Floating-point-exception in media::mp4::TimeDeltaFromRational |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5515872545538048 Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Floating-point-exception Crash Address: Crash State: media::mp4::TimeDeltaFromRational media::mp4::MP4StreamParser::EnqueueSample media::mp4::MP4StreamParser::Parse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497144 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5515872545538048 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 26 2017
,
Aug 28 2017
I have a confirmed local repro. Will investigate further.
,
Aug 29 2017
Fix is in review @ https://chromium-review.googlesource.com/c/chromium/src/+/639329
,
Aug 29 2017
,
Aug 29 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e729849c63c3463a5f18c625662dda9018ae7aa9 commit e729849c63c3463a5f18c625662dda9018ae7aa9 Author: Matt Wolenetz <wolenetz@chromium.org> Date: Tue Aug 29 19:28:43 2017 MSE: Disallow zero timescales in MP4 MVHD and MDHD This change prevents division-by-zero in various calculations like moov duration, edit list updates, and track sample cts, dts and duration by ensuring the denominator in these cases is never 0. (Very) loose reading of the ISO spec might allow for MVHD timescale to be zero when the duration is unknown, but I expect we would already be crashing the renderer on division by zero on at least some platforms prior to this CL in that case. BUG= 758876 R=sandersd@chromium.org Change-Id: Ie31044ba733d392e974ba8f8ca805935b83c4892 Reviewed-on: https://chromium-review.googlesource.com/639329 Reviewed-by: Dan Sanders <sandersd@chromium.org> Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org> Cr-Commit-Position: refs/heads/master@{#498196} [modify] https://crrev.com/e729849c63c3463a5f18c625662dda9018ae7aa9/media/formats/mp4/box_definitions.cc [modify] https://crrev.com/e729849c63c3463a5f18c625662dda9018ae7aa9/media/formats/mp4/track_run_iterator.cc
,
Aug 29 2017
#6 should fix this. Verification is pending ClusterFuzz...
,
Aug 30 2017
ClusterFuzz has detected this issue as fixed in range 498180:498221. Detailed report: https://clusterfuzz.com/testcase?key=5515872545538048 Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Floating-point-exception Crash Address: Crash State: media::mp4::TimeDeltaFromRational media::mp4::MP4StreamParser::EnqueueSample media::mp4::MP4StreamParser::Parse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497144 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=498180:498221 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5515872545538048 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 30 2017
ClusterFuzz testcase 5515872545538048 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Aug 30 2017
ClusterFuzz has detected this issue as fixed in range 498180:498221. Detailed report: https://clusterfuzz.com/testcase?key=5515872545538048 Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Floating-point-exception Crash Address: Crash State: media::mp4::TimeDeltaFromRational media::mp4::MP4StreamParser::EnqueueSample media::mp4::MP4StreamParser::Parse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497144 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=498180:498221 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5515872545538048 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 30 2017
|
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by msrchandra@chromium.org
, Aug 25 2017Labels: Test-Predator-Wrong-CLs M-62
Owner: wolenetz@chromium.org
Status: Assigned (was: Untriaged)