New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 657439 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
OOO Dec 22 - Jan 8
Closed: Mar 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

bytes_to_fill == static_cast<size_t>(params_.GetBytesPerBuffer()) in pulse_outpu

Project Member Reported by ClusterFuzz, Oct 19 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4742838359425024

Fuzzer: inferno_flicker
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  bytes_to_fill == static_cast<size_t>(params_.GetBytesPerBuffer()) in pulse_outpu
  media::PulseAudioOutputStream::FulfillWriteRequest
  pa_pdispatch_run
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=370165:370699

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96SvwSwKcgmcTpR6BwrjzBulh9pWxP54YwXQi8xSC7QAT13FDnX5ovW0wR11L3ObNE7Xi4q2CxKcBuTAaeuBrBmjle3z25QR3lV2Y5kMvJ47s30IG6yfkEEwM1NzDmZE46tWIWKaFOODhATFQMByJMEihPZnAEs3gH-hGBKmmmDhrfujDk?testcase_id=4742838359425024


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: jameswest@chromium.org grunell@chromium.org
Owner: olka@chromium.org
Status: Assigned (was: Untriaged)
olka @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !
Project Member

Comment 2 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 3 by olka@chromium.org, Dec 1 2016

Cc: dalecur...@chromium.org
The check fails comparing bytes-per-buffer value returned by pa_stream_begin_write() vs AudioParameters one pased into it. (65472 vs. 196608)

Documentation for pa_stream_begin_write() says that
"on return *nbytes can be smaller or have the same value as you passed in". (http://pulseaudio.sourcearchive.com/documentation/1.0/stream_8h_a6cf50cfc4ea8897391941184d74d7dfa.html)

However, the failing check assumes that the returned size will be the same as the passed one. The check was added  3,5 yeasr ago (https://chromiumcodereview.appspot.com/12328097) because the case had never been observed when the values are different.

Comment 5 by olka@chromium.org, Dec 1 2016

196608 bytes per buffer can be reached if maximum output buffer size of 8192 is used ( https://cs.chromium.org/chromium/src/media/audio/pulse/audio_manager_pulse.cc?q=pulse+%228192%22&sq=package:chromium&l=41&dr=C) for 12 channels at 16 bps.

In usual cases we have 20 ms buffers at 192kHz at max, so for 8 channels it will be 192 * 20 * 8 * 2 = 61440. That's probably why we never hit the check.
Project Member

Comment 6 by ClusterFuzz, Mar 16 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 4742838359425024 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment