1492365 - Crash in mozilla::Span<T>::First

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-2274a51e-92de-4f19-a16f-833c60180918.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll class mozilla::Span<char, 18446744073709551615> mozilla::Span<char, 18446744073709551615>::First mfbt/Span.h:679
1 xul.dll class mozilla::Result<unsigned int, nsresult> mozilla::MediaCacheStream::ReadBlockFromCache dom/media/MediaCache.cpp:2637
2 xul.dll nsresult mozilla::MediaCacheStream::Read dom/media/MediaCache.cpp:2698
3 xul.dll mozilla::MediaCacheStream::ReadAt dom/media/MediaCache.cpp:2778
4 xul.dll nsresult mozilla::MediaResourceIndex::CacheOrReadAt dom/media/MediaResource.cpp:301
5 xul.dll mozilla::MediaResourceIndex::ReadAt dom/media/MediaResource.cpp:266
6 xul.dll mozilla::ResourceStream::ReadAt dom/media/mp4/ResourceStream.cpp:34
7 xul.dll mozilla::SampleIterator::GetNext dom/media/mp4/Index.cpp:120
8 xul.dll struct already_AddRefed<mozilla::MediaRawData> mozilla::MP4TrackDemuxer::GetNextSample dom/media/mp4/MP4Demuxer.cpp:459
9 xul.dll mozilla::MP4TrackDemuxer::GetSamples dom/media/mp4/MP4Demuxer.cpp:534

=============================================================

There are 9 crashes (from 2 installations) in nightly 64 with buildid 20180918075510. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1491132.

[1] https://hg.mozilla.org/mozilla-central/rev?node=e0bd55a3e557

Comment 1

[Jean-Yves Avenard [:jya]]

Attachment: Bug 1492365 - Prevent arithmetic overflow.

Should mStreamLength be > 2^32, we could have overflowed leading to false positive test.

Comment 2

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 9010166 [details]
Bug 1492365 - Prevent arithmetic overflow.

Gerald Squelart [:gerald] has approved the revision.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e52cb4ceec89
Prevent arithmetic overflow. r=gerald

Comment 4

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/e52cb4ceec89

Comment 5

[Jean-Yves Avenard [:jya]]

Comment on attachment 9010166 [details]
Bug 1492365 - Prevent arithmetic overflow.

Approval Request Comment
[Feature/Bug causing the regression]: 1491132
[User impact if declined]: boom on > 4GB video file
[Is this code covered by automated tests?]: no unless we're willing to make the repository size explode
[Has the fix been verified in Nightly?]: no
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: we prevent casting a 64 bits int into 32
[String changes made/needed]: none

Comment 6

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9010166 [details]
Bug 1492365 - Prevent arithmetic overflow.

Crash fix, uplift approved for 63 beta 8, thanks.

Comment 7

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/releases/mozilla-beta/rev/d7d69ea0353c