876252 - Heap-buffer-overflow READ in speex_resampler_process_float

Status: RESOLVED FIXED

(Core :: Web Audio, defect)

Description

[Atte Kettunen]

Attachment: Repro-file

Tested on:

OS: Ubuntu 12.04

Firefox: ASAN opt-build from https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64-asan/1369563046/

ASAN-report:

==17611== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f48c10ede7c at pc 0x7f48e92350b2 bp 0x7f48bdfd3cb0 sp 0x7f48bdfd3ca8
READ of size 4 at 0x7f48c10ede7c thread T27
    #0 0x7f48e92350b1 in speex_resampler_process_float /builds/slave/m-cen-l64-asan-ntly-0000000000/build/media/libspeex_resampler/src/resample.c:867
    #1 0x7f48e61bcae5 in mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBufferWithResampling(mozilla::AudioNodeStream*, mozilla::AudioChunk*, unsigned int, unsigned long, unsigned long, unsigned int, unsigned int&, unsigned int&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/content/media/webaudio/AudioBufferSourceNode.cpp:217
    #2 0x7f48e61bb240 in mozilla::dom::AudioBufferSourceNodeEngine::CopyFromBuffer(mozilla::AudioNodeStream*, mozilla::AudioChunk*, unsigned int, unsigned int*, long*, unsigned int, unsigned int) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/content/media/webaudio/AudioBufferSourceNode.cpp:294
    #3 0x7f48e61b98ab in mozilla::dom::AudioBufferSourceNodeEngine::ProduceAudioBlock(mozilla::AudioNodeStream*, mozilla::AudioChunk const&, mozilla::AudioChunk*, bool*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/content/media/webaudio/AudioBufferSourceNode.cpp:397
    #4 0x7f48e6123d5a in mozilla::AudioNodeStream::ProduceOutput(long, long) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/content/media/AudioNodeStream.cpp:425
.
.
.

The crash stack is identical to the stack from bug 874934

Comment 1

[Mats Palmgren (inactive)]

Same underlying issue as bug 875617?

Comment 2

[(no longer active)]

Attachment: Patch (v1)

Sigh....

Comment 3

[(no longer active)]

(In reply to Mats Palmgren [:mats] from comment #1)
> Same underlying issue as bug 875617?

I doubt that.

Comment 5

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/aa7086197909

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/aa7086197909

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Does this affect branches or is this trunk only? 

I am told that this might be explicitly disabled on 22 and 23 and unaffected for 21. Is that right?

Comment 10

[(no longer active)]

(In reply to Al Billings [:abillings] from comment #9)
> Does this affect branches or is this trunk only? 

23 and 24.

> I am told that this might be explicitly disabled on 22 and 23 and unaffected
> for 21. Is that right?

It is already disabled on 22, and will be disabled on 23 once it goes to beta.  And yes, 21 is unaffected.

Comment 11

[(no longer active)]

Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.

Comment 12

[Mats Palmgren (inactive)]

(copying the security rating from the duplicate bugs)