Float-cast-overflow in blink::RealtimeAnalyser::setFftSize |
|||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6302487985520640 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::RealtimeAnalyser::setFftSize blink::AnalyserHandler::setFftSize fftSizeAttributeSetter Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085 Minimized Testcase (0.20 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96m894FLwdU0RYOHzDWN74TdCGkX3EQn66bUyCNAQCES4_QcZOWT2n0C0PudC8fi2SX_LG81TOoTPE2qwfjZ8sEjQ85tkvstrMhZSxrcHVCZnJ_tnhiO0QOtjGRbET98Z02vQis3y8_mCjSEvgn4xXYa_jvGw?testcase_id=6302487985520640 <script> var Context1= new (window.webkitOfflineAudioContext || window.OfflineAudioContext)(32,231706,44100) var Analyser3=Context1.createAnalyser(); {; } {; } Analyser3.fftSize=-0.5146401333622634; </script> Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Dec 19 2016
,
Dec 19 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8c22c74f1f57853ea427fa5f21f170144d4103ed commit 8c22c74f1f57853ea427fa5f21f170144d4103ed Author: rtoy <rtoy@chromium.org> Date: Mon Dec 19 22:58:25 2016 Test for power of two safely Use integer operations to test if an integer is a power of two. And check that the value is in range before testing for a power. BUG= 675570 TEST= Review-Url: https://codereview.chromium.org/2582323003 Cr-Commit-Position: refs/heads/master@{#439603} [modify] https://crrev.com/8c22c74f1f57853ea427fa5f21f170144d4103ed/third_party/WebKit/Source/modules/webaudio/RealtimeAnalyser.cpp [modify] https://crrev.com/8c22c74f1f57853ea427fa5f21f170144d4103ed/third_party/WebKit/Source/platform/audio/AudioUtilities.cpp [modify] https://crrev.com/8c22c74f1f57853ea427fa5f21f170144d4103ed/third_party/WebKit/Source/platform/audio/AudioUtilities.h
,
Dec 20 2016
ClusterFuzz has detected this issue as fixed in range 439552:439637. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6302487985520640 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::RealtimeAnalyser::setFftSize blink::AnalyserHandler::setFftSize fftSizeAttributeSetter Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=439552:439637 Minimized Testcase (0.20 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96m894FLwdU0RYOHzDWN74TdCGkX3EQn66bUyCNAQCES4_QcZOWT2n0C0PudC8fi2SX_LG81TOoTPE2qwfjZ8sEjQ85tkvstrMhZSxrcHVCZnJ_tnhiO0QOtjGRbET98Z02vQis3y8_mCjSEvgn4xXYa_jvGw?testcase_id=6302487985520640 <script> var Context1= new (window.webkitOfflineAudioContext || window.OfflineAudioContext)(32,231706,44100) var Analyser3=Context1.createAnalyser(); {; } {; } Analyser3.fftSize=-0.5146401333622634; </script> See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 20 2016
ClusterFuzz testcase 6302487985520640 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Dec 19 2016Components: Blink>WebAudio
Labels: Test-Predator-Correct-CLs
Owner: lukasza@chromium.org
Status: Assigned (was: Untriaged)