tor-browser

commit 4f57f90c265de2774990c22c21e7277024c8176a
parent bc25ea10e67818e1927e20961551178d12ac8f1d
Author: Andreas Pehrson <apehrson@mozilla.com>
Date:   Tue,  7 Oct 2025 16:29:33 +0000

Bug 1991492 - In MERVS::ChooseCapability check for invalid constraints. r=jib

Differential Revision: https://phabricator.services.mozilla.com/D267585

Diffstat:
M
dom/media/tests/crashtests/1490700.html
 | 
29
++++++++++++++++-------------
M
dom/media/webrtc/MediaEngineRemoteVideoSource.cpp
 | 
42
+++++++++++++++++++++++++++++++++++-------
M
dom/media/webrtc/MediaEngineRemoteVideoSource.h
 | 
3
++-

3 files changed, 53 insertions(+), 21 deletions(-)
diff --git a/dom/media/tests/crashtests/1490700.html b/dom/media/tests/crashtests/1490700.html
@@ -7,19 +7,22 @@
 <script type="application/javascript">
 async function test() {
   SpecialPowers.wrap(document).notifyUserGestureActivation();
-  await window.navigator.mediaDevices.getUserMedia({
-    video: {
-      mediaSource: 'screen',
-      height: {max: 0},
-    },
-  });
-  await window.navigator.mediaDevices.getUserMedia({
-    video: {
-      mediaSource: 'screen',
-      advanced: [{height: 0}],
-    },
-  });
-  document.documentElement.removeAttribute("class");
+  try {
+    await window.navigator.mediaDevices.getUserMedia({
+      video: {
+        mediaSource: 'screen',
+        height: {max: 0},
+      },
+    });
+    await window.navigator.mediaDevices.getUserMedia({
+      video: {
+        mediaSource: 'screen',
+        advanced: [{height: 0}],
+      },
+    });
+  } finally {
+    document.documentElement.removeAttribute("class");
+  }
 }
 
 test();
diff --git a/dom/media/webrtc/MediaEngineRemoteVideoSource.cpp b/dom/media/webrtc/MediaEngineRemoteVideoSource.cpp
@@ -243,9 +243,12 @@ nsresult MediaEngineRemoteVideoSource::Allocate(
   webrtc::CaptureCapability newCapability;
   LOG("ChooseCapability(%s) for mCapability (Allocate) ++",
       ToString(distanceMode));
-  if (!ChooseCapability(c, aPrefs, newCapability, distanceMode)) {
-    *aOutBadConstraint =
-        MediaConstraintsHelper::FindBadConstraint(c, aPrefs, mMediaDevice);
+  if (!ChooseCapability(c, aPrefs, newCapability, distanceMode,
+                        aOutBadConstraint)) {
+    if (aOutBadConstraint && !*aOutBadConstraint) {
+      *aOutBadConstraint =
+          MediaConstraintsHelper::FindBadConstraint(c, aPrefs, mMediaDevice);
+    }
     return NS_ERROR_FAILURE;
   }
   LOG("ChooseCapability(%s) for mCapability (Allocate) --",
@@ -476,9 +479,12 @@ nsresult MediaEngineRemoteVideoSource::Reconfigure(
   webrtc::CaptureCapability newCapability;
   LOG("ChooseCapability(%s) for mTargetCapability (Reconfigure) ++",
       ToString(distanceMode));
-  if (!ChooseCapability(c, aPrefs, newCapability, distanceMode)) {
-    *aOutBadConstraint =
-        MediaConstraintsHelper::FindBadConstraint(c, aPrefs, mMediaDevice);
+  if (!ChooseCapability(c, aPrefs, newCapability, distanceMode,
+                        aOutBadConstraint)) {
+    if (aOutBadConstraint && !*aOutBadConstraint) {
+      *aOutBadConstraint =
+          MediaConstraintsHelper::FindBadConstraint(c, aPrefs, mMediaDevice);
+    }
     return NS_ERROR_INVALID_ARG;
   }
   LOG("ChooseCapability(%s) for mTargetCapability (Reconfigure) --",
@@ -887,7 +893,7 @@ static void LogCapability(const char* aHeader,
 bool MediaEngineRemoteVideoSource::ChooseCapability(
     const NormalizedConstraints& aConstraints, const MediaEnginePrefs& aPrefs,
     webrtc::CaptureCapability& aCapability,
-    const DistanceCalculation aCalculate) {
+    const DistanceCalculation aCalculate, const char** aOutBadConstraint) {
   LOG("%s", __PRETTY_FUNCTION__);
   AssertIsOnOwningThread();
 
@@ -907,7 +913,29 @@ bool MediaEngineRemoteVideoSource::ChooseCapability(
     case camera::ScreenEngine:
     case camera::WinEngine:
     case camera::BrowserEngine: {
+      MOZ_ASSERT_IF(aOutBadConstraint, !*aOutBadConstraint);
       FlattenedConstraints c(aConstraints);
+      const auto checkConstraint = [](const auto& aConstraint) {
+        return aConstraint.mMin <= aConstraint.mMax && aConstraint.mMax > 0;
+      };
+      if (!checkConstraint(c.mWidth)) {
+        if (aOutBadConstraint) {
+          *aOutBadConstraint = "width";
+        }
+        return false;
+      }
+      if (!checkConstraint(c.mHeight)) {
+        if (aOutBadConstraint) {
+          *aOutBadConstraint = "height";
+        }
+        return false;
+      }
+      if (!checkConstraint(c.mFrameRate)) {
+        if (aOutBadConstraint) {
+          *aOutBadConstraint = "frameRate";
+        }
+        return false;
+      }
       // DesktopCaptureImpl polls for frames and so must know the framerate to
       // capture at. This is signaled through CamerasParent as the capability's
       // maxFPS. Note that DesktopCaptureImpl does not expose any capabilities.
diff --git a/dom/media/webrtc/MediaEngineRemoteVideoSource.h b/dom/media/webrtc/MediaEngineRemoteVideoSource.h
@@ -68,7 +68,8 @@ class MediaEngineRemoteVideoSource : public MediaEngineSource,
   bool ChooseCapability(const NormalizedConstraints& aConstraints,
                         const MediaEnginePrefs& aPrefs,
                         webrtc::CaptureCapability& aCapability,
-                        const DistanceCalculation aCalculate);
+                        const DistanceCalculation aCalculate,
+                        const char** aOutBadConstraint);
 
   uint32_t GetDistance(const webrtc::CaptureCapability& aCandidate,
                        const NormalizedConstraintSet& aConstraints,