Bug 876118 - Impose a unified channel count limit of 10000 channels in Web Audio; r=roc

--HG--
extra : rebase_source : 480cebb99e5dd8673df179b490d11e6c513fa1d1

content/media/test/crashtests/876118.html

@@ -0,0 +1,16 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource7=Context0.createBufferSource();
+
+BufferSource7.connect(Context0.destination);
+BufferSource7.buffer=function(){
+	var length=7;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-1))};
+	return Buffer;
+}();
+
+
+Context0.destination.channelCountMode="explicit";
+Context0.destination.channelCount=519910189000000;
+</script>

content/media/test/crashtests/876207.html

@@ -0,0 +1,30 @@
+<script>
+try { o1 = new window.OfflineAudioContext(1, 10, 44100); } catch(e) { }
+try { o2 = o1.createChannelSplitter(1); } catch(e) { }
+try { o3 = o1.createAnalyser(); } catch(e) { }
+try { o4 = o1.createWaveShaper(); } catch(e) { }
+try { o5 = o1.createChannelSplitter(6); } catch(e) { }
+try { o6 = o1.createAnalyser(); } catch(e) { }
+try { o7 = o1.createBufferSource(); } catch(e) { }
+try { o7.connect(o1.destination); } catch(e) { }
+try { o7.buffer = function() {
+o8 = o1.createBuffer(1, 3, o1.sampleRate);
+o9 = o8.getChannelData(0);
+for(var i = 0; i < 3; ++i) {
+o9[i] = Math.sin(i * 127);
+}
+return o8;
+}()
+; } catch(e) { }
+try { o7.playbackRate.cancelScheduledValues(0) } catch(e) { }
+try { o7.channelInterpretation = 'speakers'; } catch(e) { }
+try { o1.destination.channelInterpretation = 'speakers'; } catch(e) { }
+try { o5.connect(o1.destination, 1, 1) } catch(e) { }
+try { o1.listener.setOrientation(0, 1073741824, 1073741824, 4194304, 1, 0) } catch(e) { }
+try { o4.curve = Float32Array(127); } catch(e) { }
+try { o6.getByteFrequencyData(Uint8Array(12)) } catch(e) { }
+try { o6.disconnect() } catch(e) { }
+try { o1.destination.channelCount = 33554432; } catch(e) { }
+try { o7.playbackRate.setTargetAtTime(0, 8388608, 1) } catch(e) { }
+try { o6.getByteTimeDomainData(Uint8Array(12)) } catch(e) { }
+</script>

content/media/test/crashtests/crashtests.list

@@ -22,6 +22,8 @@ load 874952.html
 load 875144.html
 load 875596.html
 load 875911.html
+load 876118.html
+load 876207.html
 load 876249.html
 load 876252.html
 load 876834.html

content/media/webaudio/AudioContext.cpp

@@ -28,12 +28,6 @@
 #include "WaveTable.h"
 #include "nsNetUtil.h"
 
-// Note that this number is an arbitrary large value to protect against OOM
-// attacks.
-const unsigned MAX_SCRIPT_PROCESSOR_CHANNELS = 10000;
-const unsigned MAX_CHANNEL_SPLITTER_OUTPUTS = UINT16_MAX;
-const unsigned MAX_CHANNEL_MERGER_INPUTS = UINT16_MAX;
-
 namespace mozilla {
 namespace dom {
 
@@ -211,8 +205,8 @@ AudioContext::CreateScriptProcessor(uint32_t aBufferSize,
                                     ErrorResult& aRv)
 {
   if ((aNumberOfInputChannels == 0 && aNumberOfOutputChannels == 0) ||
-      aNumberOfInputChannels > MAX_SCRIPT_PROCESSOR_CHANNELS ||
-      aNumberOfOutputChannels > MAX_SCRIPT_PROCESSOR_CHANNELS ||
+      aNumberOfInputChannels > WebAudioUtils::MaxChannelCount ||
+      aNumberOfOutputChannels > WebAudioUtils::MaxChannelCount ||
       !IsValidBufferSize(aBufferSize)) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
@@ -269,7 +263,7 @@ already_AddRefed<ChannelSplitterNode>
 AudioContext::CreateChannelSplitter(uint32_t aNumberOfOutputs, ErrorResult& aRv)
 {
   if (aNumberOfOutputs == 0 ||
-      aNumberOfOutputs > MAX_CHANNEL_SPLITTER_OUTPUTS) {
+      aNumberOfOutputs > WebAudioUtils::MaxChannelCount) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }
@@ -283,7 +277,7 @@ already_AddRefed<ChannelMergerNode>
 AudioContext::CreateChannelMerger(uint32_t aNumberOfInputs, ErrorResult& aRv)
 {
   if (aNumberOfInputs == 0 ||
-      aNumberOfInputs > MAX_CHANNEL_MERGER_INPUTS) {
+      aNumberOfInputs > WebAudioUtils::MaxChannelCount) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }

content/media/webaudio/AudioNode.h

@@ -17,6 +17,7 @@
 #include "AudioContext.h"
 #include "AudioParamTimeline.h"
 #include "MediaStreamGraph.h"
+#include "WebAudioUtils.h"
 
 struct JSContext;
 
@@ -161,7 +162,8 @@ public:
   uint32_t ChannelCount() const { return mChannelCount; }
   void SetChannelCount(uint32_t aChannelCount, ErrorResult& aRv)
   {
-    if (aChannelCount == 0) {
+    if (aChannelCount == 0 ||
+        aChannelCount > WebAudioUtils::MaxChannelCount) {
       aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
       return;
     }

content/media/webaudio/WebAudioUtils.h

@@ -21,6 +21,10 @@ class AudioNodeStream;
 namespace dom {
 
 struct WebAudioUtils {
+  // This is an arbitrary large number used to protect against OOMs.
+  // We can adjust it later if needed.
+  static const uint32_t MaxChannelCount = 10000;
+
   static bool FuzzyEqual(float v1, float v2)
   {
     using namespace std;