750327 - Opus crash invalid write [@quant_band]

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

This bug might be affiliated with bug 750231 although the location seems to differ.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Timothy B. Terriberry (:derf)]

Haven't investigated too deeply, but this file does not crash opusdec (available from opus-tools: http://git.xiph.org/?p=users/greg/opus-tools.git).

Comment 3

[Christoph Diehl [:posidron]]

Sorry, should have mentioned that I have deactivated the checksum verification inside the source.

Comment 4

[Christoph Diehl [:posidron]]

Same here. This bug has [asan] in whiteboard. You will need to test it with an ASAN build of Firefox or compile the decoder with ASAN.

Comment 5

[Daniel Veditz [:dveditz]]

AFAIK opus only recently landed in m-c so we shouldn't need this fix in releases prior to Firefox 15

Comment 6

[Ralph Giles (:rillian)]

I should be fixed before firefox 15 uplift to Aurora, so we can give the preview wider deployment. Note that the code in question is pref'd off by default.

I was stuck for a while getting a working ASAN build so I could debug directly. I've resolved that with :decoder's help, so I hope to get to this soon.

Comment 7

[Ralph Giles (:rillian)]

I can no longer reproduce this with today's inbound. The stream is now properly rejected by the decoder. Looks like derf's commit 95377:010313752c64 for bug 759612 fixed it.

Comment 8

[Ralph Giles (:rillian)]

Specifically, this check in nsOpusCodec::ReconstructOpusGranulepos() blocks decoding the testcase:

if (!mDoneReadingHeaders && GetOpusDeltaGP(mUnstamped[0]) > gp)
  return false;

Comment 9

[Ralph Giles (:rillian)]

And only that check.

Comment 10

[Alex Keybl [:akeybl]]

Fixed by bug 759612, which is resolved in FF15. Marking flags to match.