Integer-overflow in media::MovingAverage::AddSample |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5405795896524800 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::MovingAverage::AddSample media::DecoderStream< media::DecoderStream< Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027 Minimized Testcase (129.53 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96g88H1FzIdX6D-KDZwxPEbhSfqGmX7pjAmWDxYMTW_MLMrYyjv3-BCAcMWuTxU_PKPYrgmxwBxPGUJupEC9Vuq7XVDa4iP6aotcRZzuMtGOiMu10ST-hD_Xp0QMSzUw6EiTRm_eRhO6gXBGqLJkYFGSCxZIHK5bRWxbVN_AsM1l5YOD3M?testcase_id=5405795896524800 Additional requirements: Requires HTTP Filer: mummareddy See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 4 2016
Rerouting to the author. Can we just factor x*x - y*y to (x + y) * (x - y) to avoid the overflow?
,
Aug 4 2016
I do not think the way in #2 could work. It is intrinsic overflow. It means that the square sum of the durations overflows 2^64, which means the total duration is at least 4000s. dalecurtis@, do you think it is normal? I think a solution has to be lowering deviation calculation precision to millisecond level.
,
Aug 4 2016
Doesn't matter if it's normal right? This can be triggered by user generated data, so it's something we should fix. That said, I don't know of any practical implications other than video rendering being bad; this information is only used for choosing frames.
,
Aug 5 2016
Moving this nonessential bug to the next milestone. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 9 2016
Issue 636039 has been merged into this issue.
,
Sep 19 2016
As not breaking normal workflow.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 22 2016
ClusterFuzz testcase 5405795896524800 is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jul 14 2017
ClusterFuzz testcase 6743100435464192 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by mummare...@chromium.org
, Aug 3 2016Owner: tzik@chromium.org
Status: Assigned (was: Untriaged)