Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Media
DescriptionUse after free in Media
ComponentMedia
Sub-componentInternals>Media
Bug ClassUAF
Tracker560373976
Fix commitcb6ec6165f7d (chromium/src) +11/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-20

Changed Functions

FunctionChangeNotes
alpha_mode
media/formats/mp4/hevc.cc
modified
TEST
media/formats/mp4/hevc_unittest.cc
modified

Files Changed

  • media/formats/mp4/hevc_unittest.cc
  • media/formats/mp4/hevc.cc
From cb6ec6165f7dfa84b3b5837c074039a18c9a23a7 Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Tue, 15 Sep 2026 09:31:29 -0700
Subject: [PATCH] Initialize chroma_sampling in HEVCDecoderConfigurationRecord.

chroma_sampling was uninitialized upon default construction and remained
uninitialized if parsed extradata did not include SPS NALUs. This led to
use-of-uninitialized-value errors when GetChromaSampling() was called.

Fixed: 560373976
Change-Id: I88a09018ad45c3854ae42a6d05013dafbf866ace
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8408787
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Eugene Zemtsov <eugene@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1698165}
---
diff --git a/media/formats/mp4/hevc.cc b/media/formats/mp4/hevc.cc
index 50b0425..81c5802 100644
--- a/media/formats/mp4/hevc.cc
+++ b/media/formats/mp4/hevc.cc
@@ -51,6 +51,7 @@
       temporalIdNested(0),
       lengthSizeMinusOne(0),
       numOfArrays(0),
+      chroma_sampling(VideoChromaSampling::kUnknown),
       alpha_mode(VideoDecoderConfig::AlphaMode::kIsOpaque) {}
 
 HEVCDecoderConfigurationRecord::HEVCDecoderConfigurationRecord(
diff --git a/media/formats/mp4/hevc_unittest.cc b/media/formats/mp4/hevc_unittest.cc
index fe1dc87..8ab8950a 100644
--- a/media/formats/mp4/hevc_unittest.cc
+++ b/media/formats/mp4/hevc_unittest.cc
@@ -114,4 +114,14 @@
   EXPECT_TRUE(test_data == output);
 }
 
+TEST(HEVCAnalyzeAnnexBTest, HEVCDecoderConfigurationRecordDefaultValues) {
+  HEVCDecoderConfigurationRecord record;
+#if BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+  EXPECT_FALSE(record.GetColorSpace().IsSpecified());
+  EXPECT_EQ(record.GetChromaSampling(), VideoChromaSampling::kUnknown);
+  EXPECT_FALSE(record.GetHDRMetadata().IsValid());
+  EXPECT_EQ(record.GetAlphaMode(), VideoDecoderConfig::AlphaMode::kIsOpaque);
+#endif  // BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+}
+
 }  // namespace media::mp4
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/media/formats/mp4/hevc_unittest.cc b/media/formats/mp4/hevc_unittest.cc
index fe1dc87..8ab8950a 100644
--- a/media/formats/mp4/hevc_unittest.cc
+++ b/media/formats/mp4/hevc_unittest.cc
@@ -114,4 +114,14 @@
   EXPECT_TRUE(test_data == output);
 }
 
+TEST(HEVCAnalyzeAnnexBTest, HEVCDecoderConfigurationRecordDefaultValues) {
+  HEVCDecoderConfigurationRecord record;
+#if BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+  EXPECT_FALSE(record.GetColorSpace().IsSpecified());
+  EXPECT_EQ(record.GetChromaSampling(), VideoChromaSampling::kUnknown);
+  EXPECT_FALSE(record.GetHDRMetadata().IsValid());
+  EXPECT_EQ(record.GetAlphaMode(), VideoDecoderConfig::AlphaMode::kIsOpaque);
+#endif  // BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+}
+
 }  // namespace media::mp4
Loading diff…

Original Bug Report

reported by 24...@project.gserviceaccount.com

media_pipeline_integration_fuzzer: Use-of-uninitialized-value in media::mp4::HEVCDecoderConfigurationRecord::GetChromaSampling

Detailed Report: https://clusterfuzz.com/testcase?key=5559906392375296

Fuzzing Engine: libFuzzer Fuzz Target: media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_msan_schemav1 Platform Id: linux

Crash Type: Use-of-uninitialized-value Crash Address: Crash State: media::mp4::HEVCDecoderConfigurationRecord::GetChromaSampling media::AVStreamToVideoDecoderConfig media::FFmpegDemuxerStream::Create

Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Crash Revision: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan_schemav1&revision=1695515

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5559906392375296

Issue filed automatically.

See https://www.chromium.org/developers/testing/memorysanitizer#TOC-Reproducing-ClusterFuzz-Bugs for instructions on reproducing this bug locally.

View on issue tracker