880342 - WebAudio heap-buffer-overflow crash [@mozilla::AudioBlockSumOfSquares]

Status: RESOLVED FIXED

(Core :: Web Audio, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

A reduced testcase will follow in the next comment.

content/media/AudioNodeEngine.cpp:158

    float
    AudioBlockSumOfSquares(const float* aInput, uint32_t aLength)
    {
      float sum = 0.0f;
      while (aLength--) {
*       sum += *aInput * *aInput;
        ++aInput;
      }
      return sum;
    }

Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/2551c645b782 + ehsan's patch for the Convolver node.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Christoph Diehl [:posidron]]

Attachment: testcase-reduced

reduced testcase

Comment 3

[Al Billings [:abillings - ex-MoCo]]

Does this affect Aurora? This is disabled in Beta, right?

Comment 4

[(no longer active)]

Can you please test without my patch as well?

Comment 5

[(no longer active)]

(In reply to Al Billings [:abillings] from comment #3)
> Does this affect Aurora? This is disabled in Beta, right?

This is with the patch to bug 815643 which has not landed yet...

Comment 6

[(no longer active)]

Fixed locally, and landed the test case: https://hg.mozilla.org/integration/mozilla-inbound/rev/a178af222dd4

Comment 7

[Christoph Diehl [:posidron]]

Tested it again with Ehsan's updated patch https://gist.github.com/ehsan/5730140 and the testcase is not reproducible anymore. Fixed.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a178af222dd4