From e41b82bd3929a78fee8f9a0595c256cfcf32ebd9 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 25 Feb 2026 20:01:52 +0100 Subject: [PATCH] [WebRTC] Ensure valid image size. Extremely small encoded image sizes should be considered corrupt data. Drive-by improvement: make sure to cast the encoded image data length to uint32_t for use with `CreateEmptyFrame` --- .../signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp b/media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp index 5cd73edbc3..ad10bedf50 100644 --- a/media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp +++ b/media/webrtc/signaling/src/media-conduit/WebrtcGmpVideoCodec.cpp @@ -820,7 +820,9 @@ WebrtcGmpVideoDecoder::Decode_g(const webrtc::EncodedImage& aInputImage, } MOZ_ASSERT(mHost); - if (!aInputImage._length) { + uint32_t dataSize=static_cast(aInputImage._length); + if (dataSize < 4) { + LOGD(("GMP Decode: bad input size (%zu)!", aInputImage._length)); return WEBRTC_VIDEO_CODEC_ERROR; } @@ -831,7 +833,7 @@ WebrtcGmpVideoDecoder::Decode_g(const webrtc::EncodedImage& aInputImage, } GMPUniquePtr frame(static_cast(ftmp)); - err = frame->CreateEmptyFrame(aInputImage._length); + err = frame->CreateEmptyFrame(dataSize); if (err != GMPNoErr) { return WEBRTC_VIDEO_CODEC_ERROR; } @@ -863,7 +865,7 @@ WebrtcGmpVideoDecoder::Decode_g(const webrtc::EncodedImage& aInputImage, nsTArray codecSpecificInfo; codecSpecificInfo.AppendElements((uint8_t*)&info, sizeof(GMPCodecSpecificInfo)); - LOGD(("GMP Decode: %llu, len %d", frame->TimeStamp(), aInputImage._length)); + LOGD(("GMP Decode: %llu, len %d", frame->TimeStamp(), dataSize)); nsresult rv = mGMP->Decode(Move(frame), aMissingFrames, codecSpecificInfo,