Closed Bug 1184871 Opened 11 years ago Closed 11 years ago

Stagefright: heap-use-after-free crash [@stagefright::ESDS::parseESDescriptor]

Categories

(Core :: Audio/Video: Playback, defect)

Product:
Core
Component:
Audio/Video: Playback
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox39 --- wontfix
firefox40 + fixed
firefox41 + fixed
firefox42 + fixed
firefox-esr38 40+ fixed
b2g-v2.0 --- wontfix
b2g-v2.0M --- wontfix
b2g-v2.1 --- wontfix
b2g-v2.1S --- fixed
b2g-v2.2 --- fixed
b2g-v2.2r --- fixed
b2g-master --- fixed

People

(Reporter: posidron, Assigned: jya)

References

Details

(4 keywords, Whiteboard: [b2g-adv-main2.5+][fixed by 1186718])

Crash Data

Attachments

(1 file)

Testcase
50.87 KB, application/octet-stream
Details
The following testcase crashes on mozilla-inbound-linux64-asan revision c66c5db7e21a See attachment. Backtrace: ==8973==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030002d3539 at pc 0x7f096f79a553 bp 0x7f094ad5be10 sp 0x7f094ad5be08 READ of size 1 at 0x6030002d3539 thread T63 (MediaPl~back #4) #0 0x7f096f79a552 in stagefright::ESDS::parseESDescriptor(unsigned long, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/ESDS.cpp:157 #1 0x7f096f7a67e9 in parse /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/ESDS.cpp:121 #2 0x7f096f7a67e9 in ESDS /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/ESDS.cpp:37 #3 0x7f096f7a67e9 in stagefright::MPEG4Extractor::updateAudioTrackInfoFromESDS_MPEG4Audio(void const*, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:2467 #4 0x7f096f79ef85 in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1641 #5 0x7f096f7a4157 in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1345 #6 0x7f096f7a3b43 in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1256 #7 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #8 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #9 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #10 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #11 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #12 0x7f096f79b62e in stagefright::MPEG4Extractor::readMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:484 #13 0x7f096f79b454 in stagefright::MPEG4Extractor::getMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:419 #14 0x7f096f77fc09 in mp4_demuxer::MP4Metadata::MP4Metadata(mp4_demuxer::Stream*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/binding/MP4Metadata.cpp:99 #15 0x7f097431801d in MakeUnique<mp4_demuxer::MP4Metadata, nsRefPtr<mp4_demuxer::BufferStream> &> /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/mozilla/UniquePtr.h:642 #16 0x7f097431801d in mozilla::MP4Demuxer::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/fmp4/MP4Demuxer.cpp:93 #17 0x7f0973f043e1 in mozilla::MediaFormatReader::AsyncReadMetadata() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaFormatReader.cpp:288 #18 0x7f0973f81230 in mozilla::detail::MethodCallWithNoArgs<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true>, mozilla::MediaDecoderReader>::Invoke() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:878 #19 0x7f0973f80d76 in mozilla::detail::ProxyRunnable<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true> >::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:938 #20 0x7f0973e7d78a in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:181 #21 0x7f0974006105 in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:256 #22 0x7f096f959021 in nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:228 #23 0x7f096f9593dc in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:242 #24 0x7f096f952f27 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:867 #25 0x7f096f9c1bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #26 0x7f0970226a6f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:326 #27 0x7f09701b2f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #28 0x7f09701b2f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #29 0x7f09701b2f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #30 0x7f096f94f345 in nsThread::ThreadFunc(void*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:360 #31 0x7f097c73f135 in _pt_root /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212 #32 0x7f097cd7d181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181) 0x6030002d3539 is located 0 bytes to the right of 25-byte region [0x6030002d3520,0x6030002d3539) freed by thread T63 (MediaPl~back #4) here: #0 0x474de1 in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7f096f7676fa in freeStorage /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:285 #2 0x7f096f7676fa in clear /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:251 #3 0x7f096f7676fa in ~typed_data /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:228 #4 0x7f096f7676fa in ~key_value_pair_t /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/TypeHelpers.h:227 #5 0x7f096f7676fa in move_forward_type<stagefright::key_value_pair_t<unsigned int, stagefright::MetaData::typed_data> > /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/TypeHelpers.h:193 #6 0x7f096f7676fa in stagefright::SortedVector<stagefright::key_value_pair_t<unsigned int, stagefright::MetaData::typed_data> >::do_move_forward(void*, void const*, unsigned long) const /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/SortedVector.h:257 #7 0x7f096f76965f in _do_move_forward /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:500 #8 0x7f096f76965f in stagefright::VectorImpl::_grow(unsigned long, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:409 #9 0x7f096f76bfa0 in insertAt /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:144 #10 0x7f096f76bfa0 in stagefright::SortedVectorImpl::add(void