Title: [231920] trunk
Revision
231920
Author
jer.no...@apple.com
Date
2018-05-17 14:02:23 -0700 (Thu, 17 May 2018)

Log Message

CRASH in ImageDecoderAVFObjC::sampleAtIndex()
https://bugs.webkit.org/show_bug.cgi?id=185734
<rdar://problem/40295094>

Reviewed by Eric Carlson.

Source/WebCore:

Test: fast/images/animated-image-mp4-crash.html

Test the correct size value before iterating over the SampleMap in presentationOrder()

* Modules/mediasource/SampleMap.h:
(WebCore::PresentationOrderSampleMap::size const):
* platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm:
(WebCore::ImageDecoderAVFObjC::sampleAtIndex const):

LayoutTests:

* fast/images/animated-image-mp4-crash-expected.txt: Added.
* fast/images/animated-image-mp4-crash.html: Added.
* fast/images/resources/two-samples-with-same-pts.mp4: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (231919 => 231920)


--- trunk/LayoutTests/ChangeLog	2018-05-17 20:52:04 UTC (rev 231919)
+++ trunk/LayoutTests/ChangeLog	2018-05-17 21:02:23 UTC (rev 231920)
@@ -1,3 +1,15 @@
+2018-05-17  Jer Noble  <jer.no...@apple.com>
+
+        CRASH in ImageDecoderAVFObjC::sampleAtIndex()
+        https://bugs.webkit.org/show_bug.cgi?id=185734
+        <rdar://problem/40295094>
+
+        Reviewed by Eric Carlson.
+
+        * fast/images/animated-image-mp4-crash-expected.txt: Added.
+        * fast/images/animated-image-mp4-crash.html: Added.
+        * fast/images/resources/two-samples-with-same-pts.mp4: Added.
+
 2018-05-17  Youenn Fablet  <you...@apple.com>
 
         REGRESSION (r229831?): Layout Test http/tests/appcache/interrupted-update.html is a flaky failure

Added: trunk/LayoutTests/fast/images/animated-image-mp4-crash-expected.txt (0 => 231920)


--- trunk/LayoutTests/fast/images/animated-image-mp4-crash-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/images/animated-image-mp4-crash-expected.txt	2018-05-17 21:02:23 UTC (rev 231920)
@@ -0,0 +1,9 @@
+Test that a malformed mp4 media file loaded as an image should not crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/images/animated-image-mp4-crash.html (0 => 231920)


--- trunk/LayoutTests/fast/images/animated-image-mp4-crash.html	                        (rev 0)
+++ trunk/LayoutTests/fast/images/animated-image-mp4-crash.html	2018-05-17 21:02:23 UTC (rev 231920)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <img>
+    <script src=""
+    <script>
+        window.jsTestIsAsync = true;
+
+        function loadImage(src) {
+            return new Promise(resolve => {
+                const image = document.querySelector('img');
+                image.src = ""
+                return image.decode().then(() => { resolve(image); });
+            });
+        }
+
+        function endTest() {
+            finishJSTest();
+            if (window.testRunner)
+                testRunner.notifyDone();
+        }
+
+        description('Test that a malformed mp4 media file loaded as an image should not crash.')
+
+        loadImage("resources/two-samples-with-same-pts.mp4").then(image => {
+            setTimeout(endTest, 100);
+        });
+    </script>
+    <script src=""
+</body>
+</html>

Added: trunk/LayoutTests/fast/images/resources/two-samples-with-same-pts.mp4 (0 => 231920)


