New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 600968 link

Starred by 0 users

Issue metadata

Status: Duplicate
Merged: issue 600669
Owner:
Closed: May 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security

Blocking:
issue 591845



Sign in to add a comment

Use-of-uninitialized-value in vorbis_header

Project Member Reported by ClusterFuzz, Apr 6 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4931256059428864

Fuzzer: libfuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  vorbis_header
  ogg_packet
  ogg_get_length
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=379005:379097

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96vzen_XWBGxTr1FprvIrBWqWfbXOpS9p91EcIMrB6DGkBQ7oeAlzYH5bzcV45uP9fAbasQB0AJUhOt68T1zQVY33XqSRwNIEAqWzIlIykb2ugnIzZE3L9Yy7je5NgBm6iMJmDk4VBXb8o8KVP59G7xhttBeQ

Filer: mmoroz

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: jrumm...@chromium.org kcc@chromium.org aizatsky@chromium.org dalecur...@chromium.org infe...@chromium.org
Owner: xhw...@chromium.org
Project Member

Comment 2 by ClusterFuzz, Apr 6 2016

Status: Assigned (was: Available)

Comment 3 by kenrb@chromium.org, Apr 6 2016

Components: Internals>Media
Owner: wolenetz@chromium.org
tentatively to wolenetz@ who will work on ffmpeg roll for M51.
Blocking: 591845

Comment 6 by mmoroz@chromium.org, Apr 25 2016

Labels: -Security_Severity-Low Security_Severity-Medium

Comment 7 by vakh@chromium.org, Apr 25 2016

Labels: M-51

Comment 8 by vakh@chromium.org, Apr 25 2016

Labels: -M-51 M-50
wolenetz@ -- setting current milestone (M50) as the milestone since it is a Medium Pri bug. Please feel free to change.
Project Member

Comment 9 by ClusterFuzz, Apr 26 2016

Labels: Pri-1
Project Member

Comment 10 by sheriffbot@chromium.org, Apr 26 2016

Labels: -Security_Impact-Head Security_Impact-Stable
wolenetz: Uh oh! This issue still open and hasn't been updated in the last 19 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: chcunningham@chromium.org tguilbert@chromium.org
Cc: -chcunningham@chromium.org wolenetz@chromium.org
Owner: chcunningham@chromium.org
Sharding this one to chcunningham@. Thanks Chris!
Mergedinto: 600669
Status: Duplicate (was: Assigned)
This seems likely to be same root cause as  Issue 600669 . Same stack / line number. See https://bugs.chromium.org/p/chromium/issues/detail?id=600669#c13
Project Member

Comment 14 by ClusterFuzz, May 10 2016

ClusterFuzz has detected this issue as fixed in range 391516:392381.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4931256059428864

Fuzzer: libfuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  vorbis_header
  ogg_packet
  ogg_get_length
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=379005:379097
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=391516:392381

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96vzen_XWBGxTr1FprvIrBWqWfbXOpS9p91EcIMrB6DGkBQ7oeAlzYH5bzcV45uP9fAbasQB0AJUhOt68T1zQVY33XqSRwNIEAqWzIlIykb2ugnIzZE3L9Yy7je5NgBm6iMJmDk4VBXb8o8KVP59G7xhttBeQ

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 15 by sheriffbot@chromium.org, Aug 21 2016

Labels: -Restrict-View-SecurityTeam
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 16 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 17 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment