New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 681377 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Feb 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in WebRtcSpl_LevinsonDurbin

Project Member Reported by ClusterFuzz, Jan 15 2017

Issue description

Components: Blink>WebRTC>Audio
Labels: Test-Predator-Wrong M-56
Owner: ivoc@chromium.org
Status: Assigned (was: Untriaged)
ivoc@, assigning to you as per previous issues  675349  and  666612 . could you please take a look?
Thank you.

Comment 2 by ivoc@chromium.org, Feb 6 2017

Sorry, I was on vacation for the past couple of weeks. I'll have a look at this soon.
Project Member

Comment 3 by bugdroid1@chromium.org, Feb 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/a48e1b6bc3d26dfc70748f05112617e8fddb32fa

commit a48e1b6bc3d26dfc70748f05112617e8fddb32fa
Author: ivoc <ivoc@webrtc.org>
Date: Thu Feb 09 11:05:59 2017

Fix for left shift of potentially negative value.

Left shifting of negative integers is undefined behavior, and should be prevented. This CL fixes one such instance in the Levinson Durbin function.

BUG= chromium:681377 

Review-Url: https://codereview.webrtc.org/2680973005
Cr-Commit-Position: refs/heads/master@{#16507}

[modify] https://crrev.com/a48e1b6bc3d26dfc70748f05112617e8fddb32fa/webrtc/common_audio/signal_processing/levinson_durbin.c

Project Member

Comment 4 by ClusterFuzz, Feb 15 2017

ClusterFuzz has detected this issue as fixed in range 450309:450324.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5333271484563456

Fuzzer: libfuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  WebRtcSpl_LevinsonDurbin
  webrtc::Expand::AnalyzeSignal
  webrtc::Expand::Process
  
Sanitizer: undefined (UBSAN)

Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=450309:450324

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv943GN1JbnVqFez_2eFb_42qxGyITVkK37weIuV5BIzAP14Xk170vZjx9K1WHinoKiFVNQrO8OXqLc46QYyrZ-j9j90UYD4o4t91gOWzpzI0vZTaA1fHulFhG_VwV7Li5QWkYk-PLCznqdkLe4EcJ3DwZ1GBZ7vU0CJ4ik7Tm-oaIzHjsfNm-prHCwZKLEGnA5MRF4hxxM-2ys0o9LEMkkMJjE4-7Dm60be4Pla39JYHyOcjuGCKsVwBa0i23QvW9Q1GdDuOWVZNLiTFXnOcvK9NVtzHrNTycOTmOZvaqOahjCzOx2wWytH9YXz6Wa-mEunrDsG4F9df-7y2GmzaMya1ox9BQ6oYjqMRD6dXzrjx630hXS0?testcase_id=5333271484563456


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Feb 15 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5333271484563456 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -M-56 M-58

Sign in to add a comment