882956 - WebAudio stack-buffer-overflow crash [@void mozilla::InterleaveAndConvertBuffer<float, float>]

Status: RESOLVED FIXED

(Core :: Web Audio, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

Wait 3 seconds after loading the testcase.


File: content/media/AudioSegment.cpp:24

template <class SrcT, class DestT>
static void
InterleaveAndConvertBuffer(const SrcT** aSourceChannels,
                           int32_t aLength, float aVolume,
                           int32_t aChannels,
                           DestT* aOutput)
{
  DestT* output = aOutput;
  for (int32_t i = 0; i < aLength; ++i) {
    for (int32_t channel = 0; channel < aChannels; ++channel) {
      float v = AudioSampleToFloat(aSourceChannels[channel][i])*aVolume;
*     *output = FloatToAudioSample<DestT>(v);
      ++output;
    }
  }
}


Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/ac7d9177c7ee

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[(no longer active)]

This code was added in bug 842243.

Shelly, can you please take a look at this?

Comment 3

[Shelly Lin [:shelly]]

Sure thing.

Comment 4

[(no longer active)]

Thanks, and let me know if you need help.  It seems like the output buffer here is smaller than what we're expecting.

Comment 5

[Shelly Lin [:shelly]]

Attachment: Fix patch for the crash in AudioSegment.cpp

When down-mixing the audio source, should pass the "output channels count" to the downmix function, not the "source channels count".

Hi Ehsan, could you review the patch? It's a small fix, I'm running the try-server in the mean while.

Comment 6

[(no longer active)]

Comment on attachment 762487 [details] [diff] [review]
Fix patch for the crash in AudioSegment.cpp

Review of attachment 762487 [details] [diff] [review]:
-----------------------------------------------------------------

Nice!  Can you please also include the test case here as a crashtest in <http://mxr.mozilla.org/mozilla-central/source/content/media/test/crashtests/> when landing?  Thanks!

Comment 7

[Shelly Lin [:shelly]]

Attachment: Fix patch for the crash in AudioSegment.cpp (with crashtest)

Thanks! Re-push the patch to try-server now.

Comment 8

[Shelly Lin [:shelly]]

https://tbpl.mozilla.org/?tree=Try&rev=7a6a4055c05d
https://tbpl.mozilla.org/?tree=Try&rev=c2a730389ce5

Comment 9

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ccd298a9db28

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ccd298a9db28