1835118 - Assertion failure: mIsValid (Invalid checked integer (division by zero or integer overflow)), at /builds/worker/workspace/obj-build/dist/include/mozilla/CheckedInt.h:562

Status: VERIFIED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.aac

Found while fuzzing m-c 20230524-6b82236cab6f (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.aac

Assertion failure: mIsValid (Invalid checked integer (division by zero or integer overflow)), at /builds/worker/workspace/obj-build/dist/include/mozilla/CheckedInt.h:562

#0 0x7f987a5e0eaa in mozilla::media::TimeUnit::operator>=(mozilla::media::TimeUnit const&) const /builds/worker/checkouts/gecko/dom/media/TimeUnits.cpp
#1 0x7f987a5e205f in mozilla::media::TimeUnit::operator<(mozilla::media::TimeUnit const&) const /builds/worker/checkouts/gecko/dom/media/TimeUnits.cpp:253:18
#2 0x7f987a01b9c1 in max<mozilla::media::TimeUnit> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/stl_algobase.h:224:15
#3 0x7f987a01b9c1 in mozilla::ADTSTrackDemuxer::GetNextFrame(mozilla::adts::Frame const&) /builds/worker/checkouts/gecko/dom/media/ADTSDemuxer.cpp:656:18
#4 0x7f987a0174ec in mozilla::ADTSTrackDemuxer::Init() /builds/worker/checkouts/gecko/dom/media/ADTSDemuxer.cpp:304:30
#5 0x7f987a016f6e in mozilla::ADTSDemuxer::InitInternal() /builds/worker/checkouts/gecko/dom/media/ADTSDemuxer.cpp:250:25
#6 0x7f987a01891f in mozilla::ADTSDemuxer::Init() /builds/worker/checkouts/gecko/dom/media/ADTSDemuxer.cpp:254:8
#7 0x7f987a3e79b6 in operator() /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:784:47
#8 0x7f987a3e79b6 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaFormatReader::DemuxerProxy::Init()::$_2, mozilla::MozPromise<mozilla::MediaResult, mozilla::MediaResult, false>>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1696:29
#9 0x7f9871fa32cb in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
#10 0x7f9871fda52b in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14
#11 0x7f9871fc8b33 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1234:16
#12 0x7f9871fd6124 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#13 0x7f9873be9c41 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#14 0x7f9873a11b1a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
#15 0x7f9873a11b1a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#16 0x7f9873a11b1a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#17 0x7f9871fbf162 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#18 0x7f9898f03b5f in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#19 0x7f9898c94b42 in start_thread nptl/pthread_create.c:442:8
#20 0x7f9898d269ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1835118 using build mozilla-central 20230524214208-6b82236cab6f. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimm, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Tyson Smith [:tsmith]]

Attachment: testcase.zip

Here is a test case that is a bit more bugmon friendly.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230814214038-27c67d619752.
The bug appears to have been introduced in the following build range:

Start: 9fa4a7ae19238256fcd261c727ad2b08c6f1a4fd (20230524162134)
End: 6a96bb1f430f92b83cc31f74db4e4c1f71e155e5 (20230524133440)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9fa4a7ae19238256fcd261c727ad2b08c6f1a4fd&tochange=6a96bb1f430f92b83cc31f74db4e4c1f71e155e5

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1817997

Comment 6

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 7

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

:padenot, since you are the author of the regressor, bug 1817997, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 9

[Paul Adenot (:padenot)]

Attachment: Bug 1835118 - Reject ADTS streams that have an invalid sample-rate index. r?alwu

Comment 10

[Paul Adenot (:padenot)]

Attachment: Bug 1835118 - Fix clang-tidy warnings in ADTSDemuxer.cpp. r?alwu

Depends on D186345

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b534e9cc7137
Reject ADTS streams that have an invalid sample-rate index. r=alwu
https://hg.mozilla.org/integration/autoland/rev/5bdf8e3fbac7
Fix clang-tidy warnings in ADTSDemuxer.cpp. r=alwu

Comment 12

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/b534e9cc7137
https://hg.mozilla.org/mozilla-central/rev/5bdf8e3fbac7

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230818212320-e2305368eaae.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.