Closed Bug 1692908 Opened 4 years ago Closed 4 years ago

Heap corruption crashes caused by AverMedia Engine (avmvirtualsource.ax)

Categories

(External Software Affecting Firefox :: Other, defect, P3)

Unspecified
Windows

Tracking

(firefox88 fixed)

RESOLVED FIXED
Tracking Status
firefox88 --- fixed

People

(Reporter: toshi, Assigned: toshi)

References

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

The module in AverMedia Engine avmvirtualsource.ax seems to cause heap corruption in Firefox.

The associated signature RtlpFreeHeapInternal | RtlFreeHeap | APP_DATA::FreeCachedMem includes crashes caused by other reasons. The characteristics of this issue is avmvirtualsource.ax in the crash dump.

Crash report: https://crash-stats.mozilla.org/report/index/70545398-0ea3-4ace-833d-0975c0210213

Reason: EXCEPTION_HEAP_CORRUPTION

Top 10 frames of crashing thread:

0 ntdll.dll RtlReportFatalFailure 
1 ntdll.dll RtlReportCriticalFailure 
2 ntdll.dll RtlpHeapHandleError 
3 ntdll.dll RtlpHpHeapHandleError 
4 ntdll.dll RtlpLogHeapFailure 
5 ntdll.dll RtlpFreeHeapInternal 
6 ntdll.dll RtlFreeHeap 
7 oleaut32.dll void APP_DATA::FreeCachedMem 
8 oleaut32.dll SysFreeString 
9 avmvirtualsource.ax avmvirtualsource.ax@0x3279 

I did some repro effort.

<Installation>

  1. Go to https://www.avermedia.com/us/support/download
  2. Choose "Webcam" and "Live Streamer CAM 313 - PW313"
  3. Download and install "AVerMedia CamEngine (Win) v2.0.0.51"

This package includes avmvirtualsource.ax 1.0.0.3, which I believe is the same file as in the crash.

<After installation>

  1. Run regsvr32 avmvirtualsource.ax (somehow the installer does not register this file)
  2. Go to https://webcammictest.com/
  3. Choose "AVerMedia Cam Engine Source"

Now, avmvirtualsource.ax is loaded into firefox.exe, but neither webcam test or crash happens. Even worse, I hit a different crash https://bugzilla.mozilla.org/show_bug.cgi?id=1576335#c16 when I close Firefox. Maybe it's because I don't have an AVerMedia's device.

Assignee: nobody → tkikuchi
Status: NEW → ASSIGNED
Pushed by archaeopteryx@coole-files.de: https://hg.mozilla.org/integration/autoland/rev/87304681d16b Block AVerMedia's virtual camera module. r=gcp
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: