New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 758876 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug



Sign in to add a comment

Floating-point-exception in media::mp4::TimeDeltaFromRational

Project Member Reported by ClusterFuzz, Aug 25 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5515872545538048

Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  media::mp4::TimeDeltaFromRational
  media::mp4::MP4StreamParser::EnqueueSample
  media::mp4::MP4StreamParser::Parse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497144

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5515872545538048

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-62
Owner: wolenetz@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "track_run_iterator.cc" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/f40f65fcd5154127ca5e7a354b2c3a2ba779d8bc

@wolenetz -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by ClusterFuzz, Aug 26 2017

Labels: OS-Mac
Labels: OS-Android OS-Chrome OS-Fuchsia OS-Windows
I have a confirmed local repro. Will investigate further.
Cc: sande...@chromium.org
Status: Started (was: Assigned)
Fix is in review @ https://chromium-review.googlesource.com/c/chromium/src/+/639329

Comment 5 by mmoroz@chromium.org, Aug 29 2017

Cc: mmoroz@chromium.org
Project Member

Comment 6 by bugdroid1@chromium.org, Aug 29 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e729849c63c3463a5f18c625662dda9018ae7aa9

commit e729849c63c3463a5f18c625662dda9018ae7aa9
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Tue Aug 29 19:28:43 2017

MSE: Disallow zero timescales in MP4 MVHD and MDHD

This change prevents division-by-zero in various calculations like moov
duration, edit list updates, and track sample cts, dts and duration by
ensuring the denominator in these cases is never 0.

(Very) loose reading of the ISO spec might allow for MVHD timescale to be zero
when the duration is unknown, but I expect we would already be crashing
the renderer on division by zero on at least some platforms prior to
this CL in that case.

BUG= 758876 
R=sandersd@chromium.org

Change-Id: Ie31044ba733d392e974ba8f8ca805935b83c4892
Reviewed-on: https://chromium-review.googlesource.com/639329
Reviewed-by: Dan Sanders <sandersd@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#498196}
[modify] https://crrev.com/e729849c63c3463a5f18c625662dda9018ae7aa9/media/formats/mp4/box_definitions.cc
[modify] https://crrev.com/e729849c63c3463a5f18c625662dda9018ae7aa9/media/formats/mp4/track_run_iterator.cc

Status: Fixed (was: Started)
#6 should fix this. Verification is pending ClusterFuzz...
Project Member

Comment 8 by ClusterFuzz, Aug 30 2017

ClusterFuzz has detected this issue as fixed in range 498180:498221.

Detailed report: https://clusterfuzz.com/testcase?key=5515872545538048

Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  media::mp4::TimeDeltaFromRational
  media::mp4::MP4StreamParser::EnqueueSample
  media::mp4::MP4StreamParser::Parse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497144
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=498180:498221

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5515872545538048

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Aug 30 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5515872545538048 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 10 by ClusterFuzz, Aug 30 2017

ClusterFuzz has detected this issue as fixed in range 498180:498221.

Detailed report: https://clusterfuzz.com/testcase?key=5515872545538048

Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  media::mp4::TimeDeltaFromRational
  media::mp4::MP4StreamParser::EnqueueSample
  media::mp4::MP4StreamParser::Parse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497144
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=498180:498221

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5515872545538048

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Cc: wolenetz@chromium.org
 Issue 760486  has been merged into this issue.

Sign in to add a comment