Closed
Bug 881775
Opened 11 years ago
Closed 11 years ago
WebAudio Assertion failure: i < Length() (invalid array index) and crash [@mozilla::DownmixAndInterleave]
Categories
(Core :: Audio/Video, defect)
Tracking
()
RESOLVED
FIXED
mozilla24
| Tracking | Status | |
|---|---|---|
| firefox23 | --- | disabled |
| firefox24 | --- | fixed |
| firefox-esr17 | --- | unaffected |
| b2g18 | --- | unaffected |
People
(Reporter: posidron, Assigned: ehsan.akhgari)
References
Details
(4 keywords, Whiteboard: [adv-main24-])
Attachments
(4 files, 1 obsolete file)
./content/media/AudioSegment.cpp
for (uint32_t i = 0; i < aChannelData.Length(); ++i) {
channelData[i] = aChannelData[i];
}
Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/86413e921d5d
|
Reporter | |
Updated•11 years ago
|
Group: core-security
|
|
Reporter | |
Comment 1•11 years ago
|
||
|
|
Reporter | |
Comment 2•11 years ago
|
||
|
Assignee | |
Comment 3•11 years ago
|
||
This code was added in bug 842243, so this has nothing to do with Web Audio.
Blocks: 842243
Component: Web Audio → Video/Audio
|
|
Assignee | |
Updated•11 years ago
|
Assignee: nobody → slin
|
|
Assignee | |
Comment 4•11 years ago
|
||
Hmm, looking at the code, here <https://hg.mozilla.org/mozilla-central/rev/e59ac8e0e410#l1.52> channelData's size will be 0 as far as I can tell, so if we ever get into this loop then we're going to access the array out of bounds, unless I'm missing something.
|
|
Reporter | |
Comment 5•11 years ago
|
||
reduced testcase
Attachment #760990 -
Attachment is obsolete: true
|
|
Assignee | |
Comment 6•11 years ago
|
||
The check before calling AudioChannelsDownMix is necessary because that function asserts if it finds out that it doesn't need to do any work.
Attachment #761173 -
Flags: review?(roc) → review+
|
|
Assignee | |
Comment 7•11 years ago
|
||
|
||
Comment 8•11 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
status-firefox24:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
|
||
Updated•11 years ago
|
status-firefox23:
--- → unaffected
status-firefox-esr17:
--- → unaffected
|
|
||
Updated•11 years ago
|
Whiteboard: [adv-main24-]
|
|
||
Updated•11 years ago
|
|
||
Updated•11 years ago
|
status-b2g18:
--- → unaffected
|
|
||
Updated•10 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•