New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 758888 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 9
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: false in webm_content_encodings_client.cc

Project Member Reported by ClusterFuzz, Aug 25 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6291972330618880

Fuzzer: libFuzzer_mediasource_WEBM_VP9_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in webm_content_encodings_client.cc
  base::debug::DebugBreak
  media::WebMContentEncodingsClient::OnUInt
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6291972330618880

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-62
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "webm_content_encodings_client.cc" assigning to the concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/9cddc0b9cd174242d365e9d64615687384b73c89

@dalecurtis -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: dalecur...@chromium.org
Owner: wolenetz@chromium.org
I have a local repro using the fuzzer case.
Concerningly, the line before this DCHECK(false) is:
// This should not happen if WebMListParser is working properly.

Investigating...
Status: Started (was: Assigned)

Comment 5 by mmoroz@chromium.org, Aug 29 2017

Cc: mmoroz@chromium.org
Cc: wolenetz@chromium.org
Owner: xhw...@chromium.org
Status: Assigned (was: Started)
=> xhwang@ :

It looks like at least kWebMIdContentSigAlgo is *not* handled properly when the webm parser finds it.  In fact, I don't see any place in our code where that EBML Tag ID is even used other than being defined and defined as a valid UINT member of a list kWebMIdContentEncryption pieces.

In debug builds -> DCHECK
In release builds -> parse error

I'm not at all clear on what the real correct behavior for Chrome should be though. It seems from the line right before the DCHECK, though, that this DCHECK's failure is unexpected.

Please take a look. Thanks!

Comment 7 by xhw...@chromium.org, Aug 31 2017

Status: Started (was: Assigned)
I'll take a look

Comment 8 by xhw...@chromium.org, Sep 13 2017

Labels: -Pri-1 Pri-2
Given this is a DCHECK and in release mode we handle the error correctly, I am going to move this issue to P2.
Project Member

Comment 9 by ClusterFuzz, Oct 1 2017

Components: Internals>Media
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Labels: -M-62 M-64
Status: Assigned (was: Started)
For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.
Labels: -M-64
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Project Member

Comment 15 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 6291972330618880 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 18 by ClusterFuzz, Jan 9

ClusterFuzz has detected this issue as fixed in range 621021:621022.

Detailed report: https://clusterfuzz.com/testcase?key=6291972330618880

Fuzzer: libFuzzer_mediasource_WEBM_VP9_pipeline_integration_fuzzer
Fuzz target binary: mediasource_WEBM_VP9_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in webm_content_encodings_client.cc
  media::WebMContentEncodingsClient::OnUInt
  media::ParseUInt
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=621021:621022

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6291972330618880

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 19 by ClusterFuzz, Jan 9

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6291972330618880 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment