phoglund@, would you mind taking a look as a person who had reviewed the fuzzer previously and enabled it then?

deadbeef@ feel free to reassign if I'm assigning too many bugs to you. I think libfuzzer_sdp_parser_fuzzer is a new fuzzer binary, ping me if you have any questions on how to repro, I'll gladly help you get set up.

Yep, definitely seems to be a new fuzzer (and a quite effective one). Who knew there could be so many bugs in code that's entirely built around static_cast'ing pointers? :)

Yeah, I enabled those a couple weeks ago. I'm glad to hear they work ;)

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/7e146cb97e27644691a8017fe252dfc184c03808

commit 7e146cb97e27644691a8017fe252dfc184c03808
Author: deadbeef <deadbeef@webrtc.org>
Date: Wed Sep 28 17:04:34 2016

Fixing heap read overflow when "sctp-port" is in a video description.

This added an SCTP codec, which is later re-interpreted as a video
codec. We shouldn't be adding codecs that don't match the type of the
media description.

BUG= chromium:648062 

Review-Url: https://codereview.webrtc.org/2354723002
Cr-Commit-Position: refs/heads/master@{#14421}

[modify] https://crrev.com/7e146cb97e27644691a8017fe252dfc184c03808/webrtc/api/webrtcsdp.cc
[modify] https://crrev.com/7e146cb97e27644691a8017fe252dfc184c03808/webrtc/api/webrtcsdp_unittest.cc

This will be fixed by the above CL on the next WebRTC roll.

 Issue 648372  has been merged into this issue.

 Issue 648198  has been merged into this issue.

 Issue 647915  has been merged into this issue.

 Issue 647904  has been merged into this issue.

 Issue 647905  has been merged into this issue.

 Issue 647948  has been merged into this issue.

 Issue 647916  has been merged into this issue.

FYI: For anyone triaging a fuzzer bug and wondering "is it a duplicate of this?", the way to tell is if "a=sctp-port" appears under "m=audio" or "m=video", rather than under "m=application".

 Issue 652002  has been merged into this issue.

Comment 19 is very helpful, thanks!

A friendly reminder that M55 Beta launch is coming soon! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix ASAP. Thank you.

WebRTC was rolled into Chromium this morning, which included the above fix.

ClusterFuzz has detected this issue as fixed in range 422769:422805.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4523351634870272

Fuzzer: libfuzzer_sdp_parser_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e90000618c
Crash State:
  default_terminate_handler
  std::__terminate
  failed_throw
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=419157:419245
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=422769:422805

Minimized Testcase (0.18 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96oaftPYPtr09SznHuIrXp3qLFbn_6n3ZJk232c8qc90Qul9KjFhmlmq4PPZ7GN6JRcxi-e-VrE-bHeLGg5uKL7_cSgfTrxaMu2YIYxPRscu2Xo73ReXbvutpTxcjh1oBgPBEeMUQytzhFx-Gd1RnJovP6ybA?testcase_id=4523351634870272
v=0
o=moa...THIS_IS_SDPARTA-46.0.1 5115930144083302970 0 IN IPfingerprint4 0.0.0.0
s=-
t=0 0
m=videoapplication 9 DTLS/SCTP v
a=sctp-portrtcp
fb:126 nack
m=application 9 DTLS/SCTP 5000


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 648842  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz testcase 6212187469381632 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.