Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactHeap buffer overflow in libaom
DescriptionHeap buffer overflow in libaom
ComponentChromium
Bug ClassOOB
Tracker432035817
Fix commit4ac713469d51 (chromium/src) +3/-3
CISA KEVNot listed
CreditedAnonymous
Disclosed2025-08-12

Files Changed

  • DEPS
  • third_party/libaom/README.chromium
  • third_party/libaom/source/libaom
From 4ac713469d5143f128789572620e3a9721210a2c Mon Sep 17 00:00:00 2001
From: Marco Paniconi <marpan@google.com>
Date: Fri, 29 Aug 2025 12:25:57 -0700
Subject: [PATCH] [CfM-R138][Merge M138] Restrict src_sad_blk_64x64 to single spatial layer

Cherry-pick the fix for this issue.

Bug: b:433046392, b:432035817
Change-Id: Ia7beb92901cb10050d000b2d71eaa09ca8036581
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6825313
Reviewed-by: Wan-Teh Chang <wtc@google.com>
Reviewed-by: James Zern <jzern@google.com>
Commit-Queue: Marco Paniconi <marpan@google.com>
Cr-Original-Commit-Position: refs/branch-heads/7204@{#2859}
Cr-Original-Branched-From: d5de512dc9dc8ddfe4e6d71b0637578bb6158683-refs/heads/main@{#1465706}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6897209
Reviewed-by: Kyle Williams <kdgwill@chromium.org>
Auto-Submit: Joshua Pius <joshuapius@google.com>
Reviewed-by: Niko Tsirakis <ntsirakis@google.com>
Owners-Override: Joshua Pius <joshuapius@google.com>
Commit-Queue: Joshua Pius <joshuapius@google.com>
Cr-Commit-Position: refs/branch-heads/7204_184@{#15}
Cr-Branched-From: 7ea839044480a944888296dc0cccc5afb60b736c-refs/branch-heads/7204@{#2436}
Cr-Branched-From: d5de512dc9dc8ddfe4e6d71b0637578bb6158683-refs/heads/main@{#1465706}
---

diff --git a/DEPS b/DEPS
index 1b0ae0a..3bc48a4 100644
--- a/DEPS
+++ b/DEPS
@@ -2285,7 +2285,7 @@
     Var('chromium_git') + '/external/libaddressinput.git' + '@' + '2610f7b1043d6784ada41392fc9392d1ea09ea07',
 
   'src/third_party/libaom/source/libaom':
-    Var('aomedia_git') + '/aom.git' + '@' +  '2cca4aba034f99842c2e6cdc173f83801d289764',
+    Var('aomedia_git') + '/aom.git' + '@' +  '1a5d58271aa6133b6fa7da9fa365290cc4f2cc4d',
 
   'src/third_party/crabbyavif/src':
     Var('chromium_git') + '/external/github.com/webmproject/CrabbyAvif.git' + '@' + Var('crabbyavif_revision'),
diff --git a/third_party/libaom/README.chromium b/third_party/libaom/README.chromium
index 7bbcd267..f9a09ff 100644
--- a/third_party/libaom/README.chromium
+++ b/third_party/libaom/README.chromium
@@ -2,7 +2,7 @@
 Short Name: libaom
 URL: https://aomedia.googlesource.com/aom/
 Version: N/A
-Revision: 2cca4aba034f99842c2e6cdc173f83801d289764
+Revision: 1a5d58271aa6133b6fa7da9fa365290cc4f2cc4d
 CPEPrefix: cpe:/a:aomedia:aomedia:3.12.1
 License: BSD-2-Clause, Patent
 License Android Compatible: yes
diff --git a/third_party/libaom/source/libaom b/third_party/libaom/source/libaom
index 2cca4ab..1a5d582 160000
--- a/third_party/libaom/source/libaom
+++ b/third_party/libaom/source/libaom
@@ -1 +1 @@
-Subproject commit 2cca4aba034f99842c2e6cdc173f83801d289764
+Subproject commit 1a5d58271aa6133b6fa7da9fa365290cc4f2cc4d
Loading diff…

Original Bug Report

reported by jo...@gmail.com

Crash with three-way self Jitsi Meet call

IMPORTANT: Your crash has already been automatically reported to our crash system. Please file this bug only if you can provide more information about it.

Chrome Version: 138.0.7204.158 Operating System: Mac OS X 15.5.0

URL (if applicable) where crash occurred: https://beta.meet.jit.si/ATestJitsiConference/.

Can you reproduce this crash?

What steps will reproduce this crash? (If it’s not reproducible, what were you doing just before the crash?)

  1. Join a three-way call to the same Jitsi Meet conference, in three separate tabs. Turn on sending video on each tab. Turn on background blur for each video.
  2. Pull out the three tabs to three separate windows, all visible on-screen.
  3. Wait.

All three tabs crashed for me near-simultaneously. I have uploaded all three crashes. The three crash IDs are:

Crash from Tuesday, July 15, 2025 at 3:49:02 PM Status: Uploaded Uploaded Crash Report ID: 859a626b13b72cf4 Upload Time: Tuesday, July 15, 2025 at 4:04:03 PM Local Crash Context: 9e038f09-8976-45b5-8199-eae8e159ef68

Crash from Tuesday, July 15, 2025 at 3:48:39 PM Status: Uploaded Uploaded Crash Report ID: 4687da90671adb6e Upload Time: Tuesday, July 15, 2025 at 4:04:03 PM Local Crash Context: 10632e25-608c-4274-b3fd-7c5255fe0a9b

Crash from Tuesday, July 15, 2025 at 3:48:35 PM Status: Uploaded Uploaded Crash Report ID: f9d9ae28f307b76a Upload Time: Tuesday, July 15, 2025 at 4:04:03 PM Local Crash Context: 78a40942-7628-4a1f-8a03-99b59c3251d6

DO NOT CHANGE BELOW THIS LINE Crash ID: crash/f9d9ae28f307b76a

View on issue tracker