Bug 951770 - Reject invalid WebM/Opus files. r=rillian
☠☠ backed out by 2b6516c8713e ☠ ☠
authorJan Gerber <j@mailb.org>
Thu, 19 Dec 2013 22:19:00 -0800
changeset 166441 4cddbc0d518340713b826a48689a534eaebc64e8
parent 166440 cdc7a6424a0d2f2a7ca801e21e1229e02ad5c56d
child 166442 b4978efcdad91a964cb08bafc7c6791a33f7c977
push id39191
push userrgiles@mozilla.com
push dateSat, 01 Feb 2014 05:43:15 +0000
treeherdermozilla-inbound@4cddbc0d5183 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersrillian
bugs951770
milestone29.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 951770 - Reject invalid WebM/Opus files. r=rillian Verify WebM CodecDelay matches the pre-skip value in CodecPrivate.
content/media/webm/WebMReader.cpp
content/media/webm/WebMReader.h
--- a/content/media/webm/WebMReader.cpp
+++ b/content/media/webm/WebMReader.cpp
@@ -367,17 +367,17 @@ nsresult WebMReader::ReadMetadata(MediaI
         Cleanup();
         return NS_ERROR_FAILURE;
       }
 
       mAudioTrack = track;
       mHasAudio = true;
       mInfo.mAudio.mHasAudio = true;
       mAudioCodec = nestegg_track_codec_id(mContext, track);
-      mCodecDelay = params.codec_delay;
+      mCodecDelay = params.codec_delay / NS_PER_USEC;
 
       if (mAudioCodec == NESTEGG_CODEC_VORBIS) {
         // Get the Vorbis header data
         unsigned int nheaders = 0;
         r = nestegg_track_codec_data_count(mContext, track, &nheaders);
         if (r == -1 || nheaders != 3) {
           Cleanup();
           return NS_ERROR_FAILURE;
@@ -434,16 +434,22 @@ nsresult WebMReader::ReadMetadata(MediaI
           return NS_ERROR_FAILURE;
         }
 
         if (!InitOpusDecoder()) {
           Cleanup();
           return NS_ERROR_FAILURE;
         }
 
+        if (mCodecDelay != FramesToUsecs(mOpusParser->mPreSkip, mOpusParser->mRate).value()) {
+          LOG(PR_LOG_DEBUG, ("Values for CodecDelay and PreSkip do not match\n"))
+          Cleanup();
+          return NS_ERROR_FAILURE;
+        }
+
         mInfo.mAudio.mRate = mOpusParser->mRate;
 
         mInfo.mAudio.mChannels = mOpusParser->mChannels;
         mChannels = mInfo.mAudio.mChannels;
         mSeekPreroll = params.seek_preroll;
 #endif
       } else {
         Cleanup();
@@ -713,17 +719,17 @@ bool WebMReader::DecodeAudioPacket(neste
         return false;
       }
 
       CheckedInt64 duration = FramesToUsecs(frames, rate);
       if (!duration.isValid()) {
         NS_WARNING("Int overflow converting WebM audio duration");
         return false;
       }
-      CheckedInt64 time = startTime - (mCodecDelay / NS_PER_USEC);
+      CheckedInt64 time = startTime - mCodecDelay;
       if (!time.isValid()) {
         NS_WARNING("Int overflow shifting tstamp by codec delay");
         nestegg_free_packet(aPacket);
         return false;
       };
       AudioQueue().Push(new AudioData(mDecoder->GetResource()->Tell(),
                                      time.value(),
                                      duration.value(),
--- a/content/media/webm/WebMReader.h
+++ b/content/media/webm/WebMReader.h
@@ -210,17 +210,17 @@ private:
   uint32_t mAudioTrack;
 
   // Time in microseconds of the start of the first audio frame we've decoded.
   int64_t mAudioStartUsec;
 
   // Number of audio frames we've decoded since decoding began at mAudioStartMs.
   uint64_t mAudioFrames;
 
-  // Number of nanoseconds that must be discarded from the start of the Stream.
+  // Number of microseconds that must be discarded from the start of the Stream.
   uint64_t mCodecDelay;
 
   // Parser state and computed offset-time mappings.  Shared by multiple
   // readers when decoder has been cloned.  Main thread only.
   nsRefPtr<WebMBufferedState> mBufferedState;
 
   // Size of the frame initially present in the stream. The picture region
   // is defined as a ratio relative to this.