1182717 - OpenH264: ASan heap-buffer-overflow WRITE in WelsDec::DoErrorConSliceMVCopy

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.264

Tested with https://github.com/cisco/openh264/commit/a8ae1346101be6ec1b5f72a861932fbda0cffcde

Comment 1

[Tyson Smith [:tsmith]]

Attachment: callstack.txt

Comment 2

[Tyson Smith [:tsmith]]

Attachment: callstack_2.txt

Comment 3

[karina]

tested openh264 branch v1.4-Firefox38, the bug is also in this branch.

Comment 4

[Haibo Zhu]

This bug has been fixed in the latest version of openh264 master branch.

Comment 5

[Tyson Smith [:tsmith]]

Fixed. Verified with https://github.com/cisco/openh264/commit/f30ad4e512e84a1376f5223f9a450c075e0b0df9

Comment 6

[Tyson Smith [:tsmith]]

Found while fuzzing: https://github.com/cisco/openh264/commit/f9f2bbf805ebb82d0cc46dd79aade2dfb264f046

Comment 7

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 8

[Tyson Smith [:tsmith]]

Attachment: test_case_2.264

Comment 9

[Haibo Zhu]

We have fixed this bug in the master branch commit b37cda2 and openh264v1.5 branch commit d6b1680, please help to verify it.

Comment 10

[Tyson Smith [:tsmith]]

Verified with commit b37cda2482.

Comment 11

[Rui Zhang]

Thanks, Tyson, for the verification. I'm marking this as "resolved now"