571141 - VP8 handling of motion vectors changed

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Timothy B. Terriberry (:derf)]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.23) Gecko/20100609 SeaMonkey/1.1.18
Build Identifier: 

We applied a temporary patch to libvpx to prevent crashing on malicious/corrupt webm files (see bug 566987), since libvpx was not clamping motion vectors for macro blocks in the SPLITMV mode. John Koleszar has proposed what I think is a better long-term solution: https://review.webmproject.org/113

This changes the bitstream behavior, though neither the new nor our current patch should affect files created by the current encoder. We will have to switch to the new clamping method if it becomes the new standard. It might be a good idea to do some fuzz testing with it now.

Reproducible: Always

Comment 1

[Timothy B. Terriberry (:derf)]

The change has now been comitted upstream: http://review.webmproject.org/gitweb?p=libvpx.git;a=commit;h=f6f0ffe96a69d7de718b9528dcc3f6f66b9cb92d

Comment 2

[Matthew Gregan [:kinetik]]

Fuzzing this found a crash due to problems clamping chroma MVs.  Tim has a patch for that which survives ~18 hours of fuzzing.  We'll need to make sure we pick up that patch as well.

Comment 3

[Matthew Gregan [:kinetik]]

https://review.webmproject.org/127

Comment 4

[Timothy B. Terriberry (:derf)]

Fixed by 593753.