--- trunk/LayoutTests/fast/images/resources/two-samples-with-same-pts.mp4	                        (rev 0)
+++ trunk/LayoutTests/fast/images/resources/two-samples-with-same-pts.mp4	2018-05-17 21:02:23 UTC (rev 231920)
@@ -0,0 +1,12 @@
+ftypmp42mp41mp42isommoovlmvhd\xD7"p\xD7"p@\xA4trak\tkhd\xD7"p\xD7"p@,,$edtselstmdia mdhd\xD7"p\xD7"pU\xC41hdlrvideCore Media Video\xC3minfvmhd$dinfdrefurl \x83stbl\xC8stsd\xB8avc1,,HH\xFF\xFF+avcCB\xE0\xFF\
 xE1'B\xE0\xA9&\xF7xP
+׽\xF0(\xDE	\x88colrnclx
+fiel
+chrmpaspsttsstsssdtp stsc stsz*\xCB\xCDstco<(ctts\xFF\xFF\xFF\xFF\xCAmdat\x81_\x90@\x80\x87\xF4N\xCD
+Kܡ\x94:\xC3ԛ\x80\xD0%\xB8 '\xFF\xFFP\x83TR@\xC0a\xC71\xC0A;\xC3\xFF\xF0\xF0U\xFB\xEF\xBE\xFB\xEF\xBE\xFB\xEF\xBE\xFB\xEF\xBE\xFF\xF8\xC1`Pe\xF7\x9A/\xC4\x88\x80\xF8\x81b X\x83\x82b\x8C\xFF\x87\x82\xAF\xD7]u\xD7]u\xD7]u\xD7]u\xD7\xF5\xF9\x98\x99\x85\xD7]u\xD7]u\xD7]u\xD7]u\xD7O]u\xD7]u\xD7]u\xD7]u\xD7]t\xF5\xD7]u\xD7]u\xD7]u\xD7]u\xD7O]u\xD7]u\xD7]u\xD7]u\xD7]t\xF5\xD7]u\xD7]u\xD7]u\xD7]u\xD7O]u\xD7]u\xD7]u\xD7]u\xD7]t\xF5\xD7]u\xD7]u\xD7]u\xD7]u\xD7O]u\xD7]u\xD7^)%j\xE0\x80\x81_\xFF\xFCEc\x80\x8A%\xF7\xDF}\xF7\xDF\xFC?\xE0\xB3\xB8\x80L4@8\xDC\x80lA\xC8\xC4+\x80\x80\xA3p6\x8C\xFF\xE0\x8A(#\xF8\xE0 cQ/\xBE\xFB\xEF\xBE\xFB뮺뮺맮\xBA뮺뮺뮺뮺z뮺뮺뮺뮺맮\xBA뮺뮺뮺뮺z뮺뮺뮺뮺맮\xBA뮺뮺뮺뮺z뮺뮺뮺뮺맮\xBA뮺뮺뮺뮺\xFF\x8F\xC1hPen\x8Ei	b)EXY\x96L\xCB\xC0\xA7	.\xD1\x89b\xD0VT\xE5е\x{1B6DB6}\xB6\xB6\xB6\xB6\xB6\xB6\xB6\xB6\xB6\xB6\xB6\xB6\xBF\xC3\x
 C6݂\xE0\xA0\xE9\xF6\xDF\xF
 3 0\,\xCB2n`p\x8AD\xB0+\xE8Е\x95v\xA0\x87\xF4N\xCD
+Kܡ\x94:\xC3ԛ\x80!\xE1\x9B\xFF\xFE
+\xE0@\xF8#\xF1s\xCCp#\x80 b1\xDF\x83)!\xB0a\xE3!\x91G؏\xE2<G\x88\xF1#\xC4x\x8F\xE2<G\x88\xF1#\xC4y\xBF\x87\xFC\x8B\xCC\xFCG\x80\xFE #Da\xB0xx+\x88	\xCF@;:Y؋\x86Eg\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF1\xEFV,qc\xBD\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xDF?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCE\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFEw\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xBE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9D\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xEF\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7|\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE\x8C!k\x84\xE6\xFF\xFF\x82(\xA0 =\xE3\x80\x86\xCCp\xC4b\x9CG\x88\xF1#\xC4x\x8F\xE6\xFE\xF0Y\x8A\xFC@\x80 R\x988\xB1V \xE0P
 X\x83\x80@	bo\xFF\xF8
 "\x8A\xDE8l\xC7|F)\xC4x\x8F\xE2<G\x88\xF1#\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCE\xE1\xA52|S\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCE\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFEw\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xBE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9D\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xEF\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7|\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE;\xE6\xFF\xE3\xF0ZM\xB3\xF1y\xE08\x80$@p\x82`\xBCA\xC7h\x84E\x97\x80L䁵V B<\xB8AbZ\x9A÷,;r\xFAۈ\B\xE2\xB8\x85\xC4.!q\x88\B\xE2\xB8\x85\xC4.!q\x9B\xE1\xE3n\xC1p`\xC1n \x92Xe\x84˚\xB08\x84y` <\xF32?t\x87\xF4N\xCD
+Kܡ\x94:\xC3ԛ\x80#!\xE2	\x9B\xFF\xFE\xA0*(\x88\xC0a\xC7\xF1\xC0A\x9B7\xFF\xFC׶#\xC4x\x8F\xE2<G\x88\xF1#\xC4x\x8F\xE2<G\x88\xF1o\xC4?\xE0\xB0$2\xDA\xE3\x88\xD0~ -. "b1\x98\x9B\xFF\xFE\x82k\xDB?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x8FpM&%\xFCM\x88\x9B\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xEF\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7|\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE;\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xDF?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCE\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFEw\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xBE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE\x89!k\x88$\xE6\xFF\xFF\x82(\xA0 \xA3w\x8Eq\xC0E\xB3\xE2<G\x88\xF1#\xC4x\x8F7\xF0\xFF\x82\xCCP
 P\xD4@*	@\x
 97 \xC4\x80p:\xCCA\xC0\xE817\xFF\xFCE\xBCp;\x8E-\x98\x8F\xE2<G\x88\xF1#\xC4y\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC{\xD2\xFE\xB5\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7|\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE;\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xDF?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCE\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFEw\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xBE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9F\xCF\xE7\xF3\xF9\xFC\xFE?\x9D\xF3\xC2\x84\x80U:8\xC9b)\xAC,\xCB+r\xF0\xCA)\x92\xEDs%\xC2&\xA9\xA9d\xCBy\x93\x99\xDAh\xA6\xA1\xAE\xDB\xB8\x85\xC4.!q\x88\B\xE2\xB8\x85\xC4.!q\x88\B\xE6\xF8x۰\\x80]\xDFm\xFF2
+\x9Fܳ&\xE69\x92\xC07\xA1\xE2)v\xA0
\ No newline at end of file

