<commit_before>---
announced: December 15, 2015
fixed_in:
- Firefox 43
- Firefox ESR 38.5
impact: High
reporter: <NAME>
title: Integer underflow and buffer overflow processing MP4 metadata in libstagefright
---

<h3>Description</h3>

<p>Mozilla developer <strong><NAME></strong> fixed an integer underflow in the
libstagefright library initially reported by <NAME> to Google. The issues occurred
in MP4 format video file while parsing cover metadata, leading  to a buffer overflow. This
results in a potentially exploitable crash and can be triggered by a malformed MP4
file served by web content.
</p>

<p class="note">In general this flaw cannot be exploited through email in the
Thunderbird product, but is potentially a risk in browser or browser-like contexts.</p>

<h3>References</h3>

<ul>
  <li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1216748">
       potential underflow in 'covr', unchecked allocation and copy in Metadata::setData</a>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7222"
class="ex-ref">CVE-2015-7222</a>)</li>
   <li><a
href="https://android.googlesource.com/platform/frameworks/av/+/
c87faed60483afb2466e03892bda80b72e5822c7%5E!/#F0">Fix integer underflow in covr MPEG4
processing</a></li>
</ul>
<commit_msg>Remove linebreak in URL to referenced Android commit<commit_after>---
announced: December 15, 2015
fixed_in:
- Firefox 43
- Firefox ESR 38.5
impact: High
reporter: <NAME>
title: Integer underflow and buffer overflow processing MP4 metadata in libstagefright
---

<h3>Description</h3>

<p>Mozilla developer <strong><NAME></strong> fixed an integer underflow in the
libstagefright library initially reported by <NAME> to Google. The issues occurred
in MP4 format video file while parsing cover metadata, leading  to a buffer overflow. This
results in a potentially exploitable crash and can be triggered by a malformed MP4
file served by web content.
</p>

<p class="note">In general this flaw cannot be exploited through email in the
Thunderbird product, but is potentially a risk in browser or browser-like contexts.</p>

<h3>References</h3>

<ul>
  <li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1216748">
       potential underflow in 'covr', unchecked allocation and copy in Metadata::setData</a>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7222"
class="ex-ref">CVE-2015-7222</a>)</li>
   <li><a
href="https://android.googlesource.com/platform/frameworks/av/+/c87faed60483afb2466e03892bda80b72e5822c7%5E!/#F0">Fix integer underflow in covr MPEG4
processing</a></li>
</ul>

{'fraction_non_alphanumeric': 0.11490683229813664, 'fraction_numerical': 0.05357142857142857, 'mean_word_length': 5.092198581560283, 'pattern_counts': {'":': 0, '<': 53, '<?xml version=': 0, '>': 53, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1854597', 'n_tokens_mistral': 935, 'n_tokens_neox': 827, 'n_words': 274}