Closed Bug 1395244 Opened 7 years ago Closed 7 years ago

index out of bounds [@ mp4parse_get_indice_table]

Categories

(Core :: Audio/Video: Playback, defect, P2)

Product:
Core
Component:
Audio/Video: Playback
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla58
Tracking Flags:
Tracking Status
firefox-esr52 --- disabled
firefox55 --- disabled
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- fixed

People

(Reporter: tsmith, Assigned: ayang)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Attachments

(2 files, 1 obsolete file)

test_case.mp4
13.33 KB, video/mp4
Details
Bug 1395244 - add gtest for index out of bounds in rust mp4 parser.
59 bytes, text/x-review-board-request
kinetik
: review+
Details
Attached video test_case.mp4 — 
thread '<unnamed>' panicked at 'index out of bounds: the len is 0 but the index is 0', /checkout/src/libcollections/vec.rs:1552
stack backtrace:
   0:     0x7f19b921ac03 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7
                               at /checkout/src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:49
   1:     0x7f19b9217bc9 - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be
                               at /checkout/src/libstd/sys_common/backtrace.rs:71
                               at /checkout/src/libstd/sys_common/backtrace.rs:60
                               at /checkout/src/libstd/panicking.rs:355
   2:     0x7f19b9216ff0 - std::panicking::default_hook::he4d55e2dd21c3cca
                               at /checkout/src/libstd/panicking.rs:371
   3:     0x7f19b9216b15 - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d
                               at /checkout/src/libstd/panicking.rs:549
   4:     0x7f19b9216a2f - std::panicking::begin_panic::hcdbfa35c94142fa2
                               at /checkout/src/libstd/panicking.rs:511
   5:     0x7f19b9216999 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81
                               at /checkout/src/libstd/panicking.rs:495
   6:     0x7f19b92247c6 - core::panicking::panic_fmt::h883a028e9f4b4457
                               at /checkout/src/libstd/panicking.rs:471
   7:     0x7f19b922432c - core::panicking::panic_bounds_check::hc3c2775988732c0b
                               at /checkout/src/libcore/panicking.rs:56
   8:     0x7f19b914582f - mp4parse_get_indice_table
                               at /checkout/src/libcollections/vec.rs:1552
                               at /home/worker/workspace/build/src/media/libstagefright/binding/mp4parse_capi/src/lib.rs:999
                               at /home/worker/workspace/build/src/media/libstagefright/binding/mp4parse_capi/src/lib.rs:701
   9:     0x7f19ac54ac0f - _ZN11mp4_demuxer15MP4MetadataRust15ReadTrackIndiceEP18mp4parse_byte_datai
                               at /home/worker/workspace/build/src/media/libstagefright/binding/MP4Metadata.cpp:1008
  10:     0x7f19ac54871f - _ZN11mp4_demuxer11MP4Metadata14GetTrackIndiceEi
                               at /home/worker/workspace/build/src/media/libstagefright/binding/MP4Metadata.cpp:433
  11:     0x7f19b1e78a2e - _ZN7mozilla10MP4Demuxer4InitEv
                               at /home/worker/workspace/build/src/dom/media/fmp4/MP4Demuxer.cpp:247
  12:     0x7f19b1828a1f - _ZN7mozilla6detail21ProxyFunctionRunnableIZNS_17MediaFormatReader12DemuxerProxy4InitEvE4$_10NS_10MozPromiseINS_11MediaResultES6_Lb1EEEE3RunEv
                               at /home/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1027
                               at /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:1511
  13:     0x7f19ac7a8cec - _ZN7mozilla9TaskQueue6Runner3RunEv
                               at /home/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:246
  14:     0x7f19ac7ca461 - _ZN12nsThreadPool3RunEv
                               at /home/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:226
  15:     0x7f19ac7ca95c - _ZThn16_N12nsThreadPool3RunEv
                               at /home/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:154
  16:     0x7f19ac7c131d - _ZN8nsThread16ProcessNextEventEbPb
                               at /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039
  17:     0x7f19ac7c6958 - _Z19NS_ProcessNextEventP9nsIThreadb
                               at /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:521
  18:     0x7f19ad55b41d - _ZN7mozilla3ipc28MessagePumpForNonMainThreads3RunEPN4base11MessagePump8DelegateE
                               at /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:338
  19:     0x7f19ad4bab8b - _ZN11MessageLoop3RunEv
                               at /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326
                               at /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
                               at /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
  20:     0x7f19ac7bbccf - _ZN8nsThread10ThreadFuncEPv
                               at /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:427
  21:     0x7f19c77854d3 - _pt_root
                               at /home/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216
  22:     0x7f19cb1636b9 - start_thread
  23:     0x7f19ca1ec3dc - clone
  24:                0x0 - <unknown>
Flags: in-testsuite?
Assignee: nobody → ayang
Invalid table content.

SampleToChunkBox { samples: [SampleToChunk { first_chunk: 100663297, samples_per_chunk: 2, sample_description_index: 1 }, SampleToChunk { first_chunk: 2, samples_per_chunk: 1, sample_description_index: 1 }] }
Comment on attachment 8904443 [details]
Bug 1395244 - check sample_table before using.

https://reviewboard.mozilla.org/r/176294/#review181202
Attachment #8904443 - Flags: review?(kinetik) → review+
Comment on attachment 8904444 [details]
Bug 1395244 - add gtest for index out of bounds in rust mp4 parser.

https://reviewboard.mozilla.org/r/176296/#review181204
Attachment #8904444 - Flags: review?(kinetik) → review+
Attachment #8904443 - Attachment is obsolete: true
MP4 parser already updated in bug 1401071.
Pushed by ayang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6010c5796517
add gtest for index out of bounds in rust mp4 parser. r=kinetik
https://hg.mozilla.org/mozilla-central/rev/6010c5796517
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox58: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: