2014849 - Assertion failure: extraData.length == 0 (Codecs that use extra data should be explicitly handled already), at /dom/media/mp4/DecoderData.cpp:282

Status: VERIFIED FIXED

(Core :: Audio/Video, defect, P3)

Description

[Tyson Smith [:tsmith]]

Reproduced on mozilla-central rev ed1c0b4f0bbe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ed1c0b4f0bbe --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: extraData.length == 0 (Codecs that use extra data should be explicitly handled already), at /dom/media/mp4/DecoderData.cpp:282

    ==22421==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7a4acbca6aab bp 0x7a4ab43a4340 sp 0x7a4ab43a3e80 T22470)
    ==22421==The signal is caused by a WRITE memory access.
    ==22421==Hint: address points to the zero page.
        #0 0x7a4acbca6aab in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x7a4acbca6aab in mozilla::MP4AudioInfo::Update(Mp4parseTrackInfo const*, Mp4parseTrackAudioInfo const*, mozilla::IndiceWrapper const*) /dom/media/mp4/DecoderData.cpp:280:5
        #2 0x7a4acbcada0e in mozilla::MP4Metadata::GetTrackInfo(mozilla::TrackInfo::TrackType, unsigned long) const /dom/media/mp4/MP4Metadata.cpp:384:18
        #3 0x7a4acbcaacd8 in mozilla::MP4Demuxer::Init() /dom/media/mp4/MP4Demuxer.cpp:162:20
        #4 0x7a4acb890611 in operator() /dom/media/MediaFormatReader.cpp:824:47
        #5 0x7a4acb890611 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaFormatReader::DemuxerProxy::Init()::$_2, mozilla::MozPromise<mozilla::MediaResult, mozilla::MediaResult, false>>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1838:29
        #6 0x7a4ac7541af0 in mozilla::TaskQueue::Runner::Run() /xpcom/threads/TaskQueue.cpp:311:20
        #7 0x7a4ac756869e in nsThreadPool::Run() /xpcom/threads/nsThreadPool.cpp:446:14
        #8 0x7a4ac755fec2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1162:16
        #9 0x7a4ac756594f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #10 0x7a4ac8156418 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #11 0x7a4ac80ae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #12 0x7a4ac80ae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #13 0x7a4ac755baee in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:373:10
        #14 0x7a4ad910f3ac in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #15 0x7a4ad8e9caa3 in start_thread ./nptl/pthread_create.c:447:8
        #16 0x7a4ad8f29c6b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0
    
    ==22421==Register values:
    rax = 0x0000000000000000  rbx = 0x000000000000001b  rcx = 0x000000000000011a  rdx = 0x00007a4ad9004563
    rdi = 0x00007a4ad9005700  rsi = 0x0000000000000000  rbp = 0x00007a4ab43a4340  rsp = 0x00007a4ab43a3e80
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00007a4ab43a4390  r13 = 0x00007a4ab43a43c0  r14 = 0x00007a4a400043e0  r15 = 0x7ffffffffffffffe
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/user/workspace/browsers/m-c-20260205163736-fuzzing-debug/libxul.so+0x90a6aab) (BuildId: 0b411186bb9521ab7e302998bc6191dc011c2d12)
    ==22421==ABORTING

Comment 1

[Tyson Smith [:tsmith]]

Attachment: Detailed Crash Information

Comment 2

[Tyson Smith [:tsmith]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205213633-279b57ef4bf0.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ce0f77cae5a91e2cb4b1ec859117e08aa1182c52 (20250207164009)
End: ed1c0b4f0bbef7e458685d5f4743c73ae66cc3fd (20260205163736)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Tyson Smith [:tsmith]]

Running this in an ASan build does not trigger a failure.

Comment 5

[Paul Adenot (:padenot)]

Attachment: (secure)

TrackTypeToGlobalTrackIndex was counting all audio/video tracks when
mapping per-type indices to global indices, but GetNumberTracks skips
tracks with unknown codecs. This mismatch caused GetTrackInfo to return
the wrong track, triggering an assertion when an unknown codec had
extra data.

Comment 6

[Paul Adenot (:padenot)]

This is an invariant that fails, not a security issue.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/95bbaa823f90
https://hg.mozilla.org/integration/autoland/rev/23a0e6439902
Skip unknown codec tracks in TrackTypeToGlobalTrackIndex. r=media-playback-reviewers,alwu

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/23a0e6439902

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260212213836-06d48ece4edf.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.