If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

nestegg: value is outside the range of representable values of type 'unsigned long' in [@nestegg_duration] nestegg.c:2080

RESOLVED FIXED

Status

()

Core
Audio/Video: Playback
P1
normal
RESOLVED FIXED
a year ago
a year ago

People

(Reporter: tsmith, Assigned: kinetik)

Tracking

(Blocks: 1 bug, {testcase})

Trunk
testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox51 affected)

Details

Attachments

(2 attachments)

(Reporter)

Description

a year ago
I found this while fuzzing nestegg commit 4d261a4df28fc193ffa9360bffdb3dbe9947a44c

Run the attached test case in a Undefined Behavior Sanitizer (UBSan) build to trigger the following error:

src/nestegg.c:2080:32: runtime error: value 1.01615e+59 is outside the range of representable values of type 'unsigned long'
    #0 0x4f28fd in nestegg_duration /home/user/code/nestegg/src/nestegg.c:2080:32
    #1 0x4ea248 in main /home/user/code/nestegg/test/test.c:112:7
    #2 0x7f798552982f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
    #3 0x4188e8 in _start (/home/user/workspace/nestegg/test+0x4188e8)
(Reporter)

Comment 1

a year ago
Created attachment 8780272 [details]
test_case.webm
(Assignee)

Updated

a year ago
Assignee: nobody → kinetik
(Assignee)

Updated

a year ago
See Also: → bug 1278515
(Assignee)

Comment 2

a year ago
Created attachment 8780355 [details] [review]
fix for this and bug 1294549

Fixes for this bug and bug 1294549.

For this bug: check that it's safe to convert unscaled_duration to a uint64_t before casting it.

For bug 1294549: treat a tc_scale of 0 as a hard error.

r? gerald since :rillian is away until Monday, but I can wait if you don't feel comfortable reviewing this code.
Attachment #8780355 - Flags: review?(gsquelart)
(Assignee)

Comment 3

a year ago
Comment on attachment 8780355 [details] [review]
fix for this and bug 1294549

Ralph is back.
Attachment #8780355 - Flags: review?(gsquelart) → review?(giles)
Attachment #8780355 - Flags: review?(giles) → review+
(Reporter)

Comment 4

a year ago
Verified fixed with nestegg revision 9b7b79412432df3c3f996b42eac19ce60d56ee48. Thanks!
Priority: -- → P1
(Assignee)

Updated

a year ago
Depends on: 1296988
Matthew: is this fixed, or can the patch can be landed?
Flags: needinfo?(kinetik)
(Assignee)

Comment 6

a year ago
Fixed by bug 1296988.
Status: NEW → RESOLVED
Last Resolved: a year ago
Flags: needinfo?(kinetik)
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.