Integer-overflow in vp8_packet |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5621327835955200 Fuzzer: libfuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: vp8_packet ogg_packet ogg_read_packet Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv978jKc8OBAU3G-z_5imcqZ5-jweDmO2MxKOqZh6SBurTByZ_u0y4ghcTI7BMsFk-0c_HA8rj0Y2Fmcj11M_82y7sU00mTB3U-BpqsgCxlQwVJFWtaAuZ-cMA326q48qTl5JzmXfNg5hayWrd5sQXwUuEgYjsjB1mqU7MvHPSB2TzfNrZSnamAuczxXYWD2Jqk2RqGcwZU-6z4Sk9mcm9YXUHDAnO4n5HqVn57sahGWaEGZAE0kQVWRNfKWVNypf8VsiIb6zSSuy_C2iRau7Pik_Aj4uMjyugs68SOxb-ASv1k2VvKKUoXYzv0rjaPo5CY2PB4mDlo9l-UPOLikEFPsS8L6W-kMalTzBeiCKimn9qd4A1uw?testcase_id=5621327835955200 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Apr 13 2017
,
Oct 24 2017
For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md. The link referenced in the description is no longer valid. (bulk edit)
,
Nov 6 2017
,
Nov 18 2017
,
Nov 18 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/aea3d2d4d8d304df1a029ef83d248508073bd066 commit aea3d2d4d8d304df1a029ef83d248508073bd066 Author: Dale Curtis <dalecurtis@chromium.org> Date: Sat Nov 18 06:56:26 2017 Roll ffmpeg DEPS and fix additional ubsan issues. This change enables AV_EF_EXPLODE such that all serious errors encountered during demuxing are fatal. Previously ffmpeg would try to ignore these in some cases; leading to ubsan or other issues. Specifically crbug.com/698524 and crbug.com/710791 . Due to the removal of the speex parser from ogg, there is one test that needs updating with the roll too. https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/1e816bccb5ff..252244150ad7 $ git log 1e816bccb..252244150 --date=short --no-merges --format='%ad %ae %s' 2017-11-17 dalecurtis [mpeg4video] Fix undefined shift on assumed 8-bit input. 2017-11-17 dalecurtis Disable unused ogg codec parsers; they have bugs we don't care about. 2017-11-17 dalecurtis Use ff_thread_once for fixed, float table init. 2017-11-17 dalecurtis Fixup some patches messages. 2017-11-17 dalecurtis [mov] Fix leak of frame_duration_buffer in mov_fix_index(). 2017-11-17 dalecurtis Prevent undefined shift with wrap_bits >= 63. 2017-11-15 hubbe avformat/mov: Check size of STSC allocation 2017-11-17 jstebbins [PATCH] lavf/mov: don't read outside frag_index bounds Created with: roll-dep src/third_party/ffmpeg BUG= 786269 , 782074 , 783459 , 784159 , 654612 , 779924 , 710791 , 698524 TEST=security test cases no longer fail. Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: Ibbf3c32080705d6484682351a351663c51a7f752 Reviewed-on: https://chromium-review.googlesource.com/777408 Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Reviewed-by: Dan Sanders <sandersd@chromium.org> Cr-Commit-Position: refs/heads/master@{#517709} [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/DEPS [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/media/filters/ffmpeg_demuxer_unittest.cc [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/media/filters/ffmpeg_glue.cc
,
Nov 19 2017
ClusterFuzz has detected this issue as fixed in range 517703:517710. Detailed report: https://clusterfuzz.com/testcase?key=5621327835955200 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: vp8_packet ogg_packet ogg_read_packet Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=517703:517710 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5621327835955200 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 19 2017
ClusterFuzz testcase 5621327835955200 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mummare...@chromium.org
, Apr 13 2017Components: Internals>Media>FFmpeg
Labels: Test-Predator-Wrong M-59