Closed Bug 1436117 (CVE-2018-5160) Opened 2 years ago Closed 2 years ago
I420Buffer in Media Pipeline might outlive its buffer
59 bytes, text/x-review-board-request
One use of a WrappedI420Buffer in MediaPipeline  gets passed on further into the stack, but nothing keeps the PlanarYCbCrImage that owns the actual pixel buffer alive. The WrappedI420Buffer outliving the PlanarYCbCrImage would be bad, but I hope and think we only end up reading that data as an image in a webrtc encoder and not doing any writing.  https://searchfox.org/mozilla-central/rev/f80722d4f3bfb722c5ec53880c4a7efb71285676/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp#345-356
2 years ago
Priority: -- → P2
Comment on attachment 8953919 [details] Bug 1436117 - Keep aImage around until the WrappedI420Buffer is released. https://reviewboard.mozilla.org/r/223070/#review229072 lgtm
Attachment #8953919 - Flags: review?(dminor) → review+
Pushed by firstname.lastname@example.org: https://hg.mozilla.org/integration/autoland/rev/ca97ef07a045 Keep aImage around until the WrappedI420Buffer is released. r=dminor
Comment on attachment 8953919 [details] Bug 1436117 - Keep aImage around until the WrappedI420Buffer is released. Approval Request Comment [Feature/Bug causing the regression]: bug 1341285 [User impact if declined]: There's a risk of the webrtc encoder accessing uninitialized memory. However we haven't seen or heard reports about this so I gather it's a very low risk. [Is this code covered by automated tests?]: Yes, though not explicitly testing what this fix is for, as it is speculative. [Has the fix been verified in Nightly?]: It's speculative, so no [Needs manual test from QE? If yes, steps to reproduce]: No [List of other uplifts needed for the feature/fix]: None [Is the change risky?]: No [Why is the change risky/not risky?]: It may extend the lifetime of some internal images. The worst that could happen would be shutdown leaks. [String changes made/needed]: None
Attachment #8953919 - Flags: approval-mozilla-beta?
Comment on attachment 8953919 [details] Bug 1436117 - Keep aImage around until the WrappedI420Buffer is released. I'd like to let this ride with 60 unless you feel strongly about fixing it in 59.
Attachment #8953919 - Flags: approval-mozilla-beta? → approval-mozilla-beta-
You need to log in before you can comment on or make changes to this bug.