603918 - Malformed WebM file leads to crash [@peek_element]

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

File: 0.webm
Number of values: 14
Offset:  4391/0x001127	Value: ['00', '00', '00', '01']
Offset: 16337/0x003fd1	Value: ['00', '00']
Offset: 32387/0x007e83	Value: ['80', '00', '00', '00', '00', '00', '00', '00']
Offset: 37970/0x009452	Value: ['ff', 'ff', 'ff', 'ff']
Offset: 38041/0x009499	Value: ['00', '00', '00', '00']
Offset: 39462/0x009a26	Value: ['00', '00']
Offset: 42438/0x00a5c6	Value: ['80', '00', '00', '00', '00', '00', '00', '00']
Offset: 54883/0x00d663	Value: ['00', '00']
Offset: 58256/0x00e390	Value: ['ff', 'c4', '40', '0f']
Offset: 63539/0x00f833	Value: ['80', '00', '00', '00', '00', '00', '00', '00']
Offset: 71026/0x011572	Value: ['7f', 'ff']
Offset: 78704/0x013370	Value: ['20', '00']
Offset: 79379/0x013613	Value: ['7f', 'ff', 'ff', 'ff']
Offset: 87426/0x015582	Value: ['80', '00']

Windows 7 is also affected.

Please execute the provided html file.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Matthew Gregan [:kinetik]]

In nsWebMReader::ReadMetadata, vorbis_synthesis_headerin fails (returning OV_EBADHEADER), so we call nsWebMReader::Cleanup() (destroying mContext) and then return an error.  nsBuiltinDecoderStateMachine::LoadMetadata fails to check the result of ReadMetadata() and we eventually crash when we're called to decode a frame.  So this sounds like the same bug as bug 604067 comment 4 mentions in the first sentence.

Comment 3

[Matthew Gregan [:kinetik]]

Fixed by bug 604067.

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

(In reply to comment #3)
> Fixed by bug 604067.

Just backed this out unfortunately. :(

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Bug 604067 landed again, so this should be fixed...