Firefox 1.9.1 Ogg Theora Decoder Segfault Vulnerability Analysis

Critical Vulnerability Information Bug ID: Bug 504843 Title: crash (segfault) @ oc_sb_create_plane_mapping when playing corrupted ogg theora file Type: defect Priority: P2 Severity: normal Vulnerability Description Status: RESOLVED FIXED Product: Core Component: Audio/Video Platform: x86 Linux Version: 1.9.1 Affected Versions State Tracking: status1.9.2 beta-fixed, status1.9.1.5+ Status Flags: beta-fixed, 1.9.1.5+ Reproduction Steps Steps to Reproduce: 1. Load the attached file. Actual Result: Firefox crashes. Expected Result: Should display some kind of "file is corrupted" message. Provided Test Files Audio File (test file causing crash) Stack trace of the relevant thread Vulnerability Analysis Root Cause: When playing a corrupted Ogg Theora file, the decoder (liboggplay and libtheora) encounters invalid frame width and height values in the file header, leading to a segmentation fault (segfault) during processing. Mitigation: Updated liboggplay and libtheora with added frame size limits and stricter validation checks. Additional Information Discussion: Extensive discussion focused on properly handling unreasonable values in media file headers and optimizing liboggplay and libtheora to prevent such issues. Patches: Multiple patch versions and code changes were provided to resolve the issue.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox 1.9.1 Ogg Theora Decoder Segfault Vulnerability Analysis