[webkit-changes] [181174] trunk

Fri, 06 Mar 2015 11:34:21 -0800

Title: [181174] trunk
Revision
181174
Author
jer.no...@apple.com
Date
2015-03-06 11:31:16 -0800 (Fri, 06 Mar 2015)

Log Message

[Web Audio] Decoding specific .m4a file crashes tab
https://bugs.webkit.org/show_bug.cgi?id=139545

Reviewed by Eric Carlson.

Source/WebCore:

Test: webaudio/decode-audio-data-too-short.html

Bail out early if CoreAudio reports the number of frames in the file to be negative.

* platform/audio/mac/AudioFileReaderMac.cpp:
(WebCore::AudioFileReader::createBus):

LayoutTests:

* webaudio/decode-audio-data-too-short-expected.txt: Added.
* webaudio/decode-audio-data-too-short.html: Added.
* webaudio/resources/media/too-short.m4a: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (181173 => 181174)


--- trunk/LayoutTests/ChangeLog	2015-03-06 19:28:26 UTC (rev 181173)
+++ trunk/LayoutTests/ChangeLog	2015-03-06 19:31:16 UTC (rev 181174)
@@ -1,3 +1,14 @@
+2015-03-06  Jer Noble  <jer.no...@apple.com>
+
+        [Web Audio] Decoding specific .m4a file crashes tab
+        https://bugs.webkit.org/show_bug.cgi?id=139545
+
+        Reviewed by Eric Carlson.
+
+        * webaudio/decode-audio-data-too-short-expected.txt: Added.
+        * webaudio/decode-audio-data-too-short.html: Added.
+        * webaudio/resources/media/too-short.m4a: Added.
+
 2015-03-06  Myles C. Maxfield  <mmaxfi...@apple.com>
 
         Crash in -[WebCascadeList objectAtIndex:] + 195

Added: trunk/LayoutTests/webaudio/decode-audio-data-too-short-expected.txt (0 => 181174)


--- trunk/LayoutTests/webaudio/decode-audio-data-too-short-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/webaudio/decode-audio-data-too-short-expected.txt	2015-03-06 19:31:16 UTC (rev 181174)
@@ -0,0 +1,9 @@
+Test that decoding an audio file which is too short does not cause a crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/webaudio/decode-audio-data-too-short.html (0 => 181174)


--- trunk/LayoutTests/webaudio/decode-audio-data-too-short.html	                        (rev 0)
+++ trunk/LayoutTests/webaudio/decode-audio-data-too-short.html	2015-03-06 19:31:16 UTC (rev 181174)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script type="text/_javascript_" src=""
+</head>
+<body>
+<script>
+description("Test that decoding an audio file which is too short does not cause a crash.");
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+window.jsTestIsAsync = true;
+
+var context = new webkitAudioContext();
+var request = new XMLHttpRequest();
+request.open("GET", 'resources/media/too-short.m4a', true);
+request.responseType = "arraybuffer";
+    
+request._onload_ = function() {
+    context.decodeAudioData(request.response, finishJSTest, finishJSTest);
+}
+request.send();
+
+</script>
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/webaudio/resources/media/too-short.m4a (0 => 181174)


--- trunk/LayoutTests/webaudio/resources/media/too-short.m4a	                        (rev 0)
+++ trunk/LayoutTests/webaudio/resources/media/too-short.m4a	2015-03-06 19:31:16 UTC (rev 181174)
@@ -0,0 +1,3 @@
+ftypmp42mp41isommdat'lUI\xC2\xC2A0P$+"A\x88PE1\x92\xC08\x90\x84!B@=\xFF5\xE6\xF3y\xBC6\xDF\xE5|\x9D\xBF\xAA\xC3\xFC\xD7\xFC\xAF\x8Dd\xF8͟\xFE/\xFC_\x8A\xC5\xFF+\xFEW\xF1\xC6 \xBF\xF1UdW\xF3_\xADu\xFE\xA0\xB4\xBF\xE5h\xA5\x8DP\xFE\xFA\xF8\xF8\xF8\xFE\xE4\xEF\xEFO\x8F\x8C\xCE\xFB\xFB\x90	\xD02||7\x9F\xDF܀\xFF\xDF\xDF\xDC\xF8\xF8m\xDF}\xF1\xF0l\xFE\xFE\xF0\x9F\xE1\xB0\xC3c\xDF\xDF\xDC?\xF0\xD8\xEF\xEF\xA0||6>\xFE\xE4\x8F\x83O\xBE\x80\xFF\xC7\xC1\x87\xB8>\xE4>>3\x80\xFE?\xC7\xF8\x9F\xC7
+_\xC3\xC4K\xF8\xC3\xF2'SS	\xC1C\x91$ \xF8\x8A(\xA0\xC7w;\xBE\xC3G\xF5nI\xF2\xDF\xEB?\x93\xFB\x8E\x86$\xD4E\xF2\x9D\xAA:\xE8J~C\x80\x8Cmoovlmvhd\xACD\xFF@\xD4trak\tkhd\xFF@pmdia mdhd\xACD\xFFU\xC4,hdlrsounSoundHandlerminfsmhd$dinfdrefurl \xE0stbldstsdTmp4a\xACD0esds\x80\x80\x80\x80\x80\x80@ww\x80\x80\x80sttsstscstsz\xDF3stco stssDudta4meta hdlrmdirilstXtra
\ No newline at end of file

Modified: trunk/Source/WebCore/ChangeLog (181173 => 181174)


--- trunk/Source/WebCore/ChangeLog	2015-03-06 19:28:26 UTC (rev 181173)
+++ trunk/Source/WebCore/ChangeLog	2015-03-06 19:31:16 UTC (rev 181174)
@@ -1,3 +1,17 @@
+2015-03-06  Jer Noble  <jer.no...@apple.com>
+
+        [Web Audio] Decoding specific .m4a file crashes tab
+        https://bugs.webkit.org/show_bug.cgi?id=139545
+
+        Reviewed by Eric Carlson.
+
+        Test: webaudio/decode-audio-data-too-short.html
+
+        Bail out early if CoreAudio reports the number of frames in the file to be negative.
+
+        * platform/audio/mac/AudioFileReaderMac.cpp:
+        (WebCore::AudioFileReader::createBus):
+
 2015-03-06  Jeremy Jones  <jere...@apple.com>
 
         Scroll to make the video element visible when exiting fullscreen.

Modified: trunk/Source/WebCore/platform/audio/mac/AudioFileReaderMac.cpp (181173 => 181174)


--- trunk/Source/WebCore/platform/audio/mac/AudioFileReaderMac.cpp	2015-03-06 19:28:26 UTC (rev 181173)
+++ trunk/Source/WebCore/platform/audio/mac/AudioFileReaderMac.cpp	2015-03-06 19:31:16 UTC (rev 181174)
@@ -147,7 +147,7 @@
     SInt64 numberOfFrames64 = 0;
     size = sizeof(numberOfFrames64);
     result = ExtAudioFileGetProperty(m_extAudioFileRef, kExtAudioFileProperty_FileLengthFrames, &size, &numberOfFrames64);
-    if (result != noErr)
+    if (result != noErr || numberOfFrames64 <= 0)
         return 0;
 
     // Sample-rate

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to