Modified: trunk/Source/WebCore/ChangeLog (231919 => 231920)


--- trunk/Source/WebCore/ChangeLog	2018-05-17 20:52:04 UTC (rev 231919)
+++ trunk/Source/WebCore/ChangeLog	2018-05-17 21:02:23 UTC (rev 231920)
@@ -1,3 +1,20 @@
+2018-05-17  Jer Noble  <jer.no...@apple.com>
+
+        CRASH in ImageDecoderAVFObjC::sampleAtIndex()
+        https://bugs.webkit.org/show_bug.cgi?id=185734
+        <rdar://problem/40295094>
+
+        Reviewed by Eric Carlson.
+
+        Test: fast/images/animated-image-mp4-crash.html
+
+        Test the correct size value before iterating over the SampleMap in presentationOrder()
+
+        * Modules/mediasource/SampleMap.h:
+        (WebCore::PresentationOrderSampleMap::size const):
+        * platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm:
+        (WebCore::ImageDecoderAVFObjC::sampleAtIndex const):
+
 2018-05-17  Wenson Hsieh  <wenson_hs...@apple.com>
 
         [Extra zoom mode] Disabled adaptations are not reset upon mainframe navigation

Modified: trunk/Source/WebCore/Modules/mediasource/SampleMap.h (231919 => 231920)


--- trunk/Source/WebCore/Modules/mediasource/SampleMap.h	2018-05-17 20:52:04 UTC (rev 231919)
+++ trunk/Source/WebCore/Modules/mediasource/SampleMap.h	2018-05-17 21:02:23 UTC (rev 231920)
@@ -54,6 +54,8 @@
     reverse_iterator rend() { return m_samples.rend(); }
     const_reverse_iterator rend() const { return m_samples.rend(); }
 
+    size_t size() const { return m_samples.size(); }
+
     WEBCORE_EXPORT iterator findSampleWithPresentationTime(const MediaTime&);
     WEBCORE_EXPORT iterator findSampleContainingPresentationTime(const MediaTime&);
     WEBCORE_EXPORT iterator findSampleContainingOrAfterPresentationTime(const MediaTime&);

Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm (231919 => 231920)


--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm	2018-05-17 20:52:04 UTC (rev 231919)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm	2018-05-17 21:02:23 UTC (rev 231920)
@@ -670,7 +670,7 @@
 
 const ImageDecoderAVFObjCSample* ImageDecoderAVFObjC::sampleAtIndex(size_t index) const
 {
-    if (index >= m_sampleData.size())
+    if (index >= m_sampleData.presentationOrder().size())
         return nullptr;
 
     // FIXME: std::map is not random-accessible; this can get expensive if callers repeatedly call
@@ -679,7 +679,7 @@
     auto iter = m_sampleData.presentationOrder().begin();
     for (size_t i = 0; i != index; ++i)
         ++iter;
-    
+
     return toSample(iter);
 }
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to