1192929 - Openh264: heap-use-after-free [@WelsDec::WelsReorderRefList]

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.264

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

What codebase is this being reported against?  1.4 as is currently being shipped, or OpenH264 trunk?

Comment 3

[Tyson Smith [:tsmith]]

(In reply to Randell Jesup [:jesup] from comment #2)
> What codebase is this being reported against?  1.4 as is currently being
> shipped, or OpenH264 trunk?

This was found while fuzzing trunk. I could not reproduce it on 1.4 with this test case.

Comment 4

[Haibo Zhu]

It is caused by the recently modification and we have fixed it in latest code, please help to check it.

Comment 5

[Tyson Smith [:tsmith]]

I was able to reproduce this with: https://github.com/cisco/openh264/commit/0fb5242b86eda91b4d4f94090b951b63c518e8ec

Comment 6

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 7

[Tyson Smith [:tsmith]]

Attachment: test_case.264

Comment 8

[Tyson Smith [:tsmith]]

Verified with https://github.com/cisco/openh264/commit/5373b8a3aad243245c56e964efa8380ab1fcc44d