kwiberg: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5286601148334080

Fuzzer: libfuzzer_audio_decoder_ilbc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  WebRtcSpl_CountLeadingZeros32
  WebRtcSpl_GetSizeInBits
  WebRtcIlbcfix_EnhancerInterface
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=372875:372885

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96LHHQUvc976QhJ817CTxfGf6I6niR8NbxvOEY7lLO76XQCJReescGk9VsScj7OQ6qByyfNaxpr1Wl57XzCqVZKP07IEaPCwih0x461ovZ7QTvH-ZBQV2gPFRx66aOQODpM86m87WCGwYOFjPr3jzG-45lDaw?testcase_id=5286601148334080

Filer: tanin

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Lowering the priority on this, since iLBC is not included in the Chromium build (only in the fuzzer binary).

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5000365674332160

Fuzzer: libfuzzer_audio_decoder_ilbc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  WebRtcSpl_CountLeadingZeros32
  WebRtcSpl_GetSizeInBits
  WebRtcIlbcfix_EnhancerInterface
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397381:397497

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96GBAba7gmRpCRgYfRpY_EW5nRjhQtXabLID_zdwRsrbVj8nE6Q-O9iC43SRQ4JxzwOWkSQpUAUy-djPLDCwnDzoCJ0rGCKUvoGufcJ-1JJr8g5mHJLDtVUuydvjI1a_6OG9QOUX8iLVMNUTud4bkWxvCMn1w?testcase_id=5000365674332160

Filer: tanin

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

I've found the bug, or at least tracked it closer to its lair. In WebRtcIlbcfix_GetCbVec, near the end (https://cs.chromium.org/chromium/src/third_party/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c?rcl=1471447605&l=96), there's first a call to WebRtcSpl_FilterMAFastQ12 which writes to the first cbveclen + 5 elements of the previously uninitialized stack array tempbuff2, followed by a call to WebRtcIlbcfix_CreateAugmentedVec which reads all SUBL + 5 elements of tempbuff2.

In our unit tests, cbveclen is always equal to SUBL when we execute this code, but in this fuzzer run, cbveclen is 18 and SUBL is 40. So we read uninitialized memory from tempbuff2, and crash a while later when the outcome of a branch depends on the contents of that memory.

I haven't tracked down why cbveclen == SUBL in the unit tests but not in this fuzzer run, so I don't yet know what the actual problem is.

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/2e486462e0f79a1ba436fa23495a9ac992fa4d53

commit 2e486462e0f79a1ba436fa23495a9ac992fa4d53
Author: kwiberg <kwiberg@webrtc.org>
Date: Tue Aug 23 12:54:25 2016

RTC_CHECK and RTC_DCHECK macros for C

So that we don't have to use assert(). Includes one sample call site.

NOTRY=true
BUG= chromium:617124 

Review-Url: https://codereview.webrtc.org/2262173002
Cr-Commit-Position: refs/heads/master@{#13862}

[modify] https://crrev.com/2e486462e0f79a1ba436fa23495a9ac992fa4d53/webrtc/base/checks.cc
[modify] https://crrev.com/2e486462e0f79a1ba436fa23495a9ac992fa4d53/webrtc/base/checks.h
[modify] https://crrev.com/2e486462e0f79a1ba436fa23495a9ac992fa4d53/webrtc/modules/audio_coding/codecs/opus/opus_interface.c

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/619a211562eeb43fdbed4085465a0ec36a08f221

commit 619a211562eeb43fdbed4085465a0ec36a08f221
Author: kwiberg <kwiberg@webrtc.org>
Date: Wed Aug 24 09:46:44 2016

iLBC: Handle a case of bad input data

We detect an unreasonable state (caused by a bad encoded stream)
before it can lead to problems, and handle it by resetting the
decoder.

NOPRESUBMIT=true
BUG= chromium:617124 

Review-Url: https://codereview.webrtc.org/2255203002
Cr-Commit-Position: refs/heads/master@{#13888}

[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/BUILD.gn
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/BUILD.gn
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/cb_construct.c
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/cb_construct.h
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/decode.c
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/decode.h
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/decode_residual.c
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/decode_residual.h
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/encode.c
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.c
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/get_cd_vec.h
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/ilbc.c
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/ilbc.gypi
[add] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/ilbc_unittest.cc
[add] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/audio_coding/codecs/ilbc/test/empty.cc
[modify] https://crrev.com/619a211562eeb43fdbed4085465a0ec36a08f221/webrtc/modules/modules.gyp

The CL referenced in comment 11 should fix the bug.

