New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 673079 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in base::debug::DebugBreak

Project Member Reported by ClusterFuzz, Dec 10 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4525746342330368

Fuzzer: libfuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900006544
Crash State:
  base::debug::DebugBreak
  media::FFmpegDemuxerStream::EnqueuePacket
  media::FFmpegDemuxer::OnReadFrameDone
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=413124:413277

Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97KXiBVlEO1Ed0YxlTNMQP2l57rftnH5gjLw-FFkdH3Y1ECdgr24kUrSUrfQ1JVYELyafyV0xJ7VTj4_PIz0xns5_tfhJvRjjoAJk5IE_9JSwJKJRo7VtFUUxxrIO6AO513uaFAaO6a1Vmim7zY7wXImz07Tg?testcase_id=4525746342330368

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any possible suspect.
Assigning to the concern owner from the CL
https://chromium.googlesource.com/chromium/src/+log/cbe3909f4f64e0f00e2eea6898395ece4672c913..b5587ce313138e508301052959470d80e3d1ea6f?pretty=fuller

Suspecting the Commit --
https://chromium.googlesource.com/chromium/src/+/ded04b8261c21b7a0a968c5f3cdd404c27e4131e

@dalecurtis -- Could you please look into the issue, kindly re-assign if this is not related to your change.
Thank You.
Cc: dalecur...@chromium.org
Owner: liber...@chromium.org
=> frank who is already fixing this for another issue.
verified that https://codereview.chromium.org/2563183002/ fixes this too.
Project Member

Comment 4 by bugdroid1@chromium.org, Dec 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/722dfe42527ed575678e5145ef3e58f03013030a

commit 722dfe42527ed575678e5145ef3e58f03013030a
Author: liberato <liberato@chromium.org>
Date: Tue Dec 20 23:49:57 2016

Fix up missing timestamps in FFmpegDemuxer.

Previously, we would DCHECK if FFmpeg provded no timestamp for a
buffer.  We now replace this with zero for the first packet, and
with an advance over the previous buffer for later ones.

The rationale is that bad media might cause this, and we previously
had a DCHECK to catch it.  This makes the behavior consistent even
in releaes builds.

BUG= 665305 ,  673079 
TEST=ffmpeg_regression_tests

Review-Url: https://codereview.chromium.org/2563183002
Cr-Commit-Position: refs/heads/master@{#439933}

[modify] https://crrev.com/722dfe42527ed575678e5145ef3e58f03013030a/media/ffmpeg/ffmpeg_regression_tests.cc
[modify] https://crrev.com/722dfe42527ed575678e5145ef3e58f03013030a/media/filters/ffmpeg_demuxer.cc
[modify] https://crrev.com/722dfe42527ed575678e5145ef3e58f03013030a/media/filters/ffmpeg_demuxer.h

Project Member

Comment 5 by ClusterFuzz, Dec 21 2016

ClusterFuzz has detected this issue as fixed in range 439885:439988.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4525746342330368

Fuzzer: libfuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900006544
Crash State:
  base::debug::DebugBreak
  media::FFmpegDemuxerStream::EnqueuePacket
  media::FFmpegDemuxer::OnReadFrameDone
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=413124:413277
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=439885:439988

Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97KXiBVlEO1Ed0YxlTNMQP2l57rftnH5gjLw-FFkdH3Y1ECdgr24kUrSUrfQ1JVYELyafyV0xJ7VTj4_PIz0xns5_tfhJvRjjoAJk5IE_9JSwJKJRo7VtFUUxxrIO6AO513uaFAaO6a1Vmim7zY7wXImz07Tg?testcase_id=4525746342330368

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Dec 21 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4525746342330368 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment