specific_config passed in is at least two bytes long.  For some media, such as dom/media/test/small-shot-mp3.mp4, this assumption is incorrect and results in accessing uninitialized (and possibly unmapped) memory.
(Assignee)

Comment 1

2 years ago
Created attachment 8565286 [details] [diff] [review]
patch v0
Attachment #8565286 - Flags: review?(snorp)
(Assignee)

Updated

2 years ago
Blocks: 1014614
Comment on attachment 8565286 [details] [diff] [review]
patch v0

Review of attachment 8565286 [details] [diff] [review]:
-----------------------------------------------------------------

oops
Attachment #8565286 - Flags: review?(snorp) → review+
(Assignee)

Comment 3

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/602f3407d79a
https://hg.mozilla.org/mozilla-central/rev/602f3407d79a
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox38: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
You need to log in before you can comment on or make changes to this bug.