2014874 - Assertion failure: wroteSequenceHeader, at /dom/media/platforms/wrappers/MediaChangeMonitor.cpp:749

Status: VERIFIED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Reproduced on mozilla-central rev ed1c0b4f0bbe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ed1c0b4f0bbe --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: wroteSequenceHeader, at /dom/media/platforms/wrappers/MediaChangeMonitor.cpp:749

    ==41390==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x767125d4adc0 bp 0x7670ff422ea0 sp 0x7670ff422e30 T41433)
    ==41390==The signal is caused by a WRITE memory access.
    ==41390==Hint: address points to the zero page.
        #0 0x767125d4adc0 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x767125d4adc0 in mozilla::AV1ChangeMonitor::UpdateConfig(mozilla::AOMDecoder::AV1SequenceInfo const&) /dom/media/platforms/wrappers/MediaChangeMonitor.cpp:749:5
        #2 0x767125d4a7db in mozilla::AV1ChangeMonitor::AV1ChangeMonitor(mozilla::VideoInfo const&) /dom/media/platforms/wrappers/MediaChangeMonitor.cpp:704:7
        #3 0x767125d3b171 in make_unique<mozilla::AV1ChangeMonitor, const mozilla::VideoInfo &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/unique_ptr.h:962:34
        #4 0x767125d3b171 in MakeUnique<mozilla::AV1ChangeMonitor, const mozilla::VideoInfo &> /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:104:10
        #5 0x767125d3b171 in mozilla::MediaChangeMonitor::Create(mozilla::PDMFactory*, mozilla::CreateDecoderParams const&) /dom/media/platforms/wrappers/MediaChangeMonitor.cpp:904:23
        #6 0x767125cff051 in mozilla::PDMFactory::CreateDecoderWithPDM(mozilla::PlatformDecoderModule*, mozilla::CreateDecoderParams const&) /dom/media/platforms/PDMFactory.cpp:0:12
        #7 0x767125cff5dc in mozilla::PDMFactory::CheckAndMaybeCreateDecoder(mozilla::CreateDecoderParamsForAsync&&, unsigned int, mozilla::Maybe<mozilla::MediaResult>) /dom/media/platforms/PDMFactory.cpp:363:9
        #8 0x767125cfe589 in mozilla::PDMFactory::CreateDecoder(mozilla::CreateDecoderParams const&) /dom/media/platforms/PDMFactory.cpp:349:10
        #9 0x767125d2adc6 in operator() /dom/media/platforms/AllocationPolicy.cpp:201:26
        #10 0x767125d2adc6 in InvokeMethod<(lambda at /dom/media/platforms/AllocationPolicy.cpp:189:15), RefPtr<mozilla::MozPromise<RefPtr<mozilla::MediaDataDecoder>, mozilla::MediaResult, true> > ((lambda at /dom/media/platforms/AllocationPolicy.cpp:189:15)::*)(RefPtr<mozilla::AllocPolicy::Token>) const, RefPtr<mozilla::AllocPolicy::Token> > /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:669:14
        #11 0x767125d2adc6 in InvokeCallbackMethod<true, mozilla::MozPromise<RefPtr<mozilla::MediaDataDecoder>, mozilla::MediaResult, true>, (lambda at /dom/media/platforms/AllocationPolicy.cpp:189:15), RefPtr<mozilla::MozPromise<RefPtr<mozilla::MediaDataDecoder>, mozilla::MediaResult, true> > ((lambda at /dom/media/platforms/AllocationPolicy.cpp:189:15)::*)(RefPtr<mozilla::AllocPolicy::Token>) const, RefPtr<mozilla::AllocPolicy::Token> > /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:681:14
        #12 0x767125d2adc6 in mozilla::MozPromise<RefPtr<mozilla::AllocPolicy::Token>, bool, true>::ThenValue<mozilla::AllocationWrapper::CreateDecoder(mozilla::CreateDecoderParams const&, mozilla::AllocPolicy*)::$_0, mozilla::AllocationWrapper::CreateDecoder(mozilla::CreateDecoderParams const&, mozilla::AllocPolicy*)::$_1>::DoResolveOrRejectInternal(mozilla::MozPromise<RefPtr<mozilla::AllocPolicy::Token>, bool, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:874:17
        #13 0x7671258839f2 in mozilla::MozPromise<RefPtr<mozilla::AllocPolicy::Token>, bool, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:505:21
        #14 0x767121541af0 in mozilla::TaskQueue::Runner::Run() /xpcom/threads/TaskQueue.cpp:311:20
        #15 0x76712156869e in nsThreadPool::Run() /xpcom/threads/nsThreadPool.cpp:446:14
        #16 0x76712155fec2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1162:16
        #17 0x76712156594f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #18 0x767122156418 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #19 0x7671220ae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #20 0x7671220ae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #21 0x76712155baee in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:373:10
        #22 0x7671333113ac in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #23 0x767132c9caa3 in start_thread ./nptl/pthread_create.c:447:8
        #24 0x767132d29c6b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0
    
    ==41390==Register values:
    rax = 0x0000000000000000  rbx = 0x00007670ff422ef0  rcx = 0x00000000000002ed  rdx = 0x0000767132e04563
    rdi = 0x0000767132e05700  rsi = 0x0000000000000000  rbp = 0x00007670ff422ea0  rsp = 0x00007670ff422e30
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00000000ffffffff  r13 = 0x000076711dabedc0  r14 = 0x00007670a8003b50  r15 = 0x00000000ffffffff
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/user/workspace/browsers/m-c-20260205163736-fuzzing-debug/libxul.so+0x914adc0) (BuildId: 0b411186bb9521ab7e302998bc6191dc011c2d12)
    ==41390==ABORTING

Comment 1

[Tyson Smith [:tsmith]]

Attachment: Detailed Crash Information

Comment 2

[Tyson Smith [:tsmith]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205213633-279b57ef4bf0.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ce0f77cae5a91e2cb4b1ec859117e08aa1182c52 (20250207164009)
End: ed1c0b4f0bbef7e458685d5f4743c73ae66cc3fd (20260205163736)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Tyson Smith [:tsmith]]

Running the attached testcase in an ASan build does not trigger a failure.

Comment 5

[Paul Adenot (:padenot)]

Attachment: (secure)

MediaCapabilities validation was checking framerate > 0 but not checking
width > 0 or height > 0, allowing zero dimensions to reach decoder creation
and trigger an assertion failure in AV1ChangeMonitor::UpdateConfig when
CreateSequenceHeader failed to write a sequence header for invalid dimensions.

Comment 6

[Paul Adenot (:padenot)]

This just returns potentially incorrect information and won't even crash (and even then, maybe not even incorrect information). Not a security issue.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/aec5a07138ad
https://hg.mozilla.org/integration/autoland/rev/66f843c75b99
Validate video width and height in MediaCapabilities. r=media-playback-reviewers,alwu

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/66f843c75b99

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260216211257-b2277cca6326.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.