2022746 - (CVE-2026-6778) WebM alpha BlockAdditional size confusion causes content-process crash with JS-created Blob

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P3)

Description

[chanhokim]

Attachment: firefox-webm-alpha-blockadditional.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36

Steps to reproduce:

1. Start a local HTTP server in /home/test/neom/target_repo/firefox/layout/reftests/webm-video/.

   Example:
   python3 -m http.server 8000

2. Open Firefox and visit:
   http://127.0.0.1:8000/poc-alpha-blockadditional.html

3. The page fetches webm-alpha.webm, rewrites the first BlockMore element in JavaScript, creates a malformed video/webm Blob, and assigns it to a normal <video> element.

4. The tab crashes while loading the crafted WebM Blob.

Actual results:

Firefox crashes the tab/content process when a crafted WebM Blob is loaded through a normal <video> element.

This is reachable from web JavaScript only. No compromised child process or forged IPC is required.

The issue appears to be in WebM alpha additional-data handling. In media/libnestegg/src/nestegg.c, ne_read_block_additions() can record a nonzero BlockAdditional length even when no payload data was read for a large declared size. This leads to alphaData == NULL with alphaLength > 0.

Later, dom/media/webm/WebMDemuxer.cpp passes that pair into MediaRawData(data, length, alphaData, alphaLength), which reaches the alpha buffer copy path and crashes.

Observed impact so far: reliable JS-triggerable content-process denial of service.

Expected results:

Firefox should reject the malformed WebM file safely without crashing.

Malformed BlockAdditional metadata should cause a controlled media parse/decode failure. The demuxer should validate the declared size against the containing element and should not propagate a nonzero alpha-data length when no payload was actually read.

Comment 1

[Andrew McCreight [:mccr8]]

When I tried this locally, it looks like a null deref.

Comment 2

[Andrew McCreight [:mccr8]]

Attachment: poc.html

There's really no need to attach a zip file containing 2 files where one of them in a plain text file. Please attach the files directly to the bug.

Comment 3

[Andrew McCreight [:mccr8]]

Here's the crash I got when running this test case in Nightly: bp-74226f7a-eeeb-4ff0-94ed-2ae3c0260312

This can probably be unhidden, but I'll mark it sec-low for now to get it off of the triage list.

Comment 4

[chanhokim]

Attachment: poc.html

Comment 5

[Karl Tomlinson (:karlt)]

https://pernos.co/debug/YL8VjSNlMZDTlIMwU2k9wQ/index.html

Comment 6

[Matthew Gregan [:kinetik]]

Attachment: GitHub Pull Request

Comment 7

[Karl Tomlinson (:karlt)]

Attachment: (secure)

nestegg_packet_additional_data() can return a non-zero length with a
null-pointer after failure to parse an ID_BLOCK_ADDITIONAL element.
https://github.com/mozilla/nestegg/issues/76

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3de9ca927f10
https://hg.mozilla.org/integration/autoland/rev/8acc0fc9cbe4
check alpha data pointer instead of length r=kinetik,media-playback-reviewers

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/8acc0fc9cbe4

Comment 10

[Karl Tomlinson (:karlt)]

Attachment: (secure)

The test did crash without this, but is more thorough with a functional
reftest-wait and saves the same bug being copied to other tests.

Comment 11

[Karl Tomlinson (:karlt)]

Attachment: (secure)

"When testing a pointer, use (!myPtr) or (myPtr)"
https://firefox-source-docs.mozilla.org/code-quality/coding-style/coding_style_cpp.html#c-c-practices

Comment 12

[BugBot [:suhaib / :marco]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5876ad2244ad
https://hg.mozilla.org/integration/autoland/rev/c6bb9228acd7
move reftest-wait to html element r=media-playback-reviewers,padenot
https://github.com/mozilla-firefox/firefox/commit/d1bb8ae95406
https://hg.mozilla.org/integration/autoland/rev/54efebd85dea
Convert pointer to boolean instead of comparing with 0 r=media-playback-reviewers,padenot

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/7dacf0411309
https://hg.mozilla.org/integration/autoland/rev/0ca6c72bb326
Revert "Bug 2022746 Convert pointer to boolean instead of comparing with 0 r=media-playback-reviewers,padenot" for causing crashtest failures.

Comment 15

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

• Push with failures
• Failure log

REFTEST TEST-UNEXPECTED-FAIL | dom/media/test/crashtests/2022746.html | load failed: timed out waiting for reftest-wait to be removed

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/37fe0ba0f1b5
https://hg.mozilla.org/integration/autoland/rev/d61353b875f0
Convert pointer to boolean instead of comparing with 0 r=media-playback-reviewers,padenot

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/d61353b875f0

Comment 18

[Karl Tomlinson (:karlt)]

This is a safe null pointer content-process crash.
It does not need to be hidden as security sensitive.
The conditions for the crash are very unlikely to be encountered through the intended use of the API.
I don't think we need to patch this on ESR140, but a patch would be safe and easy, so please let me know if you'd like one.

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/bcfaf2a6ecec
https://hg.mozilla.org/integration/autoland/rev/b9d158480cb5
move reftest-wait to html element r=media-playback-reviewers,padenot

Comment 20

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/b9d158480cb5

Comment 21

[BMO Github Automation]

Authored by https://github.com/karlt
https://github.com/mozilla/enterprise-firefox/commit/bcfaf2a6ececd7b92d1b93bc1e43a462d8807363
[enterprise-main] Bug 2022746 move reftest-wait to html element r=media-playback-reviewers,padenot