Eric Rahm [:erahm] Reporter
	Description • 10 years ago

Coverity has flagged at least five potential uninitialized variable issues in |MPEG4Source::read| [1].

#1 - |offset| can be used uninitialized in buffer reads [2],[3]
#2 - |size| can be used uninitialized in buffer reads [2],[3]
#3 - |cts| can be used uninitialized when setting buffer metadata [4]
#4 - |duration| can be used uninitialized when setting buffer metadata [5]
#5 - |isSyncSample| can be used uninitialized in an if statement [6]

I will attach the Coverity analysis as well, it's somewhat convoluted but generally the issues arise if we take the false branch of |if (!mIsAVC || mWantsNALFragments)| [7].

[1] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3079
[2] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3288
[3] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3290
[4] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3349
[5] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3351
[6] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3358
[7] - http://hg.mozilla.org/mozilla-central/annotate/71497ed2e0db/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp#l3280

	Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e) Assignee
	Comment 7 • 10 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/06b830f9b0e7

	Ed Morley [:emorley]
	Comment 8 • 10 years ago

https://hg.mozilla.org/mozilla-central/rev/06b830f9b0e7

	Al Billings [:abillings - ex-MoCo]
	Comment 9 • 10 years ago

How far back does this issue go?

	Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e) Assignee
	Comment 10 • 10 years ago

(In reply to Al Billings [:abillings] from comment #9)
> How far back does this issue go?

It has always been pref'ed off in Firefox but this code is used on all Android phones in their system libraries. If this bug is exploitable then Fennec is exposed to it until we move away from using the system libstagefright MP4 demuxer.