crash (segfault) [@ _vorbis_unpack_comment] when playing corrupted ogg vorbis/theora file

RESOLVED FIXED

Status

()

Core
Audio/Video
RESOLVED FIXED
9 years ago
7 years ago

People

(Reporter: keeler, Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Linux
crash, testcase
Points:
---
Bug Flags:
wanted1.9.0.x -
in-testsuite +

Firefox Tracking Flags

(status1.9.1 .4-fixed)

Details

(Whiteboard: [sg:dupe 501279], crash signature)

Attachments

(2 attachments)

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11
Build Identifier: mozilla-central revision c121e64e9940

Segmentation fault when playing corrupted ogg vorbis/theora file (attached). 

Reproducible: Always

Steps to Reproduce:
1. Load attached file.
Actual Results:  
firefox crashes

Expected Results:  
some sort of "this file is corrupted" message

Backtrace from a program that uses the ogg libraries similarly to firefox (i.e.
oggplayer):
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb77a36d0 (LWP 16379)]
0x0807ffb8 in vorbis_synthesis_headerin ()
Current language:  auto; currently asm
(gdb) backtrace
#0  0x0807ffb8 in vorbis_synthesis_headerin ()
#1  0x0805cdf8 in fs_vorbis_decode (fsound=0x8760b58, buf=0x0, bytes=77)
    at fishsound_vorbis.c:131
#2  0x08057029 in oggplay_callback_audio (oggz=0x8748200, op=0xbfdfb8b8, 
    serialno=1242478144, user_data=0x8760af0) at oggplay_callback.c:392
#3  0x08056e4a in oggplay_callback_predetected (oggz=0x8748200, op=0xbfdfb8b8, 
    serialno=1242478144, user_data=0x8748040) at oggplay_callback.c:653
#4  0x0805fff0 in oggz_read_sync (oggz=0x8748200) at oggz_read.c:486
#5  0x08060783 in oggz_read (oggz=0x8748200, n=8192) at oggz_read.c:606
#6  0x080559c9 in oggplay_initialise (me=0x8748040, block=0) at oggplay.c:122
#7  0x08055af8 in oggplay_open_with_reader (reader=0x8748008) at oggplay.c:159
#8  0x0804d8e7 in main (argc=2, argv=0xbfdfbaf4) at oggplayer.cpp:892
Created attachment 388966 [details]
test file that causes crash
(Reporter)

Updated

9 years ago
Summary: crash (segfault) @vorbis_synthesis_headerin when playing corrupted ogg vorbis/theora file → crash (segfault) @ _vorbis_unpack_comment when playing corrupted ogg vorbis/theora file
Created attachment 390309 [details]
stack trace of relevant thread

Went back and actually got the stack trace from firefox.  It seems the error is really in _vorbis_unpack_comment.
It looks like this was fixed in the patch for bug 501279.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Updated

9 years ago
Flags: in-testsuite?
Testcase added in patch for bug 501279.
Flags: in-testsuite? → in-testsuite+
status1.9.1: --- → wanted
Depends on: 501279
Keywords: crash, testcase
Whiteboard: [sg:dupe 501279]
Group: core-security
status1.9.1: wanted → .4-fixed

Updated

9 years ago
Summary: crash (segfault) @ _vorbis_unpack_comment when playing corrupted ogg vorbis/theora file → crash (segfault) [@ _vorbis_unpack_comment] when playing corrupted ogg vorbis/theora file
Flags: wanted1.9.0.x-
(Assignee)

Updated

7 years ago
Crash Signature: [@ _vorbis_unpack_comment]
You need to log in before you can comment on or make changes to this bug.