1892221 - UndefinedBehaviorSanitizer: third_party/libwebrtc/modules/video_capture/linux/video_capture_v4l2.cc:334:7: runtime error: load of value 228, which is not a valid value for type 'bool'

Status: RESOLVED FIXED

(Core :: WebRTC, defect, P1)

Description

[Christian Holler (:decoder)]

In experimental IPC fuzzing, we found the following crash on mozilla-central revision 20240417-795f884f7ce1 (fuzzing-asan-nyx-opt build):

third_party/libwebrtc/modules/video_capture/linux/video_capture_v4l2.cc:334:7: runtime error: load of value 228, which is not a valid value for type 'bool'
    #0 0x7fffe793c303 in webrtc::videocapturemodule::VideoCaptureModuleV4L2::StopCapture() third_party/libwebrtc/modules/video_capture/linux/video_capture_v4l2.cc:334:7
    #1 0x7fffe794874a in webrtc::videocapturemodule::VideoCaptureModuleV4L2::~VideoCaptureModuleV4L2() third_party/libwebrtc/modules/video_capture/linux/video_capture_v4l2.cc:115:3
    #2 0x7fffe794888c in rtc::RefCountedObject<webrtc::videocapturemodule::VideoCaptureModuleV4L2>::~RefCountedObject() third_party/libwebrtc/rtc_base/ref_counted_object.h:55:32
    #3 0x7fffe79485f3 in rtc::RefCountedObject<webrtc::videocapturemodule::VideoCaptureModuleV4L2>::Release() const third_party/libwebrtc/rtc_base/ref_counted_object.h:41:7
    #4 0x7fffe792cf51 in webrtc::scoped_refptr<webrtc::videocapturemodule::VideoCaptureModuleV4L2>::~scoped_refptr() third_party/libwebrtc/api/scoped_refptr.h:103:13
    #5 0x7fffe792cf51 in webrtc::videocapturemodule::VideoCaptureImpl::Create(webrtc::VideoCaptureOptions*, char const*) third_party/libwebrtc/modules/video_capture/linux/video_capture_linux.cc:72:3
    #6 0x7fffe794ad2c in webrtc::VideoCaptureFactory::Create(webrtc::VideoCaptureOptions*, char const*) third_party/libwebrtc/modules/video_capture/video_capture_factory.cc:30:10
    #7 0x7fffe0968a3e in mozilla::VideoCaptureFactory::CreateVideoCapture(int, char const*, mozilla::camera::CaptureDeviceType) dom/media/systemservices/video_engine/video_capture_factory.cc:85:12
    #8 0x7fffe08dd442 in mozilla::camera::VideoEngine::CreateVideoCapture(char const*) dom/media/systemservices/VideoEngine.cpp:68:50
    #9 0x7fffe091bb38 in mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::operator()(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const dom/media/systemservices/CamerasParent.cpp:807:38
    #10 0x7fffe091bb38 in std::enable_if<TakesAnyArguments<RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>> (mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::*)(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const>, mozilla::detail::MethodTrait<RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>> (mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::*)(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const>::ReturnType>::type mozilla::MozPromise<bool, bool, true>::InvokeMethod<mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0, RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>> (mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::*)(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const, mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue>(mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0*, RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>> (mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::*)(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const, mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) dist/include/mozilla/MozPromise.h:651:12
    #11 0x7fffe091bb38 in std::enable_if<true, void>::type mozilla::MozPromise<bool, bool, true>::InvokeCallbackMethod<true, mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0, RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>> (mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::*)(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const, mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue, RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>::Private>>(mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0*, RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>> (mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0::*)(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&) const, mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&&, RefPtr<mozilla::MozPromise<std::tuple<int, int>, bool, true>::Private>&&) dist/include/mozilla/MozPromise.h:667:14
    #12 0x7fffe091bb38 in mozilla::MozPromise<bool, bool, true>::ThenValue<mozilla::camera::CamerasParent::RecvAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&)::$_0>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&) dist/include/mozilla/MozPromise.h:921:7
    [...]

I looked into the stack and it looks like we are accessing the _streaming variable here

https://searchfox.org/mozilla-central/rev/c7df16ffad1f12a19c81c16bce0b65e4a15304d0/third_party/libwebrtc/modules/video_capture/linux/video_capture_v4l2.cc#334

although it hasn't been initialized (StartCapture hasn't been called, we are stopping from the destructor, looks like some kind of capabilities check to me (allocating, initializing and destroying without starting a capture)).

Should likely be fixed by default-initializing the class members which would be best practice anyways. I don't think this is a security issue, you cannot read back the uninitialized memory, or otherwise reasonably observe what it was.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1892221 - Initialize VideoCaptureModuleV4L2::_streaming in ctor. r?#webrtc-reviewers

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1888181

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/00c4bd7039dc
Initialize VideoCaptureModuleV4L2::_streaming in ctor. r=webrtc-reviewers,dbaker

Comment 6

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/00c4bd7039dc