WebAudio global-buffer-overflow crash [@mozilla::dom::DelayNodeEngine::ProduceAudioBlock]

RESOLVED FIXED in Firefox 24

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: posidron, Assigned: Ehsan)

Tracking

(Blocks 1 bug, 4 keywords)

Trunk
mozilla24
x86_64
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox22 disabled, firefox23- disabled, firefox24+ fixed, firefox-esr17 unaffected, b2g18 unaffected)

Details

(Whiteboard: [adv-main24-])

Attachments

(4 attachments, 1 obsolete attachment)

Reporter

Description

6 years ago
Posted file testcase
content/media/webaudio/DelayNode.cpp:215

    // Write the input sample to the correct location in our buffer
    if (input) {
*     buffer[writeIndex] = input[i] * aInput.mVolume;
    }


Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/c9e6ca6528b8
Reporter

Comment 1

6 years ago
Posted file callstack
Reporter

Comment 2

6 years ago
Posted file testcase-reduced
Assignee

Comment 4

6 years ago
Posted patch Patch (v1) (obsolete) — Splinter Review
OK, this is really embarrassing.  We ended up calculating 0 for all maxDelay values less than 1, so the internal buffer's size would end up being 0.
Assignee: nobody → ehsan
Status: NEW → ASSIGNED
Attachment #755980 - Flags: review?(roc)
Assignee

Comment 5

6 years ago
Attachment #755980 - Attachment is obsolete: true
Attachment #755980 - Flags: review?(roc)
Attachment #756073 - Flags: review?(roc)
https://hg.mozilla.org/mozilla-central/rev/e12be295c0b1
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
Flags: in-testsuite+
Assignee

Comment 8

6 years ago
Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.
Component: Video/Audio → Web Audio
Whiteboard: [adv-main24-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.