[webkit-changes] [190516] trunk

Fri, 02 Oct 2015 12:51:43 -0700

Title: [190516] trunk
Revision
190516
Author
[email protected]
Date
2015-10-02 12:51:21 -0700 (Fri, 02 Oct 2015)

Log Message

[MSE] Browser crashes when appending invalid data to MSE source buffer
https://bugs.webkit.org/show_bug.cgi?id=149689

Reviewed by Darin Adler.

Source/WebCore:

Test: media/media-source/media-source-stpp-crash.html

Bail out early (as specced) after disconnecting the SourceBuffer from its MediaSource.

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment):

LayoutTests:

* media/content/stpp.mp4: Added.
* media/media-source/media-source-stpp-crash-expected.txt: Added.
* media/media-source/media-source-stpp-crash.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (190515 => 190516)


--- trunk/LayoutTests/ChangeLog	2015-10-02 19:43:09 UTC (rev 190515)
+++ trunk/LayoutTests/ChangeLog	2015-10-02 19:51:21 UTC (rev 190516)
@@ -1,3 +1,14 @@
+2015-10-02  Jer Noble  <[email protected]>
+
+        [MSE] Browser crashes when appending invalid data to MSE source buffer
+        https://bugs.webkit.org/show_bug.cgi?id=149689
+
+        Reviewed by Darin Adler.
+
+        * media/content/stpp.mp4: Added.
+        * media/media-source/media-source-stpp-crash-expected.txt: Added.
+        * media/media-source/media-source-stpp-crash.html: Added.
+
 2015-10-02  Alex Christensen  <[email protected]>
 
         Reloading without content blockers doesn’t apply to resource loads after the main frame finishes

Added: trunk/LayoutTests/media/content/stpp.mp4 (0 => 190516)


--- trunk/LayoutTests/media/content/stpp.mp4	                        (rev 0)
+++ trunk/LayoutTests/media/content/stpp.mp4	2015-10-02 19:51:21 UTC (rev 190516)
@@ -0,0 +1 @@
+ftypiso6avc1isomdash\xA3moovlmvhd\xD1\xE0\xE4w\xD1\xE0\xE4w\xC8@(mvex trextrak\tkhd\xD1\xE0\xE4w\xD1\xE0\xE4w@\x808\xA3mdia mdhd\xD1\xE0\xE4w\xD1\xE0\xE4w\xC8\xC7-hdlrsubtBBC EBU-TT-DNminfsthd$dinfdrefurl stbl\xCAstsd\xBAstpphttp://www.w3.org/ns/ttml http://www.w3.org/ns/ttml#parameter http://www.w3.org/ns/ttml#styling http://www.w3.org/ns/ttml#metadata urn:ebu:tt:metadata urn:ebu:tt:stylesttsstscstszstco
\ No newline at end of file

Added: trunk/LayoutTests/media/media-source/media-source-stpp-crash-expected.txt (0 => 190516)


--- trunk/LayoutTests/media/media-source/media-source-stpp-crash-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/media/media-source/media-source-stpp-crash-expected.txt	2015-10-02 19:51:21 UTC (rev 190516)
@@ -0,0 +1,12 @@
+
+Tests that an unsupported media file (e.g., containing sttp track) does not cause a crash in appendBuffer().
+RUN(video.src = ""
+EVENT(sourceopen)
+RUN(sourceBuffer = source.addSourceBuffer("video/mp4"))
+RUN(sourceBuffer.appendBuffer(initSegment))
+EXPECTED (sourceBuffer.updating == 'true') OK
+EVENT(updatestart)
+EVENT(updateend)
+EXPECTED (sourceBuffer.updating == 'false') OK
+END OF TEST
+

Added: trunk/LayoutTests/media/media-source/media-source-stpp-crash.html (0 => 190516)


--- trunk/LayoutTests/media/media-source/media-source-stpp-crash.html	                        (rev 0)
+++ trunk/LayoutTests/media/media-source/media-source-stpp-crash.html	2015-10-02 19:51:21 UTC (rev 190516)
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>mock-media-source</title>
+    <script src=""
+    <script src=""
+    <script>
+    var source;
+    var sourceBuffer;
+    var initSegment;
+
+    function runTest() {
+        consoleWrite('Tests that an unsupported media file (e.g., containing sttp track) does not cause a crash in appendBuffer().');
+        findMediaElement();
+
+        source = new MediaSource();
+        waitForEventOn(source, 'sourceopen', sourceOpen);
+        run('video.src = ""
+    }
+
+    function sourceOpen() {
+        run('sourceBuffer = source.addSourceBuffer("video/mp4")');
+
+        waitForEventOn(sourceBuffer, 'updatestart');
+        waitForEventOn(sourceBuffer, 'update');
+        waitForEventOn(sourceBuffer, 'updateend', updateEnd);
+
+        var request = new XMLHttpRequest();
+        request.responseType = 'arraybuffer';
+        request.open('GET', '../content/stpp.mp4', false);
+        request.send();
+
+        initSegment = request.response;
+        run('sourceBuffer.appendBuffer(initSegment)');
+        testExpected('sourceBuffer.updating', true);
+    }
+    
+    function updateEnd() {
+        testExpected('sourceBuffer.updating', false);
+        endTest();
+    }
+
+    </script>
+</head>
+<body _onload_="runTest()">
+    <video></video>
+</body>
+</html>

Modified: trunk/Source/WebCore/ChangeLog (190515 => 190516)


--- trunk/Source/WebCore/ChangeLog	2015-10-02 19:43:09 UTC (rev 190515)
+++ trunk/Source/WebCore/ChangeLog	2015-10-02 19:51:21 UTC (rev 190516)
@@ -1,3 +1,17 @@
+2015-10-02  Jer Noble  <[email protected]>
+
+        [MSE] Browser crashes when appending invalid data to MSE source buffer
+        https://bugs.webkit.org/show_bug.cgi?id=149689
+
+        Reviewed by Darin Adler.
+
+        Test: media/media-source/media-source-stpp-crash.html
+
+        Bail out early (as specced) after disconnecting the SourceBuffer from its MediaSource.
+
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment):
+
 2015-10-02  Simon Fraser  <[email protected]>
 
         ASSERTION FAILED: param >= 0 in AnimationBase::updateStateMachine()

Modified: trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp (190515 => 190516)


--- trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp	2015-10-02 19:43:09 UTC (rev 190515)
+++ trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp	2015-10-02 19:51:21 UTC (rev 190516)
@@ -1022,8 +1022,10 @@
 
     // 2. If the initialization segment has no audio, video, or text tracks, then run the append error algorithm
     // with the decode error parameter set to true and abort these steps.
-    if (!segment.audioTracks.size() && !segment.videoTracks.size() && !segment.textTracks.size())
+    if (segment.audioTracks.isEmpty() && segment.videoTracks.isEmpty() && segment.textTracks.isEmpty()) {
         appendError(true);
+        return;
+    }
 
     // 3. If the first initialization segment flag is true, then run the following steps:
     if (m_receivedFirstInitializationSegment) {

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to