CVE-2025-5283
Overview
Background
- libvpx multi-resolution encoding
- libvpx (bundled under
media/libvpx) can encode multiple resolutions of the same stream;vpx_codec_enc_init_multi_verinitializes an array of encoder contexts, one per resolution. - `mr_cfg` / `mr_low_res_mode_info`
- The multi-resolution config passed to each encoder’s
init.mr_low_res_mode_infois a heap buffer of mode information shared across the resolution contexts; exactly one context is meant to own and later free it. - `vpx_codec_destroy`
- Tears down an encoder instance and frees resources it owns, including
mr_low_res_mode_infowhen the instance is the owning (first) context.
Root Cause Analysis
Ownership of the shared mr_low_res_mode_info buffer was transferred into each encoder context’s priv->oxcf as part of set_vp8e_config, but vp8e_init did not clear that ownership when encoder creation failed. When vp8_create_compressor(&priv->oxcf) returned NULL (a failed allocation), the old code simply set res = VPX_CODEC_MEM_ERROR and left priv->oxcf.mr_low_res_mode_info pointing at the shared buffer with mr_total_resolutions/mr_encoder_id still indicating this context owned/freed it. Control returned to vpx_codec_enc_init_multi_ver, which — on the failure path — tears the contexts down. Both the failed context (via its stale ownership fields) and the real owner could end up freeing the same mr_low_res_mode_info pointer, producing a double free (CWE-416) and heap corruption.
The patch makes the failed context relinquish ownership. On !priv->cpi, under #if CONFIG_MULTI_RES_ENCODING, it zeroes priv->oxcf.mr_total_resolutions = 0, priv->oxcf.mr_encoder_id = 0, and priv->oxcf.mr_low_res_mode_info = NULL before setting the error, so a subsequent vpx_codec_destroy on this instance will not free the shared buffer. The companion comment added to vpx_codec_enc_init_multi_ver codifies the invariant: a ctx takes ownership of mr_cfg.mr_low_res_mode_info only if its init succeeds, and the first ctx entry is responsible for freeing it. The advisory describes this as a double-free after a failed allocation; the diff substantiates exactly that — a freed-memory/ownership-confusion lifetime bug (double free), a member of the use-after-free class (CWE-416).
init left the dead context still claiming ownership of the shared mr_low_res_mode_info buffer, so teardown freed that one buffer twice; the fix nulls the ownership fields on the failure path so only the surviving owner frees it.Attack Path
- Attacker Establishes a WebRTC session (or otherwise drives multi-resolution VP8 encoder init) with the victim’s Firefox, negotiating parameters that use multi-resolution encoding. (UI:R per the vector — victim accepts/engages the call)
- Allocation failure
Induces or races a memory-allocation failure in
vp8_create_compressorduring one resolution context’sinit(e.g. via memory pressure or crafted large parameters). - Stale ownership
vp8e_initreturnsVPX_CODEC_MEM_ERRORwithpriv->oxcf.mr_low_res_mode_infostill set and ownership fields non-zero. - Double free
vpx_codec_enc_init_multi_ver’s failure teardown frees the sharedmr_low_res_mode_infovia this dead context, and again via the real owner. - Primitive Double free / heap corruption in the media encoder; “a potentially exploitable crash” per the advisory (escalation to code execution inferred, not shown by the diff).
Impact Assessment
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifmedia/libvpx/libvpx/vp8/vp8_cx_iface.c |
modified |
Files Changed
media/libvpx/libvpx/vp8/vp8_cx_iface.cmedia/libvpx/libvpx/vpx/src/vpx_encoder.c
Audit Directions
- Error paths in encoder/decoder initAudit other libvpx (and other bundled codec)
initcallbacks for shared buffers whose ownership is set up before a fallible allocation and not relinquished on failure. - Partial-init teardownReview
vpx_codec_destroyand the multi-init failure teardown for other members freed per-context that are actually shared.
Patch
diff --git a/media/libvpx/libvpx/vp8/vp8_cx_iface.c b/media/libvpx/libvpx/vp8/vp8_cx_iface.c
index 668bd0816dc..e5d816cef36 100644
--- a/media/libvpx/libvpx/vp8/vp8_cx_iface.c
+++ b/media/libvpx/libvpx/vp8/vp8_cx_iface.c
@@ -732,7 +732,17 @@ static vpx_codec_err_t vp8e_init(vpx_codec_ctx_t *ctx,
set_vp8e_config(&priv->oxcf, priv->cfg, priv->vp8_cfg, mr_cfg);
priv->cpi = vp8_create_compressor(&priv->oxcf);
- if (!priv->cpi) res = VPX_CODEC_MEM_ERROR;
+ if (!priv->cpi) {
+#if CONFIG_MULTI_RES_ENCODING
+ // Release ownership of mr_cfg->mr_low_res_mode_info on failure. This
+ // prevents ownership confusion with the caller and avoids a double
+ // free when vpx_codec_destroy() is called on this instance.
+ priv->oxcf.mr_total_resolutions = 0;
+ priv->oxcf.mr_encoder_id = 0;
+ priv->oxcf.mr_low_res_mode_info = NULL;
+#endif
+ res = VPX_CODEC_MEM_ERROR;
+ }
}
}
diff --git a/media/libvpx/libvpx/vpx/src/vpx_encoder.c b/media/libvpx/libvpx/vpx/src/vpx_encoder.c
index 001d854abe9..3af4cea3a70 100644
--- a/media/libvpx/libvpx/vpx/src/vpx_encoder.c
+++ b/media/libvpx/libvpx/vpx/src/vpx_encoder.c
@@ -114,6 +114,9 @@ vpx_codec_err_t vpx_codec_enc_init_multi_ver(
ctx->priv = NULL;
ctx->init_flags = flags;
ctx->config.enc = cfg;
+ // ctx takes ownership of mr_cfg.mr_low_res_mode_info if and only if
+ // this call succeeds. The first ctx entry in the array is
+ // responsible for freeing the memory.
res = ctx->iface->init(ctx, &mr_cfg);
}