1157551 - AddressSanitizer: heap-use-after-free dom/media/test/test_eme_playback.html

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[JW Wang [:jwwang] [:jw_wang]]

Attachment: treeherder logs

Found this bug when enabling FFmpegH264Decoder in test_eme_playback.html.

https://treeherder.mozilla.org/logviewer.html#?job_id=6838952&repo=try

See the attachment for the detail.

Comment 1

[JW Wang [:jwwang] [:jw_wang]]

https://hg.mozilla.org/mozilla-central/file/570bb53a3e7b/dom/media/fmp4/ffmpeg/FFmpegH264Decoder.cpp#l157

The root cause is the image is released again after it is freed and modification of the ref counter results in UAF.

Comment 2

[JW Wang [:jwwang] [:jw_wang]]

Attachment: 1157551_fix_UAF_in_FFmpegH264Decoder-v1.patch

Per [1], pic.data[*] must be set to NULL in release_buffer().

[1] https://hg.mozilla.org/mozilla-central/file/570bb53a3e7b/dom/media/fmp4/ffmpeg/libav53/include/libavcodec/avcodec.h#l1731

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

Thanks.

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ed2ff16c4826

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ed2ff16c4826