New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 693868 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in CalcInvArSpec

Project Member Reported by ClusterFuzz, Feb 18 2017

Issue description

Cc: msrchandra@chromium.org
Components: Blink>WebRTC
Labels: Test-Predator-Wrong-CLs M-57
Owner: kwiberg@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "WebRtcIsacfix_DecodeImpl" assigning to the concern owner.
Suspecting Commit#
https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/aeadeccda87cab07676143722ed95547c8c8d229

@kwiberg -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Project Member

Comment 2 by bugdroid1@chromium.org, Mar 3 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/3a2c803dc341a2bc266effb07df9863c14a7aeaa

commit 3a2c803dc341a2bc266effb07df9863c14a7aeaa
Author: kwiberg <kwiberg@webrtc.org>
Date: Fri Mar 03 13:44:49 2017

Multiply in 64 bits to avoid overflow

A fuzzer run caused the operands of this multiplication to be 512 and
5000000, resulting in a product about 20% too large for int32_t. So
change this from a 16x32->32 to a 16x32->64 multiplication. Since we
right shift by 2 at the end, the end result will still fit in int32_t.

I also had to fix a few follow-on add/sub overflows found by the same
fuzzer input once the multiplication was fixed. I chose to saturate
these, since it wasn't just an intermediate value that overflowed.

BUG= chromium:693868 

Review-Url: https://codereview.webrtc.org/2729573002
Cr-Commit-Position: refs/heads/master@{#17003}

[modify] https://crrev.com/3a2c803dc341a2bc266effb07df9863c14a7aeaa/webrtc/modules/audio_coding/codecs/isac/fix/source/entropy_coding.c

Project Member

Comment 4 by ClusterFuzz, Mar 5 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5899178355195904 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Mar 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/a1896a649c9238af281a0e73dacbf981d0bc8e64

commit a1896a649c9238af281a0e73dacbf981d0bc8e64
Author: kwiberg <kwiberg@webrtc.org>
Date: Mon Mar 13 12:28:47 2017

iSAC fix entropy coder: Recently added DCHECK could in fact trigger

A DCHECK added in a recent bugfix, which asserted that a signed 64->32
bit cast did not overflow, has been found to not always pass. We fix
this by saturating.

BUG= chromium:693868 

Review-Url: https://codereview.webrtc.org/2746903002
Cr-Commit-Position: refs/heads/master@{#17209}

[modify] https://crrev.com/a1896a649c9238af281a0e73dacbf981d0bc8e64/webrtc/common_audio/signal_processing/include/spl_inl.h
[modify] https://crrev.com/a1896a649c9238af281a0e73dacbf981d0bc8e64/webrtc/modules/audio_coding/codecs/isac/fix/source/entropy_coding.c

Sign in to add a comment