1814677 - Assertion failure: rowPtr + rgbStride.value() == endOfRgbBuf, at /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1742

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.avif

Found while fuzzing m-c 20230201-b7f075124503 (--enable-debug --enable-fuzzing)

Requires pref image.avif.sequence.enabled=true

Assertion failure: rowPtr + rgbStride.value() == endOfRgbBuf, at /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1742

#0 0x7f601c913aa8 in mozilla::image::nsAVIFDecoder::Decode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1742:7
#1 0x7f601c910f61 in mozilla::image::nsAVIFDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1181:25
#2 0x7f601c853057 in mozilla::image::Decoder::Decode(mozilla::image::IResumable*) /builds/worker/checkouts/gecko/image/Decoder.cpp:177:19
#3 0x7f601c8529fb in mozilla::image::AnimationSurfaceProvider::Run() /builds/worker/checkouts/gecko/image/AnimationSurfaceProvider.cpp:232:36
#4 0x7f601c875401 in mozilla::image::DecodingTask::Run() /builds/worker/checkouts/gecko/image/DecodePool.cpp:146:12
#5 0x7f601b1aee03 in mozilla::TaskController::RunPoolThread() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:328:33
#6 0x7f602ecf2c86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#7 0x7f602fa73608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#8 0x7f602f61e132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Timothy Nikkel (:tnikkel)]

I required image.avif.sequence.enabled=true in order to reproduce this.

Comment 2

[Zaggy1024]

Attachment: Bug 1814677 - Use the decoded image size for SurfacePipe frame rectangle. r=tnikkel

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ce5c2bdc3cae
Use the decoded image size for SurfacePipe frame rectangle. r=tnikkel

Comment 4

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/ce5c2bdc3cae