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/c31446f49e331ecb9e85190289e57ba21ae195cd

commit c31446f49e331ecb9e85190289e57ba21ae195cd
Author: kwiberg <kwiberg@webrtc.org>
Date: Tue Aug 30 12:36:56 2016

iLBC: Some const annotations

NOTRY=true
BUG= chromium:617124 

Review-Url: https://codereview.webrtc.org/2293843002
Cr-Commit-Position: refs/heads/master@{#13972}

[modify] https://crrev.com/c31446f49e331ecb9e85190289e57ba21ae195cd/webrtc/modules/audio_coding/codecs/ilbc/cb_construct.c
[modify] https://crrev.com/c31446f49e331ecb9e85190289e57ba21ae195cd/webrtc/modules/audio_coding/codecs/ilbc/cb_construct.h
[modify] https://crrev.com/c31446f49e331ecb9e85190289e57ba21ae195cd/webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.c
[modify] https://crrev.com/c31446f49e331ecb9e85190289e57ba21ae195cd/webrtc/modules/audio_coding/codecs/ilbc/create_augmented_vec.h

ClusterFuzz has detected this issue as fixed in range 415222:415266.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6503936764936192

Fuzzer: libfuzzer_audio_decoder_ilbc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  WebRtcSpl_CountLeadingZeros32
  WebRtcSpl_GetSizeInBits
  WebRtcIlbcfix_EnhancerInterface
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397381:397497
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=415222:415266

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96otWjD-I6z6ux-djVpeW6G4X-ejDAbiRjC2hiGX9JGY26n7_m-i80zMc3ZcGzclmCd1n2TXoEoX3IyuwN4EgkG2oJT1Q_1mWOtiABHfwuqQjZtM10N96xGvG5acMstNZ9pd4nUv1q8n5mxhN0Y8y87iCb2Ag?testcase_id=6503936764936192

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 415222:415266.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5286601148334080

Fuzzer: libfuzzer_audio_decoder_ilbc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  WebRtcSpl_CountLeadingZeros32
  WebRtcSpl_GetSizeInBits
  WebRtcIlbcfix_EnhancerInterface
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397381:397497
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=415222:415266

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96LHHQUvc976QhJ817CTxfGf6I6niR8NbxvOEY7lLO76XQCJReescGk9VsScj7OQ6qByyfNaxpr1Wl57XzCqVZKP07IEaPCwih0x461ovZ7QTvH-ZBQV2gPFRx66aOQODpM86m87WCGwYOFjPr3jzG-45lDaw?testcase_id=5286601148334080

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 415222:415266.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5000365674332160

Fuzzer: libfuzzer_audio_decoder_ilbc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  WebRtcSpl_CountLeadingZeros32
  WebRtcSpl_GetSizeInBits
  WebRtcIlbcfix_EnhancerInterface
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397381:397497
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=415222:415266

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96GBAba7gmRpCRgYfRpY_EW5nRjhQtXabLID_zdwRsrbVj8nE6Q-O9iC43SRQ4JxzwOWkSQpUAUy-djPLDCwnDzoCJ0rGCKUvoGufcJ-1JJr8g5mHJLDtVUuydvjI1a_6OG9QOUX8iLVMNUTud4bkWxvCMn1w?testcase_id=5000365674332160

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/affcac4d22a23e734bac5b3685b2a7670aab0005

commit affcac4d22a23e734bac5b3685b2a7670aab0005
Author: kwiberg <kwiberg@webrtc.org>
Date: Thu Sep 01 19:47:17 2016

WebRtcIlbcfix_EnhancerInterface: Let input array be const

NOTRY=true
BUG= chromium:617124 

Review-Url: https://codereview.webrtc.org/2297873003
Cr-Commit-Position: refs/heads/master@{#14029}

[modify] https://crrev.com/affcac4d22a23e734bac5b3685b2a7670aab0005/webrtc/modules/audio_coding/codecs/ilbc/enhancer_interface.c
[modify] https://crrev.com/affcac4d22a23e734bac5b3685b2a7670aab0005/webrtc/modules/audio_coding/codecs/ilbc/enhancer_interface.h

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/2b11fd2e4bcbd5240ee04110323309f1fa2d3251

commit 2b11fd2e4bcbd5240ee04110323309f1fa2d3251
Author: kwiberg <kwiberg@webrtc.org>
Date: Fri Sep 09 10:35:24 2016

rtc::Optional: Tell sanitizers that unset values aren't OK to access

This is a sample use of the other three sanitizer functions introduced
in https://codereview.webrtc.org/2293893002/.

BUG= chromium:617124 

Review-Url: https://codereview.webrtc.org/2289383002
Cr-Commit-Position: refs/heads/master@{#14157}

[modify] https://crrev.com/2b11fd2e4bcbd5240ee04110323309f1fa2d3251/webrtc/base/BUILD.gn
[modify] https://crrev.com/2b11fd2e4bcbd5240ee04110323309f1fa2d3251/webrtc/base/base.gyp
[add] https://crrev.com/2b11fd2e4bcbd5240ee04110323309f1fa2d3251/webrtc/base/optional.cc
[modify] https://crrev.com/2b11fd2e4bcbd5240ee04110323309f1fa2d3251/webrtc/base/optional.h

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot