In media::VTVideoDecodeAccelerator::ReusePictureBuffer,

void VTVideoDecodeAccelerator::ReusePictureBuffer(int32_t picture_id) {
  DCHECK(gpu_thread_checker_.CalledOnValidThread());
  DCHECK(picture_info_map_.count(picture_id));
  PictureInfo* picture_info = picture_info_map_.find(picture_id)->second.get();  // <--- unchecked deref
  picture_info->cv_image.reset();
  picture_info->gl_image->Destroy(false);
  picture_info->gl_image = nullptr;

For release builds, picture_info_map_.find(picture_id) is not checked against picture_info_map_.end(), but a malicious renderer (or possibly a malicious/compromised flash plugin through the PPB_VideoDecoder_Dev interface?) can send a bogus picture_id. This can then lead to memory corruption in the GPU process.

A renderer patch is attached that gives the following stacktrace in the GPU process (full stacktrace attached).

==93384==ERROR: AddressSanitizer: SEGV on unknown address 0x000112fd6af0 (pc 0x000112fdfcd3 bp 0x7fff595ad5d0 sp 0x7fff595ad500 T0)
==93384==WARNING: invalid path to external symbolizer!
==93384==WARNING: Failed to use and restart external symbolizer!
    #0 0x112fdfcd2 in media::VTVideoDecodeAccelerator::ReusePictureBuffer(int) (/Users/ochang/chromium/src/out/Default/Chromium.app/Contents/Versions/54.0.2828.0/Chromium Framework.framework/Chromium Framework+0x933fcd2)
    #1 0x11599b553 in bool IPC::MessageT<AcceleratedVideoDecoderMsg_ReusePictureBuffer_Meta, std::__1::tuple<int>, void>::Dispatch<media::GpuVideoDecodeAccelerator, media::GpuVideoDecodeAccelerator, void, void (media::GpuVideoDecodeAccelerator::*)(int)>(IPC::Message const*, media::GpuVideoDecodeAccelerator*, media::GpuVideoDecodeAccelerator*, void*, void (media::GpuVideoDecodeAccelerator::*)(int)) (/Users/ochang/chromium/src/out/Default/Chromium.app/Contents/Versions/54.0.2828.0/Chromium Framework.framework/Chromium Framework+0xbcfb553)
    #2 0x115998831 in media::GpuVideoDecodeAccelerator::OnMessageReceived(IPC::Message const&) (/Users/ochang/chromium/src/out/Default/Chromium.app/Contents/Versions/54.0.2828.0/Chromium Framework.framework/Chromium Framework+0xbcf8831)


  
 

Deleted: poc1.diff 595 bytes

poc1.diff 595 bytes Download

Deleted: stacktrace.txt 6.1 KB

stacktrace.txt 6.1 KB View Download