Integer-overflow in media::H264Parser::ParseSPS |
|||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6217321989537792 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=398351:399229 Minimized Testcase (0.09 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94nRgUtxz59sNHahXuN5uUniNHSfudPBj44Sp_-hF5rVZZ3uAfXF9QDBeaYRtO6uAdxwj1lLv-AfiRq_GtpKTbnuvv1Uivus2q6grWkcOc7N4IOG13dEiYog2YeweSejeDQIxIJlMU3_rneGLQ9h33IZTK-uQ?testcase_id=6217321989537792 Issue manually filed by: mummareddy See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 25 2016
ClusterFuzz has detected this issue as fixed in range 413961:414068. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6217321989537792 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=398351:399229 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=413961:414068 Minimized Testcase (0.09 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94nRgUtxz59sNHahXuN5uUniNHSfudPBj44Sp_-hF5rVZZ3uAfXF9QDBeaYRtO6uAdxwj1lLv-AfiRq_GtpKTbnuvv1Uivus2q6grWkcOc7N4IOG13dEiYog2YeweSejeDQIxIJlMU3_rneGLQ9h33IZTK-uQ?testcase_id=6217321989537792 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 25 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Aug 25 2016
Re-Opening the issue as Clusterfuzz has detected the crash again, Clusterfuzz update in the next comment.Thank you
,
Aug 25 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6661887897108480 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414214:414310 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv948z54bG-5N4MFhsKkuj39EiX_fqNzMToWynoRhf7s63EAJn-hJVQaaSijQRvikp_GNNH7yHKVBChLXaRrxEFQFlyCYe-mcFA57SG64exfrFEL_hn4cAeY7vjMTWG1D2Iw7-ZmExlQkgskBZIdjO9A85Y8r4Q?testcase_id=6661887897108480 Issue manually filed by: mmohammad See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 26 2016
ClusterFuzz has detected this issue as fixed in range 414399:414444. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6661887897108480 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414214:414310 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414399:414444 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv948z54bG-5N4MFhsKkuj39EiX_fqNzMToWynoRhf7s63EAJn-hJVQaaSijQRvikp_GNNH7yHKVBChLXaRrxEFQFlyCYe-mcFA57SG64exfrFEL_hn4cAeY7vjMTWG1D2Iw7-ZmExlQkgskBZIdjO9A85Y8r4Q?testcase_id=6661887897108480 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 26 2016
As per per update#6, closing the issue. thank you.
,
Aug 26 2016
,
Aug 26 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6133713085923328 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414663:414681 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97_Gis53El7EOk0MEtYfPGI9AjQ8dOFQ2l0-Qwx_mnafDYJKssRphlTNjKjJqunw0nCr8sTDK3O1H2Z2BYxTmjpuT9lxr5CWPP7MrZm4xGBb5a5EDDnfjyWlF5VE5rMhb_7k2Amw3T750DrbBOph19567L5ig?testcase_id=6133713085923328 Issue manually filed by: mmoroz See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 26 2016
,
Aug 27 2016
ClusterFuzz has detected this issue as fixed in range 414779:414830. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6133713085923328 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414663:414681 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414779:414830 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97_Gis53El7EOk0MEtYfPGI9AjQ8dOFQ2l0-Qwx_mnafDYJKssRphlTNjKjJqunw0nCr8sTDK3O1H2Z2BYxTmjpuT9lxr5CWPP7MrZm4xGBb5a5EDDnfjyWlF5VE5rMhb_7k2Amw3T750DrbBOph19567L5ig?testcase_id=6133713085923328 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 30 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5105818427195392 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414977:414989 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96Ed2S14gWokU-LCBna_xIsk-sq1PsMbpgH1CAisLqjaJk617vS5ieslrRB-Mz85nglHwcIVcAS1w7Gavk54lVbcL1Ikzxptk2gvaP-z-SLSrld37d_tB53UcNT1EWTPvZV3-6T5dnY2A1Pq305AvAYYKkscg?testcase_id=5105818427195392 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 30 2016
Author: dalecurtis Project: chromium Changelist: https://chromium.googlesource.com/chromium/src/+/39a7f93d67f79d6afadb0f74254eef19b5ff9318 Time: Tue Jul 19 18:34:59 2016 The CL last changed line 18 of file es_parser_h264_fuzzer.cc, which is stack frame 2.
,
Aug 30 2016
ClusterFuzz has detected this issue as fixed in range 415035:415043. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5105818427195392 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414977:414989 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=415035:415043 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96Ed2S14gWokU-LCBna_xIsk-sq1PsMbpgH1CAisLqjaJk617vS5ieslrRB-Mz85nglHwcIVcAS1w7Gavk54lVbcL1Ikzxptk2gvaP-z-SLSrld37d_tB53UcNT1EWTPvZV3-6T5dnY2A1Pq305AvAYYKkscg?testcase_id=5105818427195392 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 1 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4826492846735360 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=415587:415619 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv956lmxX0LYhVB9mvyKTPcyfn1BHW2in38NpAcUG4s4EKXO3QSCLjzqeRKlOdl7r-9r3bOlXAYmTyX8x7fsgtcSGDosYWWG09R36T-uDRWI49zWAezEarmvNRcSfbM7NlFUy593UP5qE7MQNdXtiAvkxaxEBQw?testcase_id=4826492846735360 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 1 2016
,
Sep 2 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/419ed06d526505e3d0b938b1a72cc2e8092a96c3 commit 419ed06d526505e3d0b938b1a72cc2e8092a96c3 Author: sandersd <sandersd@chromium.org> Date: Fri Sep 02 21:00:02 2016 H264Parser: Check bounds for |expected_delta_per_pic_order_cnt_cycle| BUG= 639142 Review-Url: https://codereview.chromium.org/2300253002 Cr-Commit-Position: refs/heads/master@{#416338} [modify] https://crrev.com/419ed06d526505e3d0b938b1a72cc2e8092a96c3/media/filters/h264_parser.cc
,
Sep 3 2016
ClusterFuzz has detected this issue as fixed in range 416303:416379. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4826492846735360 Fuzzer: libfuzzer_es_parser_h264_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: media::H264Parser::ParseSPS media::mp2t::EsParserH264::ParseFromEsQueue _start Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=415587:415619 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=416303:416379 Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv956lmxX0LYhVB9mvyKTPcyfn1BHW2in38NpAcUG4s4EKXO3QSCLjzqeRKlOdl7r-9r3bOlXAYmTyX8x7fsgtcSGDosYWWG09R36T-uDRWI49zWAezEarmvNRcSfbM7NlFUy593UP5qE7MQNdXtiAvkxaxEBQw?testcase_id=4826492846735360 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 6 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 18 2017
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label. |
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by mummare...@chromium.org
, Aug 18 2016Owner: aizatsky@chromium.org
Status: Assigned (was: Untriaged)