const*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:571 #11 0x7f096f765879 in key_value_pair_t /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/SortedVector.h:200 #12 0x7f096f765879 in add /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/KeyedVector.h:177 #13 0x7f096f765879 in stagefright::MetaData::setData(unsigned int, unsigned int, void const*, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:195 #14 0x7f096f7a017f in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1208 #15 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #16 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #17 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #18 0x7f096f79b62e in stagefright::MPEG4Extractor::readMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:484 #19 0x7f096f79b454 in stagefright::MPEG4Extractor::getMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:419 #20 0x7f096f77fc09 in mp4_demuxer::MP4Metadata::MP4Metadata(mp4_demuxer::Stream*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/binding/MP4Metadata.cpp:99 #21 0x7f097431801d in MakeUnique<mp4_demuxer::MP4Metadata, nsRefPtr<mp4_demuxer::BufferStream> &> /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/mozilla/UniquePtr.h:642 #22 0x7f097431801d in mozilla::MP4Demuxer::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/fmp4/MP4Demuxer.cpp:93 #23 0x7f0973f043e1 in mozilla::MediaFormatReader::AsyncReadMetadata() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaFormatReader.cpp:288 #24 0x7f0973f81230 in mozilla::detail::MethodCallWithNoArgs<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true>, mozilla::MediaDecoderReader>::Invoke() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:878 #25 0x7f0973f80d76 in mozilla::detail::ProxyRunnable<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true> >::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:938 #26 0x7f0973e7d78a in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:181 #27 0x7f0974006105 in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:256 #28 0x7f096f959021 in nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:228 #29 0x7f096f9593dc in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:242 #30 0x7f096f952f27 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:867 #31 0x7f096f9c1bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #32 0x7f0970226a6f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:326 #33 0x7f09701b2f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #34 0x7f09701b2f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #35 0x7f09701b2f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #36 0x7f096f94f345 in nsThread::ThreadFunc(void*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:360 #37 0x7f097c73f135 in _pt_root /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212 #38 0x7f097cd7d181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181) previously allocated by thread T63 (MediaPl~back #4) here: #0 0x474fe1 in __interceptor_malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74 #1 0x7f096f767594 in allocateStorage /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:279 #2 0x7f096f767594 in typed_data /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:234 #3 0x7f096f767594 in key_value_pair_t /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/TypeHelpers.h:234 #4 0x7f096f767594 in move_forward_type<stagefright::key_value_pair_t<unsigned int, stagefright::MetaData::typed_data> > /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/TypeHelpers.h:188 #5 0x7f096f767594 in stagefright::SortedVector<stagefright::key_value_pair_t<unsigned int, stagefright::MetaData::typed_data> >::do_move_forward(void*, void const*, unsigned long) const /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/SortedVector.h:257 #6 0x7f096f76965f in _do_move_forward /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:500 #7 0x7f096f76965f in stagefright::VectorImpl::_grow(unsigned long, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:409 #8 0x7f096f76bfa0 in insertAt /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:144 #9 0x7f096f76bfa0 in stagefright::SortedVectorImpl::add(void const*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/libutils/VectorImpl.cpp:571 #10 0x7f096f765879 in key_value_pair_t /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/SortedVector.h:200 #11 0x7f096f765879 in add /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/system/core/include/utils/KeyedVector.h:177 #12 0x7f096f765879 in stagefright::MetaData::setData(unsigned int, unsigned int, void const*, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:195 #13 0x7f096f765d66 in stagefright::MetaData::setInt64(unsigned int, long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:69 #14 0x7f096f79ff5c in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1181 #15 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #16 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #17 0x7f096f7a2a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #18 0x7f096f79b62e in stagefright::MPEG4Extractor::readMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:484 #19 0x7f096f79b454 in stagefright::MPEG4Extractor::getMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:419 #20 0x7f096f77fc09 in mp4_demuxer::MP4Metadata::MP4Metadata(mp4_demuxer::Stream*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/binding/MP4Metadata.cpp:99 #21 0x7f097431801d in MakeUnique<mp4_demuxer::MP4Metadata, nsRefPtr<mp4_demuxer::BufferStream> &> /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/mozilla/UniquePtr.h:642 #22 0x7f097431801d in mozilla::MP4Demuxer::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/fmp4/MP4Demuxer.cpp:93 #23 0x7f0973f043e1 in mozilla::MediaFormatReader::AsyncReadMetadata() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaFormatReader.cpp:288 #24 0x7f0973f81230 in mozilla::detail::MethodCallWithNoArgs<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true>, mozilla::MediaDecoderReader>::Invoke() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:878 #25 0x7f0973f80d76 in mozilla::detail::ProxyRunnable<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true> >::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:938 #26 0x7f0973e7d78a in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:181 #27 0x7f0974006105 in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:256 #28 0x7f096f959021 in nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:228 #29 0x7f096f9593dc in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:242 #30 0x7f096f952f27 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:867 #31 0x7f096f9c1bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #32 0x7f0970226a6f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:326 #33 0x7f09701b2f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #34 0x7f09701b2f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #35 0x7f09701b2f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #36 0x7f096f94f345 in nsThread::ThreadFunc(void*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:360 #37 0x7f097c73f135 in _pt_root /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212 #38 0x7f097cd7d181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181) Thread T63 (MediaPl~back #4) created by T60 (MediaPl~back #1) here: #0 0x461855 in pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:175 #1 0x7f097c73babd in _PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f097c73b63a in PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f096f95093d in nsThread::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:470 #4 0x7f096f95693e in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadManager.cpp:249 #5 0x7f096f95800e in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>&&) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:109 #6 0x7f096f9598e7 in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>&&, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:276 #7 0x7f0974004869 in operator nsIEventTarget * /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsIEventTarget.h:37 #8 0x7f0974004869 in operator-> /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/SharedThreadPool.h:51 #9 0x7f0974004869 in mozilla::MediaTaskQueue::DispatchLocked(already_AddRefed<nsIRunnable>, mozilla::MediaTaskQueue::DispatchMode, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:65 #10 0x7f0973fd735c in mozilla::MediaTaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/MediaTaskQueue.h:45 #11 0x7f0973e7d0fc in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:233 #12 0x7f0973e7bda2 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:88 #13 0x7f09740061da in ~AutoTaskGuard /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.h:145 #14 0x7f09740061da in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:257 #15 0x7f096f959021 in nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:228 #16 0x7f096f9593dc in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:242 #17 0x7f096f952f27 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:867 #18 0x7f096f9c1bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #19 0x7f0970226a6f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:326 #20 0x7f09701b2f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #21 0x7f09701b2f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #22 0x7f09701b2f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #23 0x7f096f94f345 in nsThread::ThreadFunc(void*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:360 #24 0x7f097c73f135 in _pt_root /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212 #25 0x7f097cd7d181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181) Thread T60 (MediaPl~back #1) created by T0 (Web Content) here: #0 0x461855 in pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:175 #1 0x7f097c73babd in _PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f097c73b63a in PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f096f95093d in nsThread::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:470 #4 0x7f096f95693e in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadManager.cpp:249 #5 0x7f096f95800e in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>&&) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:109 #6 0x7f096f9598e7 in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>&&, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:276 #7 0x7f0974004869 in operator nsIEventTarget * /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsIEventTarget.h:37 #8 0x7f0974004869 in operator-> /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/SharedThreadPool.h:51 #9 0x7f0974004869 in mozilla::MediaTaskQueue::DispatchLocked(already_AddRefed<nsIRunnable>, mozilla::MediaTaskQueue::DispatchMode, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:65 #10 0x7f0973fd735c in mozilla::MediaTaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/MediaTaskQueue.h:45 #11 0x7f0973e7d0fc in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:233 #12 0x7f0973e7bda2 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:88 #13 0x7f0973e7aef1 in reset /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/mozilla/Maybe.h:373 #14 0x7f0973e7aef1 in mozilla::XPCOMThreadWrapper::FireTailDispatcher() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/AbstractThread.cpp:76 #15 0x7f0973e7b090 