New issue
Advanced search Search tips

Issue 655091 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Crash in webrtc::RtpDepacketizerH264::ProcessStapAOrSingleNalu

Project Member Reported by ClusterFuzz, Oct 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5299395694428160

Fuzzer: libfuzzer_h264_depacketizer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900003c01
Crash State:
  webrtc::RtpDepacketizerH264::ProcessStapAOrSingleNalu
  webrtc::RtpDepacketizerH264::Parse
  webrtc::FuzzOneInput
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=424657:424680

Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95KCITYpfDaB97vJ7cdJh2N1fUvCBkq5cKFa9072ufc-Xd0vHfVa5brDE3kRD_nE8gvhndC_UTPpmmXtXXdVOoUvugtg5p7Q827bJt7e6ITKCXQw2HNhk7tyZJZBWlFhAUajXxYaexxNED2uhZuL1THpw_jTQ?testcase_id=5299395694428160

Issue manually filed by: nyerramilli

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: nyerramilli@chromium.org kwiberg@chromium.org
Components: Tools>Test>FindIt>WrongResult Blink>WebRTC
Labels: -Pri-1 -Type-Bug findit-wrong M-56 Te-Logged Pri-2 Type-Bug-Regression
Owner: henrika@chromium.org
Status: Assigned (was: Untriaged)
Providing Findit results for internal purpose:
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: stefan
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/553f5ae3597df8bfd8519643e0ec48d5bb081c55
Time: Thu Oct 06 12:04:52 2016
The CL last changed line 532 of file rtp_format_h264.cc, which is stack frame 1.

Author: sprang
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/cc31c7df49e0806f04dae190877483ba6642bd8d
Time: Thu Jun 02 09:43:32 2016
The CL last changed line 354 of file rtp_format_h264.cc, which is stack frame 2.

Author: Peter Boström
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/1626ef513e399d954b7c86c7d55a46d5720b7ff9
Time: Thu Dec 17 13:28:16 2015
The CL last changed line 16 of file h264_depacketizer_fuzzer.cc, which is stack frame 3.

Author: Peter Boström
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/fe3129a990da6b19e8366bf037c065e617e2c4a6
Time: Mon Nov 23 14:12:06 2015
The CL last changed line 39 of file webrtc_fuzzer_main.cc, which is stack frame 4.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/d6b2224ee4102bbe91c0a59dcb563de2d0ea75f2
Time: Thu Aug 25 01:25:03 2016
The CL last changed line 491 of file FuzzerLoop.cpp, which is stack frame 5.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/d33f707d488e6ac62cb5110f90115d9fe863c99e
Time: Sat Feb 13 17:56:51 2016
The CL last changed line 442 of file FuzzerLoop.cpp, which is stack frame 6.

Suspected Project: chromium-webrtc
Suspected Component: Blink>Webrtc

Requesting webrtc team to check the issue.
Cc: hbos@chromium.org sprang@chromium.org
Owner: holmer@chromium.org
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 12 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/12a39f4100f19c56052b134403c9969b0fdfd5b2

commit 12a39f4100f19c56052b134403c9969b0fdfd5b2
Author: stefan <stefan@webrtc.org>
Date: Wed Oct 12 22:30:14 2016

Don't crash on unexpected stap-a or fu-a.

BUG= chromium:655091 

Review-Url: https://codereview.webrtc.org/2406363004
Cr-Commit-Position: refs/heads/master@{#14618}

[modify] https://crrev.com/12a39f4100f19c56052b134403c9969b0fdfd5b2/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc

Comment 4 by holmer@chromium.org, Oct 12 2016

Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Oct 18 2016

ClusterFuzz has detected this issue as fixed in range 425639:425659.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5299395694428160

Fuzzer: libfuzzer_h264_depacketizer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900003c01
Crash State:
  webrtc::RtpDepacketizerH264::ProcessStapAOrSingleNalu
  webrtc::RtpDepacketizerH264::Parse
  webrtc::FuzzOneInput
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=424657:424680
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=425639:425659

Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95KCITYpfDaB97vJ7cdJh2N1fUvCBkq5cKFa9072ufc-Xd0vHfVa5brDE3kRD_nE8gvhndC_UTPpmmXtXXdVOoUvugtg5p7Q827bJt7e6ITKCXQw2HNhk7tyZJZBWlFhAUajXxYaexxNED2uhZuL1THpw_jTQ?testcase_id=5299395694428160

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment