964761 - Stack buffer overflow in content/media/webm/EbmlComposer.cpp

Status: RESOLVED DUPLICATE of bug 964762

(Core :: Audio/Video, defect)

Description

[Paul Adenot (:padenot)]

15:07.96 In file included from /usr/include/string.h:638:0,
15:07.96                  from ../../../dist/system_wrappers/string.h:3,
15:07.96                  from ../../../dist/include/nsTArray.h:16,
15:07.96                  from /home/padenot/src/trees/mozilla-inbound/content/media/webm/EbmlComposer.h:8,
15:07.96                  from /home/padenot/src/trees/mozilla-inbound/content/media/webm/EbmlComposer.cpp:6,
15:07.96                  from /home/padenot/src/trees/mozilla-inbound/obj-x86_64-unknown-linux-gnu/content/media/webm/Unified_cpp_content_media_webm0.cpp:2:
15:07.96 In function ‘char* strcpy(char*, const char*)’,
15:07.96     inlined from ‘void mozilla::EbmlComposer::GenerateHeader()’ at /home/padenot/src/trees/mozilla-inbound/content/media/webm/EbmlComposer.cpp:50:43:
15:07.96 /usr/include/x86_64-linux-gnu/bits/string3.h:104:86: error: call to char* __builtin___strcpy_chk(char*, const char*, long unsigned int) will always overflow destination buffer [-Werror]

"A_VORBIS" is 9 char long (because of the \0). Maybe we don't want the '\0' in the container, in which case we can just put a "- 1" on the size.

Comment 1

[Paul Adenot (:padenot)]

Seems like I screwed up, here, real bug is bug 964762.