In nsVideoInfo, the rectangle specified by mPicture should be located completely within the rectangle specified by mFrame. The stride of the frame may be (usually is) larger than the frame width. The sanity checks in VideoData::Create are incorrect: Say, for a frame which is 800 pixels wide: if (!AddOverflow32(aInfo.mPicture.x, aInfo.mPicture.width, picXLimit) || picXLimit > PRUint32(aBuffer.mPlanes.mStride) || x = 60 width = 780 picXLimit = 840 mStride = 864 This check will succeed as picXLimit < mStride, but the picture region extends outside of the valid frame rectangle.
Component: Audio/Video → Audio/Video: Playback
Mass closing do to inactivity. Feel free to re-open if still needed.
Status: NEW → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → INACTIVE
You need to log in before you can comment on or make changes to this bug.