1156342 - OpenH264: global-buffer-overflow crash [@WelsDec::ParseScalingList]

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase.264

Tested with https://github.com/cisco/openh264/commit/864ff21021

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Ethan Hugg [:ehugg]]

I just replicated this crash with the master branch, but I cannot replicate it with the v1.4-Firefox38 branch (gives a 'Feature not supported' message).   So we need to fix this before the next version, but this shouldn't hold up the v1.4 rollout.

Comment 3

[sijchen]

This problem has been fixed in commit dac1363

Comment 4

[sijchen]

please kindly check if it works. thanks

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking for 38+ since this is sec-critical. 
Christoph, which platforms and versions are affected?  Do you need extra QA help?

Comment 6

[Ethan Hugg [:ehugg]]

No Firefox versions are affected.  This is a bug in code that was added since v1.4 of OpenH264 was made.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

unmarking tracking as this applies to an unreleased version of the plugin.

Comment 8

[Ethan Hugg [:ehugg]]

This should now be fixed by the rollout of OpenH264 v1.4 - bug 1133784.

Comment 9

[Ethan Hugg [:ehugg]]

Closed this by mistake, this bug was found in post-1.4 code.

Comment 10

[Christoph Diehl [:posidron]]

Fixed. Tested with https://github.com/cisco/openh264/commit/7d7a5c28bc

Comment 11

[Andrew McCreight [:mccr8]]

Marking as fixed per comment 10.