New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675193 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , All
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in webrtc::TimeStretch::SpeechDetection

Project Member Reported by ClusterFuzz, Dec 16 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6335163677278208

Fuzzer: libfuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  webrtc::TimeStretch::SpeechDetection
  webrtc::TimeStretch::Process
  webrtc::NetEqImpl::DoPreemptiveExpand
  

Minimized Testcase (5.48 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94GC6lDz-PUvDdULuq28rEse084OoRPfk1sgBvjqu1jI3bsLBNslgRu2REKOktu0Pk28Hucmnjd9xXgHpDRdTo-WLfYqmhc8xif8ouW4gXHOaF0syB0xMXa5Aef9oJaxXUzGtuNY-Kxdsi_WH9_K4iNnKtiNw?testcase_id=6335163677278208

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: tlegrand@chromium.org
Components: Blink>WebRTC>Audio
Labels: OS-All
Owner: hlundin@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 2 by bugdroid1@chromium.org, Feb 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/b1629cf5d604363dd902b8ec2454ef279353c81f

commit b1629cf5d604363dd902b8ec2454ef279353c81f
Author: Henrik Lundin <henrik.lundin@webrtc.org>
Date: Tue Feb 28 13:58:30 2017

Avoid overflow in NetEq's TimeStretch::SpeechDetection

BUG= chromium:675193 
R=kwiberg@webrtc.org

Review-Url: https://codereview.webrtc.org/2718943004 .
Cr-Commit-Position: refs/heads/master@{#16902}

[modify] https://crrev.com/b1629cf5d604363dd902b8ec2454ef279353c81f/webrtc/modules/audio_coding/neteq/time_stretch.cc

Project Member

Comment 3 by ClusterFuzz, Mar 2 2017

ClusterFuzz has detected this issue as fixed in range 453872:453879.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6335163677278208

Fuzzer: libfuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  webrtc::TimeStretch::SpeechDetection
  webrtc::TimeStretch::Process
  webrtc::NetEqImpl::DoPreemptiveExpand
  
Sanitizer: undefined (UBSAN)

Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=453872:453879

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv949VybiRrZWqe2KBuvtBb4KFYgnOxc7A0WT3y6iDS8ePoUDZ99w1tAP-GTxWCjp_IPwKXgLfFHJIAGGGZNd0rrbpBFQXx8hQbLmZw0PjksW3nRGXdOH_DH6UO17Y4qNHX_egEgABjxZXNsuBhqnCkHzIC-7D0IJGBYLgUdT2QjvxoO7_RbCc01TpFp8TMpbCdPzTDcTMOZDDk4U5Jjptlg2whTNrr3dzbqT1_x6NdBJFRwkpRXH8wlWNpxc9MiFCexhj-cXqoMdMzFzF-wTpReMhw5M1bmCc0phPXX8Qwqa0AsNxOtAB5puqEIevALU1H5VDl-q5Eg0juDKOfoFtLAqo4faJUPEN2Wt_uY9Eq2WSK6168o?testcase_id=6335163677278208


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Mar 2 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6335163677278208 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: M-58

Sign in to add a comment