Closed Bug 1202619 Opened 10 years ago Closed 10 years ago

SEGV in FastConvertYUVToRGB32Row

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1194933

People

(Reporter: attekett, Assigned: jnicol)

Details

(5 keywords)

Attachments

(1 file)

firefox-SEGV-FastConvertYUVToRGB32Row1.video
12.01 KB, application/octet-stream
Details
Tested on: OS: Ubuntu 14.04 Firefox: ASAN-build from https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64-asan/1441620204/ You need the following html-file to load the attached video-file to trigger the crash: <html> <video width=40 height=40 src='./firefox-SEGV-FastConvertYUVToRGB32Row1.video'></video> <script> var num=0 function changeTest(){ var tag=document.getElementsByTagName('video')[0] num++ tag.src='./firefox-SEGV-FastConvertYUVToRGB32Row1.video' tag.width=num setTimeout(changeTest,100) } changeTest() </script> </html> These two bugs might be related: https://bugzilla.mozilla.org/show_bug.cgi?id=672870 https://bugzilla.mozilla.org/show_bug.cgi?id=750190 ASAN-trace: ASAN:SIGSEGV ================================================================= ==7691==ERROR: AddressSanitizer: SEGV on unknown address 0x7f682f4b2000 (pc 0x7f6869c20351 sp 0x7ffe5dd1a628 bp 0x7ffe5dd1a6d0 T0) #0 0x7f6869c20350 in FastConvertYUVToRGB32Row /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/ycbcr/yuv_row_posix.cpp:22 #1 0x7f6869c21a31 in ConvertYCbCrToRGB32 /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/ycbcr/yuv_convert.cpp:92 #2 0x7f6869c20c8a in ConvertYCbCrToRGB /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/ycbcr/YCbCrUtils.cpp:140 #3 0x7f6869ceb090 in GetAsSourceSurface /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/ImageContainer.cpp:578 #4 0x7f6869f3ef3d in GetAsSourceSurface /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp:80 #5 0x7f6869d1e69c in Paint /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/basic/BasicImageLayer.cpp:81 #6 0x7f6869dfe0b4 in PaintSelfOrChildren /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/basic/BasicLayerManager.cpp:806 #7 0x7f6869dfb9d2 in PaintLayer /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/basic/BasicLayerManager.cpp:919 #8 0x7f6869df6fcd in EndTransactionInternal /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/basic/BasicLayerManager.cpp:532 #9 0x7f686e079d19 in PaintInactiveLayer /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/FrameLayerBuilder.cpp:3521 #10 0x7f686e07c8df in DrawPaintedLayer /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/FrameLayerBuilder.cpp:5665 #11 0x7f6869e19503 in PaintThebes /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/client/ClientPaintedLayer.cpp:87 #12 0x7f6869e19e38 in RenderLayerWithReadback /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/client/ClientPaintedLayer.cpp:141 #13 0x7f6869e73c77 in RenderLayer /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/client/ClientContainerLayer.h:65 #14 0x7f6869e1395f in EndTransactionInternal /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/client/ClientLayerManager.cpp:281 #15 0x7f6869e13e8e in EndTransaction /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/layers/client/ClientLayerManager.cpp:324 #16 0x7f686e1ac1fb in PaintRoot /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsDisplayList.cpp:1682 #17 0x7f686e2547a4 in PaintFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsLayoutUtils.cpp:3344 #18 0x7f686e2d23d7 in Paint /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsPresShell.cpp:6159 #19 0x7f686d94b93c in ProcessPendingUpdatesPaint /builds/slave/m-cen-l64-asan-000000000000000/build/src/view/nsViewManager.cpp:466 #20 0x7f686d94b0be in ProcessPendingUpdatesForView /builds/slave/m-cen-l64-asan-000000000000000/build/src/view/nsViewManager.cpp:397 . . .
Group: firefox-core-security → gfx-core-security, core-security
Component: General → Graphics
Product: Firefox → Core
Milan: please assign the appropriate person to look at this.
Group: core-security
Flags: sec-bounty?
Flags: needinfo?(milan)
Jamie, give this a try - Lee, you can review?
Assignee: nobody → jnicol
Flags: needinfo?(milan)
(In reply to Milan Sreckovic [:milan] from comment #2) > Jamie, give this a try - Lee, you can review? Sure, if Jamie can track it down.
I unfortunately cannot reproduce this, I just get a blank page. There's a video element that's expanding if you check the inspector, but it's just white so you can't see anything. I also cannot play the video in any application, I don't know if that's to be expected?
I pretty much got the same results Jamie mentioned in comment # 4. I tried the following but couldn't reproduce the crash: - opening the poc in several tabs/windows and waiting 5-10 minutes - tried with both e10s enabled & disabled - closing fx while the poc was opened to see if that generated a crash while fx was closing - opened the poc about 15 times in new tabs and quickly closed them one by one hoping that could possibly trigger a crash - tried opening the video file in a tab to see if that generated a crash - tried reproducing the crash with several asan builds that are a few days older than the build mentioned in comment # 0 I also get the following message in the browser console: "Media resource file:///home/kjozwiak/Desktop/poc/firefox-SEGV-FastConvertYUVToRGB32Row1.video could not be decoded." Atte, does this crash happen instantly once you open the poc? Is there a set of specific steps that need to be followed to reproduce this?
My steps to reproduce the crash: 1. Downloaded ASAN-prebuild from http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64-asan/1442846095/ and extracted it. 2. Downloaded repro-file and created test.html with the content from the original report. 3. Opened test.html with firefox from prebuild. 4. Waited around 10-20s and ASAN:SIGSEGV ================================================================= ==24978==ERROR: AddressSanitizer: SEGV on unknown address 0x7ff283b00000 (pc 0x7ff2b6ba7bf1 sp 0x7ffefcf0fe28 bp 0x7ffefcf0fed0 T0)
Does the video file play for you in other media players? And do you get the message in the console "Media resource ... could not be decoded"? And can you see a video being played for the 10-20s before the crash? I'm wondering if perhaps the video file was corrupted when uploading to bugzilla
Flags: needinfo?(attekett)
I'm using the file I downloaded from bugzilla. The video-file is fuzzed file and it doesn't play on Chrome and Totem on Ubuntu. I'm currently investigating if there is some settings on my system that affect Firefox.
Flags: needinfo?(attekett)
Thought that might be the case, just trying to eliminate potential reasons why I cannot reproduce. I am running Ubuntu 15.04, which could make a difference. 14.04 doesn't play nice on my work laptop so I'll try on a live CD on my personal laptop later tonight.
Okay. This issue might be my fault. On my fuzzing cluster I use user.js from https://github.com/MozillaSecurity/fuzzdata/blob/master/settings/firefox/prefs.js Note: Looks like my version of that file is outdated and has small diff to current one. diff ~/Downloads/prefs.js ~/firefox-prof/user.js 37d36 < user_pref("media.fragmented-mp4.gmp.enabled", true); That might also have some effect. Can't check currently.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
This is a direct duplicate of a bug Tyson found a month earlier so minused for bounty.
Flags: sec-bounty? → sec-bounty-
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: