1332953 - Update libopus to 1.1.4 release

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Description

[NVD]

http://opus-codec.org/release/stable/2017/01/20/libopus-1_1_4.html

"This Opus 1.1.4 release fixes a single bug. A specially-crafted Opus packet could cause an integer wrap-around in the SILK LSF stabilization code. This would cause an out-of-bounds read 256 bytes before a constant table. In most circumstances, the consequences are harmless and the result is simply noise in the audio.

This was reported as CVE-2017-0381. Contrary to that report, our own analysis shows that no remote code execution is possible. However, we are making this release as a precaution."

Comment 1

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Ralph - feel like updating libopus?

Comment 2

[Ralph Giles (:rillian)]

Attachment: Bug 1332953 - Update libopus to 1.1.4.

This fixes a wrap-around issue in SILK LSF stabilization code,
addressing CVE-2017-0381.

Review commit: https://reviewboard.mozilla.org/r/112432/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/112432/

Comment 3

[Matthew Gregan [:kinetik]]

Comment on attachment 8837264 [details]
Bug 1332953 - Update libopus to 1.1.4.

https://reviewboard.mozilla.org/r/112432/#review113860

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4b5f50f51228
Update libopus to 1.1.4. r=kinetik

Comment 5

[Ralph Giles (:rillian)]

Needinfo myself to nominate for aurora uplift.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Let's get this on Beta ahead of the next ESR as well.

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4b5f50f51228

Comment 8

[Julien Cristau [:jcristau]]

Too late for 52.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Whoops, lost track of this one. Ralph, can you please request Aurora approval on this still?

Comment 10

[Ralph Giles (:rillian)]

Thanks for the reminder.

Comment 11

[Ralph Giles (:rillian)]

Comment on attachment 8837264 [details]
Bug 1332953 - Update libopus to 1.1.4.

Approval Request Comment
[Feature/Bug causing the regression]: Opus/WebM audio playback.
[User impact if declined]: Firefox will be vulnerable to a minor CVE. We do not believe this is exploitable, but it is reassuring to ship the fix sooner.
[Is this code covered by automated tests?]: yes.
[Has the fix been verified in Nightly?]: yes.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Change is a single line applying saturating instead wrapping arithmetic, and that change is well tested in other applications. The only possible change of behaviour is better audio output for invalid files.
[String changes made/needed]: None

Comment 12

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8837264 [details]
Bug 1332953 - Update libopus to 1.1.4.

Shipping this more quickly sounds good to me. Let's uplift for aurora 53. Too late for 52 though.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f56e8387be84