2014841 - Assertion failure: aValue <= ((4294967295U) - 1), at /dom/media/BitWriter.cpp:74

Status: VERIFIED FIXED

(Core :: Audio/Video, defect, P2)

Description

[Tyson Smith [:tsmith]]

Reproduced on mozilla-central rev ed1c0b4f0bbe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ed1c0b4f0bbe --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: aValue <= ((4294967295U) - 1), at /dom/media/BitWriter.cpp:74

    ==16331==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7d3bca6cbba9 bp 0x7ffc5b4cc130 sp 0x7ffc5b4cc120 T16331)
    ==16331==The signal is caused by a WRITE memory access.
    ==16331==Hint: address points to the zero page.
        #0 0x7d3bca6cbba9 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x7d3bca6cbba9 in mozilla::BitWriter::WriteUE(unsigned int) /dom/media/BitWriter.cpp:74:3
        #2 0x7d3bcad693fc in mozilla::H264::CreateExtraData(unsigned char, unsigned char, mozilla::H264_LEVEL, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&) /dom/media/platforms/agnostic/bytestreams/H264.cpp:1277:6
        #3 0x7d3bcaca8d55 in mozilla::MP4Decoder::GetTracksInfo(mozilla::MediaContainerType const&, mozilla::MediaResult&) /dom/media/mp4/MP4Decoder.cpp:121:11
        #4 0x7d3bcaca92a0 in mozilla::MP4Decoder::IsSupportedType(mozilla::MediaContainerType const&, mozilla::DecoderDoctorDiagnostics*) /dom/media/mp4/MP4Decoder.cpp:141:17
        #5 0x7d3bca6ebd8c in CanHandleCodecsType /dom/media/DecoderTraits.cpp:89:9
        #6 0x7d3bca6ebd8c in mozilla::CanHandleMediaType(mozilla::MediaContainerType const&, mozilla::DecoderDoctorDiagnostics*) /dom/media/DecoderTraits.cpp:150:28
        #7 0x7d3bcabe0a23 in mozilla::dom::HTMLMediaElement::GetCanPlay(nsTSubstring<char16_t> const&, mozilla::DecoderDoctorDiagnostics*) /dom/media/mediaelement/HTMLMediaElement.cpp:5453:7
        #8 0x7d3bcabec349 in mozilla::dom::HTMLMediaElement::CanPlayType(nsTSubstring<char16_t> const&, nsTSubstring<char16_t>&) /dom/media/mediaelement/HTMLMediaElement.cpp:5470:27
        #9 0x7d3bc8a8e54b in mozilla::dom::HTMLMediaElement_Binding::canPlayType(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./HTMLMediaElementBinding.cpp:507:24
        #10 0x7d3bc9a58206 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3309:13
        #11 0x7d3bce623694 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:490:13
        #12 0x7d3bce622f3f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #13 0x7d3bcdc2cc63 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1698:10
        #14 0x1f8dd5c17dee  ([anon:js-executable-memory]+0xbdee)
    
    ==16331==Register values:
    rax = 0x0000000000000000  rbx = 0x00007ffc5b4cc1e0  rcx = 0x000000000000004a  rdx = 0x00007d3bd7e04563
    rdi = 0x00007d3bd7e05700  rsi = 0x0000000000000000  rbp = 0x00007ffc5b4cc130  rsp = 0x00007ffc5b4cc120
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00000000000002d0  r13 = 0x0000000000000000  r14 = 0x00000000ffffffff  r15 = 0x00000000000002d0
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/user/workspace/browsers/m-c-20260205163736-fuzzing-debug/libxul.so+0x8acbba9) (BuildId: 0b411186bb9521ab7e302998bc6191dc011c2d12)
    ==16331==ABORTING

Comment 1

[Tyson Smith [:tsmith]]

Attachment: Detailed Crash Information

Comment 2

[Tyson Smith [:tsmith]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205213633-279b57ef4bf0.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ce0f77cae5a91e2cb4b1ec859117e08aa1182c52 (20250207164009)
End: ed1c0b4f0bbef7e458685d5f4743c73ae66cc3fd (20260205163736)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Tyson Smith [:tsmith]]

Running this in an ASan build does not trigger a failure.

Comment 5

[Paul Adenot (:padenot)]

Attachment: (secure)

Comment 6

[Paul Adenot (:padenot)]

Impact: we essentially make a mistake at the demuxing stage, not validating some input, and send metadata to a decoder, telling it there's going to be a video that is 0x0 in size. If the decoder has a bug, this can be an issue (and even then, 0x0 is pretty safe), but we perform some checking before handing to the decoder, and I don't think it's a security problem in practice.

Comment 7

[Paul Adenot (:padenot)]

I'm marking this as sec-other.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/145adb078d7b
https://hg.mozilla.org/integration/autoland/rev/510833ef7dcb
Clamp H.264 SPS width/height to minimum macroblock size. r=media-playback-reviewers,alwu

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/510833ef7dcb

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260212213836-06d48ece4edf.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.