in apply<mozilla::XPCOMThreadWrapper, void (mozilla::XPCOMThreadWrapper::*)()> /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsThreadUtils.h:621 #16 0x7f0973e7b090 in nsRunnableMethodImpl<void (mozilla::XPCOMThreadWrapper::*)(), true>::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsThreadUtils.h:828 #17 0x7f0974ed0985 in assign_assuming_AddRef /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/widget/../dist/include/nsCOMPtr.h:336 #18 0x7f0974ed0985 in forget /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/widget/../dist/include/nsCOMPtr.h:574 #19 0x7f0974ed0985 in Forget /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.h:110 #20 0x7f0974ed0985 in nsBaseAppShell::RunSyncSectionsInternal(bool, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.cpp:381 #21 0x7f0974ed152d in RunSyncSections /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.h:95 #22 0x7f0974ed152d in AfterProcessNextEvent /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.cpp:435 #23 0x7f0974ed152d in non-virtual thunk to nsBaseAppShell::AfterProcessNextEvent(nsIThreadInternal*, unsigned int, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/widget/Unified_cpp_widget1.cpp:437 #24 0x7f096f9533f0 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:881 #25 0x7f096f9c1bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #26 0x7f0970225af9 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:95 #27 0x7f09701b2f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #28 0x7f09701b2f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #29 0x7f09701b2f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #30 0x7f0974ecf137 in nsBaseAppShell::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.cpp:165 #31 0x7f0976d366a2 in XRE_RunAppShell /builds/slave/m-in-l64-asan-0000000000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:785 #32 0x7f09701b2f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #33 0x7f09701b2f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #34 0x7f09701b2f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #35 0x7f0976d35d99 in XRE_InitChildProcess /builds/slave/m-in-l64-asan-0000000000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:621 #36 0x48d672 in content_process_main(int, char**) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/app/../contentproc/plugin-container.cpp:236 #37 0x7f096d3c3ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) SUMMARY: AddressSanitizer: heap-use-after-free /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/ESDS.cpp:157 stagefright::ESDS::parseESDescriptor(unsigned long, unsigned long) Shadow bytes around the buggy address: 0x0c0680052650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0680052660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0680052670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0680052680: fa fa fa fa fa fa 00 00 00 03 fa fa 00 00 00 03 0x0c0680052690: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa fd fd =>0x0c06800526a0: fd fd fa fa fd fd fd[fd]fa fa fd fd fd fd fa fa 0x0c06800526b0: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x0c06800526c0: fa fa 00 00 00 fa fa fa fd fd fd fd fa fa 00 00 0x0c06800526d0: 00 01 fa fa 00 00 00 01 fa fa 00 00 00 01 fa fa 0x0c06800526e0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa 0x0c06800526f0: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe
Attached file Testcase —
Blocks: fuzzing-stagefright
Component: Video/Audio → Video/Audio: Playback
Assignee: nobody → jyavenard
See Also: → CVE-2015-4493
Can you give me access to bug 1186718. Thanks
Flags: needinfo?(cdiehl)
Flags: needinfo?(cdiehl)
Patch supplied in bug 1186718 will fix this as I've fixed all occurrences in that function not checking for overflow.
It should be noted that if ffmpeg (and as such chrome) finds an invalid ESDS it just skips it. I've seen some few files that didn't play in FF yet played perfectly with VLC, Chrome or FFmpeg. All that was wrong was the ESDS (but was valid enough so the H264 decoder could make sense of it). so right now, we just abort completely, should we do the same as those other guys?
Flags: needinfo?(ajones)
Depends on: CVE-2015-4493
See Also: CVE-2015-4493 →
May I have access to bug 872136 too?
(In reply to Jean-Yves Avenard [:jya] from comment #4) > so right now, we just abort completely, should we do the same as those other > guys? That seems reasonable. However we should be careful about passing malformed things to the platform. Doing so may mean that media plays on one platform and not another. There are also security implications of malformed data.
Flags: needinfo?(ajones)
(In reply to Jean-Yves Avenard [:jya] from comment #3) > Patch supplied in bug 1186718 will fix this as I've fixed all occurrences in > that function not checking for overflow. This should be fixed then. Christoph, can you verify that?
status-firefox39: ? → wontfix
status-firefox40: ? → affected
status-firefox41: ? → affected
status-firefox-esr38: ? → affected
tracking-firefox40: --- → +
tracking-firefox41: --- → +
tracking-firefox-esr38: --- → ?
Flags: needinfo?(cdiehl)
Yes, seems so, it's not popping up anymore.
Flags: needinfo?(cdiehl)
Al, I am not sure I understand the current status of this bug. Bug 1186718 fixed 40 but you marked 40 as affected in this bug. Anyway, this is too late for 40. We should do something for 41.
status-firefox40: affected → wontfix
Flags: needinfo?(abillings)
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Group: core-security → core-security-release
Group: core-security-release
Whiteboard: [b2g-adv-main2.5+]
Whiteboard: [b2g-adv-main2.5+] → [b2g-adv-main2.5+][fixed by 1186718]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: