Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5022191997681664

Fuzzer: libfuzzer_media_vpx_video_decoder_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  valid_ref_frame_size
  setup_frame_size_with_refs
  read_uncompressed_header
  
Recommended Security Severity: Low


Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95Mizu_cmfQ2owbfhj20VA5f7s9JxDvN27rlI-8Qc-1nmUyP0aw_Ksra8gesE9Zy-wfl01t3oTqNq46wsUEpuwha4AR3P_iVkKNMtht9mTyFZ7C6v1hc3PZIrJ85fGq3EeUNQ2IUIbTawZ4jTBZ25uksdJm1zhCvtrL3HG2JrhTQHuRa9Q


Additional requirements: Requires Gestures

Filer: inferno

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Jrummell@, can you take a look. These two testcase look related, but are unreliable testcases. Wonder if stack, line number help in root cause.

Max, Kostya, Mike - looks like libfuzzer+msan is giving some unreproducible testcases. Is msan+libfuzzer supposed to be flaky ?

yaowu@chromium.org, does this look like https://bugs.chromium.org/p/chromium/issues/detail?id=612023 ?

Interesting, the testcase looks unreproducible with the given input, but when trying to reproduce whole fuzzing session it crashes in the same way:

https://paste.googleplex.com/5049757349183488

Looks like one or more of VP9_COMMON->frame_refs[i].buf [1] is not always updated for a new frame. Investigating.

[1] https://code.google.com/p/chromium/codesearch#chromium/src/third_party/libvpx/source/libvpx/vp9/common/vp9_blockd.h&l=143

regarding #3, yes, looks very similar.  We are doing a libvpx roll with fix: https://chromium-review.googlesource.com/#/c/345572/

The roll commit is here:
https://chromium.googlesource.com/chromium/src.git/+/7257d4cc4f0856ec0b4e2c44dedbdaef7dbf41a9

Answering #2: given that we now think this is an OOB, it explains why msan is flaky. Msan does not have redzones and thus when hitting OOB it may or may not hit uninitialized memory. Fun! 

I can't see  issue 612023 , but after looking at the fix I'm marking this issue as a duplicate.

It would be great if CF tried any crashing test case with other sanitizers and attached their reports (if any) to the same bug.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot