Bug 1314533: [MSE] P4. Reject invalid webm block. r=gerald
authorJean-Yves Avenard <jyavenard@mozilla.com>
Fri, 04 Nov 2016 02:16:53 +1100
changeset 321370 7c84e5453411694e379a08bed40f2f0db46aa475
parent 321369 754c160ecbed3f2f34e05916e1c814b36403ac04
child 321371 ab4d4dfee0743f13ec660d757b7a5d5d97b8879d
push id21
push usermaklebus@msu.edu
push dateThu, 01 Dec 2016 06:22:08 +0000
reviewersgerald
bugs1314533
milestone52.0a1
Bug 1314533: [MSE] P4. Reject invalid webm block. r=gerald An invalid webm block at this stage is either a non init segment or non media segment. MozReview-Commit-ID: 46NrhCwqas1
dom/media/mediasource/ContainerParser.cpp
--- a/dom/media/mediasource/ContainerParser.cpp
+++ b/dom/media/mediasource/ContainerParser.cpp
@@ -135,22 +135,24 @@ public:
     // ...
     // 0x18538067 // Segment (must be "unknown" size or contain a value large
                   // enough to include the Segment Information and Tracks
                   // elements that follow)
     // 0x1549a966 // -> Segment Info
     // 0x1654ae6b // -> One or more Tracks
 
     // 0x1a45dfa3 // EBML
-    if (aData->Length() >= 4 &&
-        (*aData)[0] == 0x1a && (*aData)[1] == 0x45 && (*aData)[2] == 0xdf &&
+    if (aData->Length() < 4) {
+      return NS_ERROR_NOT_AVAILABLE;
+    }
+    if ((*aData)[0] == 0x1a && (*aData)[1] == 0x45 && (*aData)[2] == 0xdf &&
         (*aData)[3] == 0xa3) {
       return NS_OK;
     }
-    return NS_ERROR_NOT_AVAILABLE;
+    return MediaResult(NS_ERROR_FAILURE, RESULT_DETAIL("Invalid webm content"));
   }
 
   MediaResult IsMediaSegmentPresent(MediaByteBuffer* aData) override
   {
     ContainerParser::IsMediaSegmentPresent(aData);
     // XXX: This is overly primitive, needs to collect data as it's appended
     // to the SB and handle, rather than assuming everything is present in a
     // single aData segment.
@@ -158,28 +160,29 @@ public:
     // ...
     // DocType == "webm"
     // ...
     // 0x18538067 // Segment (must be "unknown" size)
     // 0x1549a966 // -> Segment Info
     // 0x1654ae6b // -> One or more Tracks
 
     // 0x1f43b675 // Cluster
-    if (aData->Length() >= 4 &&
-        (*aData)[0] == 0x1f && (*aData)[1] == 0x43 && (*aData)[2] == 0xb6 &&
+    if (aData->Length() < 4) {
+      return NS_ERROR_NOT_AVAILABLE;
+    }
+    if ((*aData)[0] == 0x1f && (*aData)[1] == 0x43 && (*aData)[2] == 0xb6 &&
         (*aData)[3] == 0x75) {
       return NS_OK;
     }
     // 0x1c53bb6b // Cues
-    if (aData->Length() >= 4 &&
-        (*aData)[0] == 0x1c && (*aData)[1] == 0x53 && (*aData)[2] == 0xbb &&
+    if ((*aData)[0] == 0x1c && (*aData)[1] == 0x53 && (*aData)[2] == 0xbb &&
         (*aData)[3] == 0x6b) {
       return NS_OK;
     }
-    return NS_ERROR_NOT_AVAILABLE;
+    return MediaResult(NS_ERROR_FAILURE, RESULT_DETAIL("Invalid webm content"));
   }
 
   bool ParseStartAndEndTimestamps(MediaByteBuffer* aData,
                                   int64_t& aStart, int64_t& aEnd) override
   {
     bool initSegment = NS_SUCCEEDED(IsInitSegmentPresent(aData));
 
     if (mLastMapping &&