New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 657437 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

video_configs_.find(bytestream_track_id) == video_configs_.end() in media_tracks

Project Member Reported by ClusterFuzz, Oct 19 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4722304938672128

Fuzzer: ochang_media_mutator
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  video_configs_.find(bytestream_track_id) == video_configs_.end() in media_tracks
  media::MediaTracks::AddVideoTrack
  media::FFmpegDemuxer::OnFindStreamInfoDone
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=415934:416233

Minimized Testcase (42.06 Kb): https://cluster-fuzz.appspot.com/download/AMIfv950zOCDZjgimAWsXjWqo7FXgVi6dKPtiVIAEp9DGs6M2BPUxl12QdSjvqTy9Njwy_TAPwMjZ8D2c1hx12KzzI51LByoKlwxliuDjHECTTA1X04RLh93KyUWscsmm6OgjAy1XJElIbMo5QfZujPKvrtfnfa6u1U9NayodpWc2DOPY6D3gU0?testcase_id=4722304938672128

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by ajha@chromium.org, Oct 20 2016

Cc: ajha@chromium.org
Components: Internals>Media>Video
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Unable to find the exact suspect.

Dale@: Could you please help in investigating this further or routing to appropriate owner.

Appreciate your help!
Cc: dalecur...@chromium.org
Owner: servolk@chromium.org
Status: Started (was: Assigned)
Hmm, looks like there are duplicate stream ids in that .mp4 file. Fix coming soon.
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 21 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/41ecabf2dc6286a0cc529cfe50eabe44c3a56c54

commit 41ecabf2dc6286a0cc529cfe50eabe44c3a56c54
Author: servolk <servolk@chromium.org>
Date: Fri Oct 21 18:05:35 2016

Handle duplicate media track ids in FFmpegDemuxer

Previously we would just crash due to CHECK when we detected media
streams with duplicate bytestream ids. This CL adds explicit checks
for duplicate stream ids in FFmpegDemuxer and skips those streams.

BUG= 657437 

Review-Url: https://chromiumcodereview.appspot.com/2434383003
Cr-Commit-Position: refs/heads/master@{#426840}

[modify] https://crrev.com/41ecabf2dc6286a0cc529cfe50eabe44c3a56c54/media/filters/ffmpeg_demuxer.cc
[modify] https://crrev.com/41ecabf2dc6286a0cc529cfe50eabe44c3a56c54/media/filters/ffmpeg_demuxer_unittest.cc
[add] https://crrev.com/41ecabf2dc6286a0cc529cfe50eabe44c3a56c54/media/test/data/crbug657437.mp4

Status: Fixed (was: Started)
Project Member

Comment 6 by ClusterFuzz, Oct 22 2016

ClusterFuzz has detected this issue as fixed in range 426818:426932.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4722304938672128

Fuzzer: ochang_media_mutator
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  video_configs_.find(bytestream_track_id) == video_configs_.end() in media_tracks
  media::MediaTracks::AddVideoTrack
  media::FFmpegDemuxer::OnFindStreamInfoDone
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=415934:416233
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=426818:426932

Minimized Testcase (42.06 Kb): https://cluster-fuzz.appspot.com/download/AMIfv950zOCDZjgimAWsXjWqo7FXgVi6dKPtiVIAEp9DGs6M2BPUxl12QdSjvqTy9Njwy_TAPwMjZ8D2c1hx12KzzI51LByoKlwxliuDjHECTTA1X04RLh93KyUWscsmm6OgjAy1XJElIbMo5QfZujPKvrtfnfa6u1U9NayodpWc2DOPY6D3gU0?testcase_id=4722304938672128

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment