New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 758871 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: false. unknown video profile: 42 in h264_parser.cc

Project Member Reported by ClusterFuzz, Aug 25 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4549658516127744

Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. unknown video profile: 42 in h264_parser.cc
  base::debug::DebugBreak
  media::H264Parser::ProfileIDCToVideoCodecProfile
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4549658516127744

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-62
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the CL, "h264_parser.cc" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/77be7aef526705f9e752c9cf1abf6a8d99e26803

@dalecurtis -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: dalecur...@chromium.org
Owner: wolenetz@chromium.org
Cc: servolk@chromium.org sande...@chromium.org
Components: Internals>Media>Source
Labels: -Pri-1 Pri-2
Status: Started (was: Assigned)
I don't think this is P1 (if it is hiding some later bad behavior past the NOTREACHED() in Release builds, fuzzing hopefully will catch that separately).

Regardless, fix is out for review at https://chromium-review.googlesource.com/c/chromium/src/+/636191
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e9674393b47f91a2d98369bad036d5a3ff3faf9d

commit e9674393b47f91a2d98369bad036d5a3ff3faf9d
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Mon Aug 28 19:45:04 2017

MSE: Emit error on unrecognized MP4 video (or MP2T SPS) profile indication

Replaces DCHECK with DVLOG in H264Parser::ProfileIDCToVideoCodecProfile
when the profile is unrecognized.

Also, fails parsing early (instead of delaying failure until later in
the pipeline/decoder configuration) when that utility produces
VIDEO_CODEC_PROFILE_UNKNOWN in MP4 non-DV avcC and MP2T SPS parsing.  In the
MP4 case, also logs an error message to chrome://media-internals.

In the MP4 case, helps protect against future regression by doing the
parse error emission on unknown video codec profile near the end of
VideoSampleEntry processing.

BUG= 758871 
TEST=debug asan fuzzer case (mp4) yields parse error instead of DCHECK failure.

Change-Id: I1ae6cdb783ee752cd122005da85f1dc8b0ae35ff
Reviewed-on: https://chromium-review.googlesource.com/636191
Reviewed-by: Sergey Volk <servolk@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#497849}
[modify] https://crrev.com/e9674393b47f91a2d98369bad036d5a3ff3faf9d/media/formats/mp2t/es_parser_h264.cc
[modify] https://crrev.com/e9674393b47f91a2d98369bad036d5a3ff3faf9d/media/formats/mp4/box_definitions.cc
[modify] https://crrev.com/e9674393b47f91a2d98369bad036d5a3ff3faf9d/media/video/h264_parser.cc

Status: Fixed (was: Started)
Should be fixed by #4. Pending CF verification.
Project Member

Comment 6 by ClusterFuzz, Aug 29 2017

ClusterFuzz has detected this issue as fixed in range 497803:497860.

Detailed report: https://clusterfuzz.com/testcase?key=4549658516127744

Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. unknown video profile: 42 in h264_parser.cc
  base::debug::DebugBreak
  media::H264Parser::ProfileIDCToVideoCodecProfile
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497803:497860

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4549658516127744

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Aug 29 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4549658516127744 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment