New issue
Advanced search Search tips

Issue 713792 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 713515
Owner:
Closed: Apr 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in media::ADTSStreamParser::ParseFrameHeader

Project Member Reported by ClusterFuzz, Apr 20 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6194579754975232

Fuzzer: libfuzzer_es_parser_adts_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  media::ADTSStreamParser::ParseFrameHeader
  media::mp2t::EsParserAdts::UpdateAudioConfiguration
  media::mp2t::EsParserAdts::ParseFromEsQueue
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=465743:465794

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96K_Scvt5pD9e3hPKCkz0kvyFNl2jMLZqieMD_4VoeA8-1VMaXAOE2XoZu7QxhvU6W6JgFR5c-ew24mrlbXcix3ImRv-Upo17jHFGJhgyx-4ZU17CF9AglZ6sjGdHkHbHCI6XS5Ya0jtmQkfQU4Caa9YeixVSaDOyBrGXcxMx0__N7ZIavMLuoY9KBap055PSout__dN6TGtuG-yog3XD5fj9i8VjhhOXua3dIxSYi4TAng_fYCIobHVOtPlyhcN0V-fSk-5yBPcFPrZyxcq8QVIcAQBoXm-z2Y8-gZ401Uxke4FDoBkzMvC0EaBmnteGwpJkbzkWMzz0kYL84hOkeeohtjvISPZHHgVWfcPQ5vVHDkSjc?testcase_id=6194579754975232


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Apr 21 2017

Labels: M-59
Project Member

Comment 2 by sheriffbot@chromium.org, Apr 21 2017

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Apr 21 2017

Labels: Pri-1

Comment 4 by mea...@chromium.org, Apr 21 2017

Components: Blink>Media
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
dalecurtis: This one looks identical to  bug 713515 , can you please confirm? Thanks.
Mergedinto: 713515
Status: Duplicate (was: Assigned)
Yup, a bit easier to understand too :) Took me a bit to figure out why this was UB vs just uninitialized value.

Comment 6 by mea...@chromium.org, Apr 21 2017

Nice, and thanks for the quick response :)
Project Member

Comment 7 by sheriffbot@chromium.org, Aug 2 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment