New issue
Advanced search Search tips
Starred by 4 users

Issue metadata

Status: Fixed
Closed: Jun 2018

Sign in to add a comment

Issue 1568: WebRTC: Out-of-bounds memory access in WebRTC VP9 Missing Frame Processing

Reported by, May 1 2018 Project Member

Issue description

There is a missing check in VP9 frame processing that could lead to memory corruption.

In the file video_coding/, the function RtpFrameReferenceFinder::MissingRequiredFrameVp9 contains the following code:

  size_t temporal_idx = info.gof->temporal_idx[gof_idx];
  for (size_t l = 0; l < temporal_idx; ++l) {
      auto missing_frame_it = missing_frames_for_layer_[l].lower_bound(ref_pid);

missing_frames_for_layer_ is a std::array of length kMaxTemporalLayers which equals 5.

Meanwhile, values in the temporal_idx array are read in in the following code:

    RETURN_FALSE_ON_ERROR(parser->ReadBits(&t, 3));
    vp9->gof.temporal_idx[i] = t;

Reading three bits makes the maximum size of temporal_idx 7, which can go out of bounds of the missing_frames_for_layer_ array.

This issue causes a crash in Chrome. To reproduce the issue.

1) unzip the attached on a local webserver
2) fetch the webrtc source (, and replace src/modules/rtp_rtcp/source/ with the version attached to the code
3) build webrtc, including the examples
4) run the attached with python 3.6 or higher
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
6) visit in chrome
7) Enter any username and hit "Log in"
8) Type anything into the chat window at the bottom and hit send

The attached file 'missingframe' contains the VP9 frame that causes this crash.

Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.

This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.
396 KB Download
3.7 KB View Download
32.8 KB View Download
6.6 KB View Download

Comment 1 by, Jun 7 2018

Project Member
Labels: -Restrict-View-Commit CVE-2018-6129
Status: Fixed (was: New)

Sign in to add a comment