1791596 - UaF in [@ mozilla::AudioSegment::Mix ]

Status: RESOLVED DUPLICATE of bug 1605894

(Core :: WebRTC: Audio/Video, defect)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

STRs:

1. In about:config set media.getusermedia.audiocapture.enabled to true
2. Open https://jsfiddle.net/jib1/zecvu1dz/16/
3. Wait, or twiddle the pause/play button of the element for a while seems to help

Expected result: No crash
Actual result: bp-9ee9c0fe-9b4c-45aa-8757-46ed10220919

The crash address 0x000000010c920000 suggests a UaF.

Reproed at least twice on macOS. I have to wait a bit, usually 10 seconds or more, but then it seems to hit reliably for me.

Comment 1

[Andrew McCreight [:mccr8]]

This looks like it could be a dupe of bug 1605894. The crash report has PHC information in there. It says "PHC Kind" is "GuardPage", which maybe is more of a buffer overflow like the other bug?

Comment 2

[Tyson Smith [:tsmith]]

I tested with an ASan builds and got the same results as seen in bug 1605894.