1937978 - ClearKey crash on AV1

Status: VERIFIED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[vitaly.ivanov]

Attachment: Screenshot 2024-12-18 102559.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Steps to reproduce:

1. Download https://github.com/vitaly-castLabs/mse-eme-player/blob/main/media/av1-test-v-encr.mp4
2. Open https://vitaly-castlabs.github.io/mse-eme-player/ in Firefox.
3. Set MIME to video/mp4;codecs="av01.0.04M.08".
4. Hit Browse... and select the file downloaded in step 1.

Tested on Win 11 24H2, Core Ultra 7 258V laptop, no external GPU

Actual results:

It shows 1 frame and stops with "The clearkey plugin has crashed"

Expected results:

Normal playback. The video can be played by Chrome and ffplay (ffplay -decryption_key 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c ./av1-test-v-encr.mp4) without any issues

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video: Playback' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Mayank Bansal]

I get this crash report: https://crash-stats.mozilla.org/report/index/93c819d3-fcb7-4972-ab00-d55a10241218#tab-bugzilla

Comment 3

[Mayank Bansal]

Bisection:
Bug 1601817 - Add plumbing to expose Widevine and Clearkey AV1 support. r=media-playback-reviewers,geckoview-reviewers,owlish,alwu

This patch adds in the necessary plumbing to allow attempting to use the
Widevine and Clearkey plugins for EME decryption with AV1 codecs.

Differential Revision: https://phabricator.services.mozilla.com/D174359

Comment 4

[Mayank Bansal]

Profile with "media playback" preset logging: https://share.firefox.dev/4glX9fG

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1601817

Comment 6

[vitaly.ivanov]

This might happen (just a shot in the dark) due to SVT AV1 encoder not producing OBU_TEMPORAL_DELIMITERs consistently - they seemed to be dropped randomly. When I switch to libaom (or standalone aomenc), the crash no longer happens. So this works:

ffmpeg -f lavfi -i testsrc=n=2:size=640x480:rate=30 -t 5 -f yuv4mpegpipe -pix_fmt yuv420p - | aomenc - --codec=av1 --obu --i420 --width=640 --height=480 --fps=30/1 --cpu-used=5 --rt --cq-level=40 --tile-rows=2 --num-tile-groups=2 -o av1-test.obu && \
ffmpeg -i av1-test.obu -c:v copy -f mp4 -movflags frag_keyframe+empty_moov+default_base_moof av1-test-frag.mp4 && \
packager in=av1-test-frag.mp4,stream=video,output=av1-test-frag-encr.mp4,drm_label=VIDEO --protection_scheme cbcs --enable_raw_key_encryption --keys label=VIDEO:key_id=00000000000000000000000000000001:key=3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c:iv=d5fbd6b82ed93e4ef98ae40931ee33b7 --protection_systems CommonSystem --segment_duration 1 --fragment_duration 1 --fragment_sap_aligned=false --segment_sap_aligned=false --clear_lead 0 --nogenerate_sidx_in_media_segments

While if I generate it the way it's described here, the resulting encrypted fmp4 crashes ClearKey plugin:
https://github.com/vitaly-castLabs/mse-eme-player/blob/main/README.md

Comment 7

[Andreas Pehrson [:pehrsons]]

I got notice of this crash through the following STR:

• Open https://reference.dashif.org/dash.js/nightly/samples/dash-if-reference-player/
• In the text field at the top, enter https://svt-vod-secure-2b.akamaized.net/d0/secure/20241218/ff65efc1-ad40-4e5f-a498-0067637330a3/dash-avc.mpd (Note geoblocked to Sweden)
• Click Load

Expected Result:
Video plays

Actual Result:
Plugin process crashes in ClearKeyUtils::DecryptCbcs, accessing the first element in an empty Span.

Reporting success when decrypting an empty buffer works for the case above, I'll put up a patch to propose this as a fix.

Comment 8

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1937978 - Exit early with success when decrypting an empty CBCS subsample buffer with ClearKey. r?#media-playback-reviewers

Without the early exit, DecryptCbcs() will try to get the address of the first
element in the subsample (Span), which with length 0 is forbidden.

