New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 732065 link

Starred by 1 user

Issue metadata

Status: Fixed
Merged: issue 735218
Owner:
Closed: Nov 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in mov_get_stsc_samples

Project Member Reported by ClusterFuzz, Jun 10 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5402979422437376

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mov_get_stsc_samples
  mov_read_packet
  ff_read_packet
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=433019:433116

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5402979422437376


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org andreas....@googlemail.com
Labels: M-60 Test-Predator-Correct-CLs
Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: Andreas Cadhalpun
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/a5b4476a602f31e451b11ca0c18bc92be130a50e
Time: Wed Oct 19 17:23:49 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 7. (file: utils.c, crashed on: 813, modified: 806). 

Author: Luca Barbato
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/3ef98937f512184f80d3bd30015f5ec83dc11eb0
Time: Sat Feb 06 12:15:36 2016
File mov.c is changed in this cl (and is part of stack frame #0, "mov_get_stsc_samples"; frame #1, "mov_read_packet")
Minimum distance from crash line to modified line: 14. (file: mov.c, crashed on: 2522, modified: 2536). 

Author: Hendrik Leppkes
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/c2e13d2ecd388bab28e743c34ed146c5ed213fc9
Time: Thu Jun 30 12:10:42 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 20. (file: utils.c, crashed on: 1514, modified: 1494). 

Author: Luca Barbato
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/5eb562831b3a9bea8026c413ef1338e06450d005
Time: Tue Feb 09 22:07:18 2016
File mov.c is changed in this cl (and is part of stack frame #0, "mov_get_stsc_samples"; frame #1, "mov_read_packet")
Minimum distance from crash line to modified line: 36. (file: mov.c, crashed on: 2522, modified: 2558). 

Author: Timo Rothenpieler
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/6d9a46e884d090a68069112a3b0436aa8b563967
Time: Wed Sep 21 17:00:46 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 40. (file: utils.c, crashed on: 3694, modified: 3654). 

Author: Michael Niedermayer
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/6826f16e4a3629c801396dca3ada8a78fc506e85
Time: Thu Jun 09 09:22:01 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 44. (file: utils.c, crashed on: 3712, modified: 3756). 

Author: Matthieu Bouron
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/acfab2dce6d30ab30b953d10e2e0097d8f8cb29f
Time: Thu Jun 16 11:16:52 2016
File mov.c is changed in this cl (and is part of stack frame #0, "mov_get_stsc_samples"; frame #1, "mov_read_packet")
Minimum distance from crash line to modified line: 55. (file: mov.c, crashed on: 2522, modified: 2577). 

Author: Michael Niedermayer
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/196cfc278d2bce03d03ef95b5b34dfd9689ddb60
Time: Tue Apr 12 01:55:19 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 57. (file: utils.c, crashed on: 3712, modified: 3769). 

Author: Michael Niedermayer
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/218bb8b3f370c00b2dba2e6bb1ce4628e6870ad5
Time: Thu Jun 09 17:11:18 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 73. (file: utils.c, crashed on: 3694, modified: 3621). 

Author: Clément Bœsch
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/8ca78d0fefa02e44657ad57adab151b7b71b27d3
Time: Sat Jun 25 11:38:53 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 81. (file: utils.c, crashed on: 3694, modified: 3613). 

Author: Michael Niedermayer
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/2a70e78a2885aa9264f95b293a2169e57ca1bbdb
Time: Thu Jun 09 17:09:36 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 85. (file: utils.c, crashed on: 3694, modified: 3609). 

Author: Michael Niedermayer
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/ad72d7d299c4b8355d4e3809bb9d5dbe8ac6cbb5
Time: Mon May 30 12:00:53 2016
File utils.c is changed in this cl (and is part of stack frame #2, "ff_read_packet"; frame #3, "read_frame_internal"; frame #4, "avformat_find_stream_info")
Minimum distance from crash line to modified line: 96. (file: utils.c, crashed on: 3712, modified: 3808).

Suspecting Commit#
https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/a5b4476a602f31e451b11ca0c18bc92be130a50e

Andreas.Cadhalpun -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: -andreas....@googlemail.com
Mergedinto: 735218
Status: Duplicate (was: Untriaged)
This issue looks similar to Bug ID -- 735218. So merging the issue into same. Please un-merge if that is not the case.
Thank You.
Labels: -M-60 M-65
Owner: jrumm...@chromium.org
Status: Assigned (was: Duplicate)
This is also a ffmpeg failure, but it is not the same as  issue 735218 .
Status: Duplicate (was: Assigned)
Still linked, try to unlink  issue 735218 .
Status: Assigned (was: Duplicate)
Project Member

Comment 6 by ClusterFuzz, Nov 19 2017

ClusterFuzz has detected this issue as fixed in range 517703:517710.

Detailed report: https://clusterfuzz.com/testcase?key=5402979422437376

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mov_get_stsc_samples
  mov_read_packet
  ff_read_packet
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=433019:433116
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=517703:517710

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5402979422437376

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Status: Fixed (was: Assigned)
Looks like this was fixed by the latest version of ffmpeg (checked in at 517709).

Sign in to add a comment