1791365 - UndefinedBehaviorSanitizer: dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp:996:24: runtime error: load of value 96, which is not a valid value for type 'enum AVColorSpace'

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20220917-09d4c0163454 (fuzzing build).

For detailed crash information, see attachment.

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing --target firefox gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run FUZZER=MediaWebM objdir/dist/bin/firefox test.bin

This could be security-sensitive: This particular UBSan message of loading an invalid enum value is a typical symptom of uninitialized memory. It is likely that mFrame->colorspace is uninitialized here. However, a cursory look at the code suggests that the value is only flowing into a switch statement with a default case and not used further. On the other hand, there could be more parts of mFrame uninitialized, so we should check first what the source of the issue here is.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Daniel Veditz [:dveditz]]

Paul: who can take a look here?

Comment 4

[Paul Adenot (:padenot)]

This is on an AV1 decoded via ffmpeg, we only do this on Linux. Looks like other members don't have correct values as well, lots of errors on stdout.

Comment 5

[Paul Adenot (:padenot)]

https://pernos.co/debug/Xfocc_ZLL6uIh4ogAMvWVA/index.html

Comment 6

[Paul Adenot (:padenot)]

It's initialized to a bogus value, directly from the codec byte-stream, and we fall back to a good default value in the switch.

Then the code errors out as it should, because the file isn't valid, this isn't security sensitive, but I'll make a patch regardless to silence this.

Comment 7

[Paul Adenot (:padenot)]

Attachment: Bug 1791365 - Don't copy invalid enum value in FFmpegVideoDecoder to avoid tripping UBSan. r?alwu

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/47a79816520b
Don't copy invalid enum value in FFmpegVideoDecoder to avoid tripping UBSan. r=alwu

Comment 9

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/47a79816520b

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:padenot, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox106 to wontfix.

For more information, please visit auto_nag documentation.