CVE-2026-113028
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
alpha_modemedia/formats/mp4/hevc.cc |
modified | |
TESTmedia/formats/mp4/hevc_unittest.cc |
modified |
Files Changed
media/formats/mp4/hevc_unittest.ccmedia/formats/mp4/hevc.cc
Patch
From cb6ec6165f7dfa84b3b5837c074039a18c9a23a7 Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Tue, 15 Sep 2026 09:31:29 -0700
Subject: [PATCH] Initialize chroma_sampling in HEVCDecoderConfigurationRecord.
chroma_sampling was uninitialized upon default construction and remained
uninitialized if parsed extradata did not include SPS NALUs. This led to
use-of-uninitialized-value errors when GetChromaSampling() was called.
Fixed: 560373976
Change-Id: I88a09018ad45c3854ae42a6d05013dafbf866ace
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8408787
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Eugene Zemtsov <eugene@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1698165}
---
diff --git a/media/formats/mp4/hevc.cc b/media/formats/mp4/hevc.cc
index 50b0425..81c5802 100644
--- a/media/formats/mp4/hevc.cc
+++ b/media/formats/mp4/hevc.cc
@@ -51,6 +51,7 @@
temporalIdNested(0),
lengthSizeMinusOne(0),
numOfArrays(0),
+ chroma_sampling(VideoChromaSampling::kUnknown),
alpha_mode(VideoDecoderConfig::AlphaMode::kIsOpaque) {}
HEVCDecoderConfigurationRecord::HEVCDecoderConfigurationRecord(
diff --git a/media/formats/mp4/hevc_unittest.cc b/media/formats/mp4/hevc_unittest.cc
index fe1dc87..8ab8950a 100644
--- a/media/formats/mp4/hevc_unittest.cc
+++ b/media/formats/mp4/hevc_unittest.cc
@@ -114,4 +114,14 @@
EXPECT_TRUE(test_data == output);
}
+TEST(HEVCAnalyzeAnnexBTest, HEVCDecoderConfigurationRecordDefaultValues) {
+ HEVCDecoderConfigurationRecord record;
+#if BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+ EXPECT_FALSE(record.GetColorSpace().IsSpecified());
+ EXPECT_EQ(record.GetChromaSampling(), VideoChromaSampling::kUnknown);
+ EXPECT_FALSE(record.GetHDRMetadata().IsValid());
+ EXPECT_EQ(record.GetAlphaMode(), VideoDecoderConfig::AlphaMode::kIsOpaque);
+#endif // BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+}
+
} // namespace media::mp4
Regression Test / PoC
diff --git a/media/formats/mp4/hevc_unittest.cc b/media/formats/mp4/hevc_unittest.cc
index fe1dc87..8ab8950a 100644
--- a/media/formats/mp4/hevc_unittest.cc
+++ b/media/formats/mp4/hevc_unittest.cc
@@ -114,4 +114,14 @@
EXPECT_TRUE(test_data == output);
}
+TEST(HEVCAnalyzeAnnexBTest, HEVCDecoderConfigurationRecordDefaultValues) {
+ HEVCDecoderConfigurationRecord record;
+#if BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+ EXPECT_FALSE(record.GetColorSpace().IsSpecified());
+ EXPECT_EQ(record.GetChromaSampling(), VideoChromaSampling::kUnknown);
+ EXPECT_FALSE(record.GetHDRMetadata().IsValid());
+ EXPECT_EQ(record.GetAlphaMode(), VideoDecoderConfig::AlphaMode::kIsOpaque);
+#endif // BUILDFLAG(ENABLE_HEVC_PARSER_AND_HW_DECODER)
+}
+
} // namespace media::mp4
Original Bug Report
media_pipeline_integration_fuzzer: Use-of-uninitialized-value in media::mp4::HEVCDecoderConfigurationRecord::GetChromaSampling
Detailed Report: https://clusterfuzz.com/testcase?key=5559906392375296
Fuzzing Engine: libFuzzer Fuzz Target: media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_msan_schemav1 Platform Id: linux
Crash Type: Use-of-uninitialized-value Crash Address: Crash State: media::mp4::HEVCDecoderConfigurationRecord::GetChromaSampling media::AVStreamToVideoDecoderConfig media::FFmpegDemuxerStream::Create
Sanitizer: memory (MSAN)
Recommended Security Severity: Medium
Crash Revision: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan_schemav1&revision=1695515
Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5559906392375296
Issue filed automatically.
See https://www.chromium.org/developers/testing/memorysanitizer#TOC-Reproducing-ClusterFuzz-Bugs for instructions on reproducing this bug locally.