1532849 - UBSan: Value outside the range of representable values of type 'unsigned int' [@ mozilla::ChannelMediaDecoder::ComputePlaybackRate]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.mp4

Found in m-c commit 78601cacfe69

This was build with undefined behavior sanitizer checks enabled via mozconfig.
ac_add_options --enable-undefined-sanitizer="enum"

src/dom/media/ChannelMediaDecoder.cpp:413:22: runtime error: 7.08286e+09 is outside the range of representable values of type 'unsigned int'
    #0 0x7f0354945dd8 in mozilla::ChannelMediaDecoder::ComputePlaybackRate(mozilla::MediaChannelStatistics const&, mozilla::BaseMediaResource*, double) src/dom/media/ChannelMediaDecoder.cpp:413:22
    #1 0x7f035495c5a1 in operator() src/dom/media/ChannelMediaDecoder.cpp:366:21
    #2 0x7f035495c5a1 in mozilla::detail::RunnableFunction<mozilla::ChannelMediaDecoder::DurationChanged()::$_1>::Run() src/objdir-ff-ubsan/dist/include/nsThreadUtils.h:562
    #3 0x7f034f478c83 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() src/objdir-ff-ubsan/dist/include/mozilla/TaskDispatcher.h:197:35
    #4 0x7f034f46e450 in mozilla::TaskQueue::Runner::Run() src/xpcom/threads/TaskQueue.cpp:199:12
    #5 0x7f034f49dfc3 in nsThreadPool::Run() src/xpcom/threads/nsThreadPool.cpp:241:14
    #6 0x7f034f49e33c in non-virtual thunk to nsThreadPool::Run() src/xpcom/threads/nsThreadPool.cpp
    #7 0x7f034f495fd1 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1166:14
    #8 0x7f034f49a9fd in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:482:10
    #9 0x7f0350598a5a in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:303:20
    #10 0x7f035045f650 in RunHandler src/ipc/chromium/src/base/message_loop.cc:308:3
    #11 0x7f035045f650 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #12 0x7f034f490902 in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:453:11
    #13 0x7f037571e592 in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #14 0x7f037539e6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #15 0x7f037437c88e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Michael Froman [:mjf]]

Jean-Yves, any thoughts on who should take a look at this?

Comment 2

[Jean-Yves Avenard [:jya]]

Attachment: Bug 1532849 - Prevent arithmetic overflow. r?bryce

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5abd778efd7a
Prevent arithmetic overflow. r=bryce

Comment 4

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/5abd778efd7a