New issue
Advanced search Search tips

Issue 659184 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in base::debug::DebugBreak

Project Member Reported by ClusterFuzz, Oct 25 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5265504882393088

Fuzzer: libfuzzer_mp4_box_reader_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900001d3d
Crash State:
  base::debug::DebugBreak
  media::mp4::BoxReader::ScanChildren
  _start
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=415616:415651

Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97ihNAtJL5iiQFN_DY5a5_JMuFZvCLeqEuNxr4Jurkt5DJYy70UHxKbwjBU7XKkfRtzfXAMoq9bmmDuZC3ggjc4CMP24f8T_YzH5XdaqOXRTdVnKYrowJm9qHv5LAcV-mj4htDcU655Tn0nKIUhwRjGEXZ6TQ?testcase_id=5265504882393088

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Components: Blink>Media
Labels: Test-Predator-Wrong-CLs
Owner: thakis@chromium.org
Status: Assigned (was: Untriaged)
Suspected CLs	
===========================
Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: mostynb@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/901a5e3835718e8872f38af32d65fce7ea3fcbeb
Time: Mon Apr 08 23:26:25 2013
The CL last changed line 221 of file debugger_posix.cc, which is stack frame 2.

Author: brettw@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/58580359a452cb7c3b9580edc0843c3ab3d158df
Time: Tue Oct 26 04:07:50 2010
The CL last changed line 251 of file debugger_posix.cc, which is stack frame 3.

Author: rch@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/82d89abc03ea6fd6b9258f0e57be0290b33d7eb1
Time: Fri Feb 28 18:25:34 2014
The CL last changed line 748 of file logging.cc, which is stack frame 4.

Author: strobe@google.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/8398ac4a8713c7382bdb88ff52c61903690b72bc
Time: Fri Jun 15 17:00:02 2012
The CL last changed line 203 of file box_reader.cc, which is stack frame 5.

Author: krasin
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/f45d529d19dad67376809c81119f4f38c98f97ae
Time: Thu Oct 22 01:46:22 2015
The CL last changed line 41 of file mp4_box_reader_fuzzer.cc, which is stack frame 6.
===========================
Suspected Project: chromium

From code search on the file "box_reader.cc", Suspecting the below.
review url:https://codereview.chromium.org/1874413003
thakis@ : Could you please take a look into this if its related to your change.

Comment 2 by thakis@chromium.org, Oct 27 2016

Owner: ----
Status: Untriaged (was: Assigned)
That CL was a no-op.

I'm guessing the fuzzer that found this is new, and the bug is old. I'd either give this to whoever wrote the fuzzer, or an owner of box_reader.cc
Components: -Blink>Media Internals>Media
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Seems like a bad DCHECK. The style guide prohibits having DCHECKS for errors that are handled (like this one). Will send a short CL to remove.
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 27 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fc85f147a3fd757dd8caac1e59114122a529cc8a

commit fc85f147a3fd757dd8caac1e59114122a529cc8a
Author: dalecurtis <dalecurtis@chromium.org>
Date: Thu Oct 27 21:21:04 2016

Remove DCHECK since error is properly handled.

Prevents fuzzer test from completing and is frowned upon
by the Chromium style guide.

BUG= 659184 
TEST=none

Review-Url: https://codereview.chromium.org/2459463003
Cr-Commit-Position: refs/heads/master@{#428139}

[modify] https://crrev.com/fc85f147a3fd757dd8caac1e59114122a529cc8a/media/formats/mp4/box_reader.cc

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Oct 28 2016

ClusterFuzz has detected this issue as fixed in range 428102:428149.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5265504882393088

Fuzzer: libfuzzer_mp4_box_reader_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900001d3d
Crash State:
  base::debug::DebugBreak
  media::mp4::BoxReader::ScanChildren
  _start
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=415616:415651
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=428102:428149

Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97ihNAtJL5iiQFN_DY5a5_JMuFZvCLeqEuNxr4Jurkt5DJYy70UHxKbwjBU7XKkfRtzfXAMoq9bmmDuZC3ggjc4CMP24f8T_YzH5XdaqOXRTdVnKYrowJm9qHv5LAcV-mj4htDcU655Tn0nKIUhwRjGEXZ6TQ?testcase_id=5265504882393088

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment