2014898 - AssertedCast error: Cannot cast 5e+09 from double to uint32_t: out of range [@ mozilla::WebMDemuxer::ReadMetadata]

Status: VERIFIED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Reproduced on mozilla-central rev ed1c0b4f0bbe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ed1c0b4f0bbe --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

[@ MOZ_CrashSequence]

    ==52479==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x741131bbf355 bp 0x74110a1c34d0 sp 0x74110a1c2fb0 T52528)
    ==52479==The signal is caused by a WRITE memory access.
    ==52479==Hint: address points to the zero page.
        #0 0x741131bbf355 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x741131bbf355 in AssertedCast<unsigned int, double> /builds/worker/workspace/obj-build/dist/include/mozilla/Casting.h:238:5
        #2 0x741131bbf355 in mozilla::WebMDemuxer::ReadMetadata() /dom/media/webm/WebMDemuxer.cpp:526:29
        #3 0x741131bbd4b6 in mozilla::WebMDemuxer::Init() /dom/media/webm/WebMDemuxer.cpp:189:7
        #4 0x741131864b63 in mozilla::TrackBuffersManager::InitializationSegmentReceived() /dom/media/mediasource/TrackBuffersManager.cpp:1319:18
        #5 0x741131863b55 in mozilla::TrackBuffersManager::SegmentParserLoop() /dom/media/mediasource/TrackBuffersManager.cpp:1025:7
        #6 0x74112ced1286 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:18
        #7 0x74112ced1286 in __invoke_impl<nsresult, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
        #8 0x74112ced1286 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
        #9 0x74112ced1286 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
        #10 0x74112ced1286 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
        #11 0x74112ced1286 in apply<nsIThread, nsresult (nsIThread::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1081:12
        #12 0x74112ced1286 in mozilla::detail::RunnableMethodImpl<nsUpdateProcessor*, void (nsUpdateProcessor::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1132:13
        #13 0x74112d141af0 in mozilla::TaskQueue::Runner::Run() /xpcom/threads/TaskQueue.cpp:311:20
        #14 0x74112d16869e in nsThreadPool::Run() /xpcom/threads/nsThreadPool.cpp:446:14
        #15 0x74112d15fec2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1162:16
        #16 0x74112d16594f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #17 0x74112dd56418 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #18 0x74112dcae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #19 0x74112dcae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #20 0x74112d15baee in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:373:10
        #21 0x74113f0bd3ac in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #22 0x74113ea9caa3 in start_thread ./nptl/pthread_create.c:447:8
        #23 0x74113eb29c6b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0
    
    ==52479==Register values:
    rax = 0x00000000000000ee  rbx = 0x000074110a1c30a0  rcx = 0x000058366719b118  rdx = 0x000074113ec04563
    rdi = 0x000074113ec05700  rsi = 0x0000000000000000  rbp = 0x000074110a1c34d0  rsp = 0x000074110a1c2fb0
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x0000000080004005  r13 = 0x0000000000000000  r14 = 0x0000000000000000  r15 = 0x00007410a8005e00
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/user/workspace/browsers/m-c-20260205163736-fuzzing-debug/libxul.so+0x93bf355) (BuildId: 0b411186bb9521ab7e302998bc6191dc011c2d12)
    ==52479==ABORTING

Comment 1

[Tyson Smith [:tsmith]]

Attachment: Detailed Crash Information

Comment 2

[Tyson Smith [:tsmith]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205213633-279b57ef4bf0.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ce0f77cae5a91e2cb4b1ec859117e08aa1182c52 (20250207164009)
End: ed1c0b4f0bbef7e458685d5f4743c73ae66cc3fd (20260205163736)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Tyson Smith [:tsmith]]

Running this in an ASan build does not trigger a failure.

Comment 5

[Paul Adenot (:padenot)]

Attachment: (secure)

A malicious WebM file can specify an audio sampling frequency that exceeds
UINT32_MAX (e.g., 5e9 Hz). The code previously attempted to cast this value
to uint32_t using AssertedCast before validating it, which causes a crash in
debug builds when the value is out of range.

The fix moves the validation before the cast, checking that params.rate is
within valid bounds (0 < rate <= AudioInfo::MAX_RATE) before attempting the
AssertedCast. This prevents the crash while maintaining the same error handling
for invalid sample rates.

Comment 6

[Paul Adenot (:padenot)]

UB, but in practice we get a garbage sample-rate, and that will fail very quickly (we enforce a tight range, something like 8000-384000Hz). sec-other, not dangerous.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ac3dc1feabeb
https://hg.mozilla.org/integration/autoland/rev/5a3ade634f58
Validate WebM audio sample rate before casting to uint32_t. r=media-playback-reviewers,alwu

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/5a3ade634f58

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260213212122-0d74a4189e30.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.