CVE-2026-113028
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
alpha_modemedia/formats/mp4/hevc.cc |
modified | |
TESTmedia/formats/mp4/hevc_unittest.cc |
modified |
Files Changed
media/formats/mp4/hevc_unittest.ccmedia/formats/mp4/hevc.cc
Patch
From cb6ec6165f7dfa84b3b5837c074039a18c9a23a7 Mon Sep 17 00:00:00 2001 From: Dale Curtis <[email protected]> Date: Tue, 15 Sep 2026 09:31:29 -0700 Subject: [PATCH] Initialize chroma_sampling in HEVCDecoderConfigurationRecord. chroma_sampling was uninitialized upon default construction and remained uninitialized if parsed extradata did not include SPS NALUs. This led to use-of-uninitialized-value errors when GetChromaSampling() was called. Fixed: 560373976 Change-Id: I88a09018ad45c3854ae42a6d05013dafbf866ace Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8408787 Commit-Queue: Dale Curtis <[email protected]> Reviewed-by: Eugene Zemtsov <[email protected]> Cr-Commit-Position: refs/heads/main@{#1698165} --- diff --git a/media/formats/mp4/hevc.cc b/media/formats/mp4/hevc.cc index 50b0425..81c5802 100644 --- a/media/formats/mp4/hevc.cc +++ b/media/formats/mp4/hevc.cc @@ -51,6 +51,7 @@ temporalIdNested(0), lengthSizeMinusOne(0), numOfArrays(0), + chroma_sampling(VideoChromaSampling::kUnknown), alpha_mode(VideoDecoderConfig::AlphaMode::kIsOpaque) {} HEVCDecoderConfigurationRecord::HEVCDecoderConfigurationRecord( diff --git a/media/formats/mp4/hevc_unittest.cc b/media/formats/mp4/hevc_unittest.cc index fe1dc87..8ab8950a 100644 --- a/media/formats/mp4/hevc_unittest.cc +++ b/media/formats/mp4/hevc_unittest.cc @@ -114,4 +114,14 @@ EXPECT_TRUE(test_data == output); } +TEST(HEVCAnalyzeAnnexBTest, HEVCDecoderConfigurationRecordDefaultValues) { + HEVCDecoderConfigurationRecord record; +#if BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER) + EXPECT_FALSE(record.GetColorSpace().IsSpecified()); + EXPECT_EQ(record.GetChromaSampling(), VideoChromaSampling::kUnknown); + EXPECT_FALSE(record.GetHDRMetadata().IsValid()); + EXPECT_EQ(record.GetAlphaMode(), VideoDecoderConfig::AlphaMode::kIsOpaque); +#endif // BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER) +} + } // namespace media::mp4
Regression Test / PoC
diff --git a/media/formats/mp4/hevc_unittest.cc b/media/formats/mp4/hevc_unittest.cc
index fe1dc87..8ab8950a 100644
--- a/media/formats/mp4/hevc_unittest.cc
+++ b/media/formats/mp4/hevc_unittest.cc
@@ -114,4 +114,14 @@
EXPECT_TRUE(test_data == output);
}
+TEST(HEVCAnalyzeAnnexBTest, HEVCDecoderConfigurationRecordDefaultValues) {
+ HEVCDecoderConfigurationRecord record;
+#if BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+ EXPECT_FALSE(record.GetColorSpace().IsSpecified());
+ EXPECT_EQ(record.GetChromaSampling(), VideoChromaSampling::kUnknown);
+ EXPECT_FALSE(record.GetHDRMetadata().IsValid());
+ EXPECT_EQ(record.GetAlphaMode(), VideoDecoderConfig::AlphaMode::kIsOpaque);
+#endif // BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+}
+
} // namespace media::mp4
Original Bug Report
media_pipeline_integration_fuzzer: Use-of-uninitialized-value in media::mp4::HEVCDecoderConfigurationRecord::GetChromaSampling
Detailed Report: https://clusterfuzz.com/testcase?key=5559906392375296
Fuzzing Engine: libFuzzer Fuzz Target: media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_msan_schemav1 Platform Id: linux
Crash Type: Use-of-uninitialized-value Crash Address: Crash State: media::mp4::HEVCDecoderConfigurationRecord::GetChromaSampling media::AVStreamToVideoDecoderConfig media::FFmpegDemuxerStream::Create
Sanitizer: memory (MSAN)
Recommended Security Severity: Medium
Crash Revision: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan_schemav1&revision=1695515
Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5559906392375296
Issue filed automatically.
See https://www.chromium.org/developers/testing/memorysanitizer#TOC-Reproducing-ClusterFuzz-Bugs for instructions on reproducing this bug locally.