New issue
Advanced search Search tips

Issue 653699 link

Starred by 1 user
Status: Duplicate
Merged: issue 787753
Owner:
holmer@chromium.org
Closed: Nov 2017
Cc:
pbos@chromium.org
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in webrtc::FuzzOneInput

Project Member Reported by ClusterFuzz, Oct 6 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6171508735213568

Fuzzer: libfuzzer_congestion_controller_feedback_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  webrtc::FuzzOneInput
  _start
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=407738:407796

Minimized Testcase (0.03 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97Q3EopWhRRqEw1Vg0K6akk5KLRcPTW7kRMwVFgETQXez2K-tEbf5wDZs7igfCrC49wdX26v7AHssasXKs4gugi4TqWSzVIesjXHZyIqmjdcixV7QoJQqqo8nsGPJrBp8YxmkwyCxIyylTTfbyQpZXhCkkqBw?testcase_id=6171508735213568

Issue manually filed by: mmohammad

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Comment 1 by mmohammad@chromium.org, Oct 6 2016

Owner: kcc@chromium.org
Status: Assigned (was: Untriaged)
kcc@ @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

Comment 2 by kcc@chromium.org, Oct 6 2016

Owner: pbos@chromium.org

Comment 3 by kcc@chromium.org, Oct 6 2016 

Looks like a bug in the fuzz target in webrtc

Comment 4 by pbos@chromium.org, Oct 6 2016

Cc: pbos@chromium.org
Owner: holmer@chromium.org
holmer@, arrival_time_ms is not bounded so arrival_time_ms += ByteReader<uint8_t>::ReadBigEndian(&data[i]); overflows during fuzzer-data parsing (not inside the congestion controller).
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 6 by mmoroz@chromium.org, Oct 24 2017 

For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.

(bulk edit)

Comment 7 by holmer@chromium.org, Nov 27 2017

Mergedinto: 787753
Status: Duplicate (was: Assigned)
►

Sign in to add a comment