Picture region checks in VideoData::Create are incorrect

RESOLVED INACTIVE

Status

()

RESOLVED INACTIVE
9 years ago
3 months ago

People

(Reporter: kinetik, Unassigned)

Tracking

Trunk
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
In nsVideoInfo, the rectangle specified by mPicture should be located completely within the rectangle specified by mFrame.  The stride of the frame may be (usually is) larger than the frame width.  The sanity checks in VideoData::Create are incorrect:

Say, for a frame which is 800 pixels wide:

  if (!AddOverflow32(aInfo.mPicture.x, aInfo.mPicture.width, picXLimit) ||
      picXLimit > PRUint32(aBuffer.mPlanes[0].mStride) ||

x = 60
width = 780
picXLimit = 840
mStride = 864

This check will succeed as picXLimit < mStride, but the picture region extends outside of the valid frame rectangle.
Component: Audio/Video → Audio/Video: Playback

Comment 1

3 months ago
Mass closing do to inactivity.
Feel free to re-open if still needed.
Status: NEW → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → INACTIVE
You need to log in before you can comment on or make changes to this bug.