867086 - WebAudio stack-buffer-overflow [@mozilla::AudioChannelsDownMix]

Status: RESOLVED FIXED

(Core :: Web Audio, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

content/media/AudioChannelFormat.cpp:212

  for (uint32_t c = 0; c < inputChannelCount; ++c) {
*   outputChannels[m.mInputDestination[c]] +=
      m.mInputCoefficient[c]*(static_cast<const float*>(inputChannels[c]))[s];
  }


Tested with m-i changeset: 130174:ea5490a3bca7

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[(no longer active)]

I'm rewriting a whole bunch of stuff in this code in bug 865234.  It probably makes sense for us to wait for that bug to land and then retest.  I'm hoping to push those patches tomorrow if I get the reviews.

Comment 3

[(no longer active)]

Christoph, can you please retest this?  Thanks!

Comment 4

[Christoph Diehl [:posidron]]

Fixed.

Tested with m-i changeset: 130540:39aad6551764

Comment 5

[(no longer active)]

Yay!

Comment 6

[Christoph Diehl [:posidron]]

We shouldn't dup found security bugs against implementation bugs, if the specific vulnerability was unknown at the time. There were no previous reports of the same issue. Let's mark this as fixed.

Comment 7

[(no longer active)]

Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.