This could also be solved by getting the address of the Span through data()
instead, to avoid dereferencing the first element. That seems more like a
footgun than the early exit however.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2b4b08e13b75
Exit early with success when decrypting an empty CBCS subsample buffer with ClearKey. r=media-playback-reviewers,aosmond

Comment 10

[Andreas Pehrson [:pehrsons]]

Bug 1601817 is the regressor because it enables ClearKey for AV1. However, this may impact other codecs too.

Comment 11

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/2b4b08e13b75

Comment 12

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1937978 - Exit early with success when decrypting an empty CBCS subsample buffer with ClearKey. r?#media-playback-reviewers

Without the early exit, DecryptCbcs() will try to get the address of the first
element in the subsample (Span), which with length 0 is forbidden.

This could also be solved by getting the address of the Span through data()
instead, to avoid dereferencing the first element. That seems more like a
footgun than the early exit however.

Original Revision: https://phabricator.services.mozilla.com/D235310

Comment 13

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Decoding of some media content will fail due to plugin process crashes
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See https://bugzilla.mozilla.org/show_bug.cgi?id=1937978#c0 and https://bugzilla.mozilla.org/show_bug.cgi?id=1937978#c7; also https://bugzilla.mozilla.org/show_bug.cgi?id=1908682#c0 if you can get access
• Risk associated with taking this patch: Low
• Explanation of risk level: Adds early exit guards for cases that would otherwise crash
• String changes made/needed: None
• Is Android affected?: no

Comment 14

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1937978 - Exit early with success when decrypting an empty CBCS subsample buffer with ClearKey. r?#media-playback-reviewers

Without the early exit, DecryptCbcs() will try to get the address of the first
element in the subsample (Span), which with length 0 is forbidden.

This could also be solved by getting the address of the Span through data()
instead, to avoid dereferencing the first element. That seems more like a
footgun than the early exit however.

Original Revision: https://phabricator.services.mozilla.com/D235310

Comment 15

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Decoding of some media content will fail due to plugin process crashes
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See https://bugzilla.mozilla.org/show_bug.cgi?id=1937978#c7; https://bugzilla.mozilla.org/show_bug.cgi?id=1908682#c0 if you can get access
• Risk associated with taking this patch: Low
• Explanation of risk level: Trivial; adds early exit guards for cases that would otherwise crash
• String changes made/needed: None
• Is Android affected?: no

Comment 16

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/6c46a2d74575

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/86a0bf4b5094

Comment 18

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Attachment: 1937978.gif

Reproduced the issue with Firefox 136.0a1 (2025-01-20) on Windows 10x64 by following steps from comment 0 and comment 7. Clearkey plugin crashes after following the steps.
The issue is verified fixed with Firefox 136.0a1 (2025-01-26), 135.0b10 (20250124174536 - comment 17) and 128.7.0esr (20250124132142 - comment 16) on Windows 10x64, macOS 12 and Ubuntu 24. The clearkey plugin no longer crashes and the videos are successfully played after following the steps from comment 0 and comment 7. Unfortunately, we don't have an account for the https://www.pw.live/ webpage.
However, on Windows 10x64 with Nightly 136.0a1 (2025-01-26) if I click the seek bar from comment 0 to almost the end I get an Video can't be played because the file is a corrupt error (see screen recording). This only happens with the latest nightly and on Windows 10x64. I cannot reproduce this with 135.0b10 (20250124174536 - comment 17) and 128.7.0esr (20250124132142 - comment 16). Should we close this one and file a new issue for this? Thank you!

Comment 19

[Andreas Pehrson [:pehrsons]]

Yes, please file another issue, this seems separate.

Comment 20

[Alexandru Trif, Desktop Test Engineering [:atrif]]

(In reply to Andreas Pehrson [:pehrsons] from comment #19)

Yes, please file another issue, this seems separate.

Thank you! I have filed bug 1943934. Closing this one as verified per comment 18.