876338 - WebAudio heap-buffer-overflow crash [@mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer]

Status: RESOLVED DUPLICATE of bug 876252

(Core :: Web Audio, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

./content/media/webaudio/AudioBufferSourceNode.cpp:174

  void CopyFromInputBuffer(AudioChunk* aOutput,
                           uint32_t aChannels,
                           uintptr_t aSourceOffset,
                           uintptr_t aBufferOffset,
                           uint32_t aNumberOfFrames) {
    for (uint32_t i = 0; i < aChannels; ++i) {
      float* baseChannelData = static_cast<float*>(const_cast<void*>(aOutput->mChannelData[i]));
      memcpy(baseChannelData + aBufferOffset,
*            mBuffer->GetData(i) + aSourceOffset,
             aNumberOfFrames * sizeof(float));
    }
  }


Tested with m-i changeset: 132982:ce25da24ba1c

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Christoph Diehl [:posidron]]

Attachment: testcase-use-after-free

Testcase with a delayed call to stop()
This variation of the testcase lets FF crash with a use-after-free.

Comment 3

[Christoph Diehl [:posidron]]

Attachment: testcase

Comment 4

[Christoph Diehl [:posidron]]

Attachment: testcase-use-after-free

Comment 5

[(no longer active)]

Dupe of bug 876252.

Comment 6

[(no longer active)]

Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.