504644 - crash (segfault) [@ _vorbis_unpack_comment] when playing corrupted ogg vorbis/theora file

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Dana Keeler (she/her) [:keeler]]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11
Build Identifier: mozilla-central revision c121e64e9940

Segmentation fault when playing corrupted ogg vorbis/theora file (attached). 

Reproducible: Always

Steps to Reproduce:
1. Load attached file.
Actual Results:  
firefox crashes

Expected Results:  
some sort of "this file is corrupted" message

Backtrace from a program that uses the ogg libraries similarly to firefox (i.e.
oggplayer):
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb77a36d0 (LWP 16379)]
0x0807ffb8 in vorbis_synthesis_headerin ()
Current language:  auto; currently asm
(gdb) backtrace
#0  0x0807ffb8 in vorbis_synthesis_headerin ()
#1  0x0805cdf8 in fs_vorbis_decode (fsound=0x8760b58, buf=0x0, bytes=77)
    at fishsound_vorbis.c:131
#2  0x08057029 in oggplay_callback_audio (oggz=0x8748200, op=0xbfdfb8b8, 
    serialno=1242478144, user_data=0x8760af0) at oggplay_callback.c:392
#3  0x08056e4a in oggplay_callback_predetected (oggz=0x8748200, op=0xbfdfb8b8, 
    serialno=1242478144, user_data=0x8748040) at oggplay_callback.c:653
#4  0x0805fff0 in oggz_read_sync (oggz=0x8748200) at oggz_read.c:486
#5  0x08060783 in oggz_read (oggz=0x8748200, n=8192) at oggz_read.c:606
#6  0x080559c9 in oggplay_initialise (me=0x8748040, block=0) at oggplay.c:122
#7  0x08055af8 in oggplay_open_with_reader (reader=0x8748008) at oggplay.c:159
#8  0x0804d8e7 in main (argc=2, argv=0xbfdfbaf4) at oggplayer.cpp:892

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: test file that causes crash

Comment 2

[Dana Keeler (she/her) [:keeler]]

Attachment: stack trace of relevant thread

Went back and actually got the stack trace from firefox.  It seems the error is really in _vorbis_unpack_comment.

Comment 3

[Dana Keeler (she/her) [:keeler]]

It looks like this was fixed in the patch for bug 501279.

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

Testcase added in patch for bug 501279.