New issue
Advanced search Search tips

Issue 655917 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in webrtc::DtmfToneGenerator::Generate

Project Member Reported by ClusterFuzz, Oct 14 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5189061340037120

Fuzzer: libfuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  webrtc::DtmfToneGenerator::Generate
  webrtc::NetEqImpl::DoDtmf
  webrtc::NetEqImpl::GetAudioInternal
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=423119:423133

Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv947dbfW91M64bAVrxGf70G86wsirtTmaFwnmFmGvDEZHkgbuCYuNF9uv6LqmFKkLgSGmacXQ2DOZRqDXO6UyjJk58JkzK9cJWNjJ56URJrhbCeJuweJeonIHexo12U5mtQKp-mNQkVTqmw1VvLhlB-T9oa3iw?testcase_id=5189061340037120

Issue manually filed by: nyerramilli

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: nyerramilli@chromium.org
Components: Tools>Test>FindIt>CorrectResult Blink>WebRTC
Labels: Findit-for-crash M-56 Te-Logged
Owner: kwiberg@chromium.org
Status: Assigned (was: Untriaged)
Findit Results:
-------------------
Suspected CLs	The result is a list of CLs that change the crashed files.

Author: kwiberg
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/b9a5d2a304565d81be4a562deabd8397cc9a818a
Time: Tue Oct 04 16:33:27 2016
File neteq_impl.cc is changed in this cl (and is part of stack frame #1, "webrtc::NetEqImpl::DoDtmf"; frame #2, "webrtc::NetEqImpl::GetAudioInternal"; frame #3, "webrtc::NetEqImpl::GetAudio")
Minimum distance from crash line to modified line: 72. (file: neteq_impl.cc, crashed on: 210, modified: 282).

Suspected Project: chromium-webrtc
Suspected Component: Blink>Webrtc

based on findit results, kwiberg@, could you please check the issue and help..

Project Member

Comment 2 by bugdroid1@chromium.org, Oct 24 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/b60d1962d8e325e5a3f41fd6130269400e672f0c

commit b60d1962d8e325e5a3f41fd6130269400e672f0c
Author: kwiberg <kwiberg@webrtc.org>
Date: Mon Oct 24 11:18:46 2016

Eliminate left shift of negative value by using multiplication instead

BUG= chromium:655917 

Review-Url: https://codereview.webrtc.org/2430393003
Cr-Commit-Position: refs/heads/master@{#14741}

[modify] https://crrev.com/b60d1962d8e325e5a3f41fd6130269400e672f0c/webrtc/modules/audio_coding/neteq/dtmf_tone_generator.cc

Status: Fixed (was: Assigned)
The CL in comment #2 should fix the issue.
Project Member

Comment 4 by ClusterFuzz, Oct 26 2016

ClusterFuzz has detected this issue as fixed in range 427295:427323.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5189061340037120

Fuzzer: libfuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  webrtc::DtmfToneGenerator::Generate
  webrtc::NetEqImpl::DoDtmf
  webrtc::NetEqImpl::GetAudioInternal
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=423119:423133
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=427295:427323

Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv947dbfW91M64bAVrxGf70G86wsirtTmaFwnmFmGvDEZHkgbuCYuNF9uv6LqmFKkLgSGmacXQ2DOZRqDXO6UyjJk58JkzK9cJWNjJ56URJrhbCeJuweJeonIHexo12U5mtQKp-mNQkVTqmw1VvLhlB-T9oa3iw?testcase_id=5189061340037120

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment