2054208 - crash at null in [@ mozilla::WebrtcAudioConduit::OnDtmfEvent]

Status: VERIFIED FIXED

(Core :: WebRTC: Audio/Video, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing m-c 20260709-8edd37202070 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

==50117==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7bffd9598366 bp 0x7bff9ffdecd0 sp 0x7bff9ffdecd0 T37)
==50117==The signal is caused by a READ memory access.
==50117==Hint: address points to the zero page.
    #0 0x7bffd9598366 in mozilla::WebrtcAudioConduit::OnDtmfEvent(mozilla::DtmfEvent const&) /builds/worker/workspace/obj-build/dom/media/webrtc/libwebrtcglue/./../../../../../../checkouts/gecko/dom/media/webrtc/libwebrtcglue/AudioConduit.cpp:265:16
    #1 0x7bffd95fc5ea in operator() /builds/worker/workspace/obj-build/dist/include/MediaEventSource.h:672:11
    #2 0x7bffd95fc5ea in void mozilla::detail::ListenerImpl<(mozilla::ListenerPolicy)2, mozilla::MediaEventListener mozilla::MediaEventSourceImpl<(mozilla::ListenerPolicy)2, mozilla::DtmfEvent>::Connect<mozilla::WebrtcAudioConduit, void (mozilla::WebrtcAudioConduit::*)(mozilla::DtmfEvent const&)>(nsIEventTarget*, mozilla::WebrtcAudioConduit*, void (mozilla::WebrtcAudioConduit::*)(mozilla::DtmfEvent const&))::'lambda'(mozilla::DtmfEvent const&), mozilla::DtmfEvent>::ApplyWithArgs<mozilla::DtmfEvent const&>(mozilla::DtmfEvent const&) /builds/worker/workspace/obj-build/dist/include/MediaEventSource.h:431:7
    #3 0x7bffd9432beb in operator()<const mozilla::DtmfEvent &> /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:149:25
    #4 0x7bffd9432beb in std::tuple<mozilla::DtmfEvent> const& std::__invoke_impl<void, void mozilla::detail::ListenerBatch<mozilla::detail::Listener<(mozilla::ListenerPolicy)2, mozilla::DtmfEvent>>::ApplyWithArgsTuple<std::tuple<mozilla::DtmfEvent> const&>(std::tuple<mozilla::DtmfEvent> const&)::'lambda'(auto&&...), mozilla::DtmfEvent const&>(std::__invoke_other, void mozilla::detail::ListenerBatch<mozilla::detail::Listener<(mozilla::ListenerPolicy)2, mozilla::DtmfEvent>>::ApplyWithArgsTuple<std::tuple<mozilla::DtmfEvent> const&>(std::tuple<mozilla::DtmfEvent> const&)::'lambda'(auto&&...)&&, mozilla::DtmfEvent const&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
    #5 0x7bffd94322eb in __invoke<(lambda at /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:146:9), const mozilla::DtmfEvent &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
    #6 0x7bffd94322eb in __apply_impl<(lambda at /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:146:9), const std::tuple<mozilla::DtmfEvent> &, 0UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
    #7 0x7bffd94322eb in apply<(lambda at /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:146:9), const std::tuple<mozilla::DtmfEvent> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
    #8 0x7bffd94322eb in ApplyWithArgsTuple<const std::tuple<mozilla::DtmfEvent> &> /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:145:5
    #9 0x7bffd94322eb in mozilla::detail::NotificationPolicy<(mozilla::ListenerPolicy)2, mozilla::detail::Listener<(mozilla::ListenerPolicy)2, mozilla::DtmfEvent>>::SharedArgs<mozilla::DtmfEvent>::ApplyWithArgs(mozilla::detail::ListenerBatch<mozilla::detail::Listener<(mozilla::ListenerPolicy)2, mozilla::DtmfEvent>>*) /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:290:15
    #10 0x7bffcff60407 in operator()<StoreRefPtrPassByPtr<mozilla::net::ConnectionData> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1076:18
    #11 0x7bffcff60407 in __invoke_impl<nsresult, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1075:9), StoreRefPtrPassByPtr<mozilla::net::ConnectionData> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
    #12 0x7bffcff60407 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1075:9), StoreRefPtrPassByPtr<mozilla::net::ConnectionData> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
    #13 0x7bffcff60407 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1075:9), std::tuple<StoreRefPtrPassByPtr<mozilla::net::ConnectionData> > &, 0UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
    #14 0x7bffcff60407 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1075:9), std::tuple<StoreRefPtrPassByPtr<mozilla::net::ConnectionData> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
    #15 0x7bffcff60407 in apply<mozilla::net::Dashboard, nsresult (Dashboard::*)(mozilla::net::ConnectionData *)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1074:12
    #16 0x7bffcff60407 in mozilla::detail::RunnableMethodImpl<mozilla::ChildProfilerController*, void (mozilla::ChildProfilerController::*)(mozilla::ProfileAndAdditionalInformation*), true, (mozilla::RunnableKind)0, mozilla::ProfileAndAdditionalInformation*>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1125:13
    #17 0x7bffd1563632 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/TaskDispatcher.h:232:35
    #18 0x7bffd157ccc5 in mozilla::TaskQueue::Runner::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskQueue.cpp:297:17
    #19 0x7bffd15a7d17 in nsThreadPool::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadPool.cpp:442:14
    #20 0x7bffd1599c8a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1173:16
    #21 0x7bffd15a3ed9 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
    #22 0x7bffd17da041 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:297:20
    #23 0x7bffd16b05c4 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:10
    #24 0x7bffd16b05c4 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
    #25 0x7bffd16b05c4 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
    #26 0x7bffd1592270 in nsThread::ThreadFunc(void*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:374:10
    #27 0x7ffff73ebabf in _pt_root /builds/worker/workspace/obj-build/config/external/nspr/pr/./../../../../../../checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:190:3
    #28 0x5555556c1bd6 in asan_thread_start(void*) _asan_rtl_:28

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260710095230-ddbfac25ce6f.
The bug appears to have been introduced in the following build range:

Start: 74ce3636f0d3baa5b876cc22411d46b68202f5c5 (20260708160402)
End: 66750c0df77c31e9b434518330f52029d6a7e1f2 (20260708161624)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=74ce3636f0d3baa5b876cc22411d46b68202f5c5&tochange=66750c0df77c31e9b434518330f52029d6a7e1f2

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1813848

:philipp.hancke, since you are the author of the regressor, bug 1813848, could you take a look?

For more information, please visit BugBot documentation.

Comment 3

[Philipp Hancke [:fippo]]

Attachment: Bug 2054208: don't send DTMF on a disabled sender

which sets the sendStream to null

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b8f869b898fb
https://hg.mozilla.org/integration/autoland/rev/b307742ce0d3
don't send DTMF on a disabled sender r=bwc

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/b307742ce0d3

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260714035758-97985f89971d.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1813848