CHECK failure: AVC::IsValidAnnexB(*buffer, *subsamples) in avc.cc |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5584643159228416 Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: AVC::IsValidAnnexB(*buffer, *subsamples) in avc.cc base::debug::DebugBreak media::mp4::AVC::InsertParamSetsAnnexB Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5584643159228416 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 6 2017
I haven't touched this code for a very long time. Sergey, can you please take a look?
,
Sep 6 2017
Matt, I believe this has been fixed by https://chromium-review.googlesource.com/c/630636/ ?
,
Sep 6 2017
@#3, I don't think so. That CL (https://chromium-review.googlesource.com/c/630636/) hasn't landed yet, and its approach is to *remove* a different DCHECK (and perhaps add some logging). This bug (761938) is hitting a different DCHECK. Dan, can you take both this bug (761938) and completing the landing of https://chromium-review.googlesource.com/c/630636/ (the latter probably needs a new bug for tracking it, since 750518 got repurposed for merging a fix for a different specific issue)?
,
Sep 6 2017
(in #4, s/750518/750818/... sorry for spam...)
,
Sep 8 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6 commit d95c2a9ca61a92f3baca34cfd05565fb53ed40a6 Author: Dan Sanders <sandersd@chromium.org> Date: Fri Sep 08 22:59:13 2017 [media] Refactor IsValidAnnexB checks. Since we don't validate the stream before converting, it is possible for the conversion to operate correctly and still return an invalid buffer. This CL extracts the check to a separate method on the bitstream converter, and logs a media log entry when it fails. Bug: 761938 Change-Id: Ic9be88197e2aaedd79b46b6b46792e83af4b2151 Reviewed-on: https://chromium-review.googlesource.com/656307 Commit-Queue: Dan Sanders <sandersd@chromium.org> Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org> Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#500723} [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/avc.cc [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/avc.h [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/avc_unittest.cc [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/bitstream_converter.h [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/box_definitions.cc [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/hevc.cc [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/hevc.h [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/mp4_stream_parser.cc [modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/mp4_stream_parser.h
,
Sep 9 2017
ClusterFuzz has detected this issue as fixed in range 500678:500748. Detailed report: https://clusterfuzz.com/testcase?key=5584643159228416 Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: AVC::IsValidAnnexB(*buffer, *subsamples) in avc.cc base::debug::DebugBreak media::mp4::AVC::InsertParamSetsAnnexB Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500678:500748 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5584643159228416 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 10 2017
ClusterFuzz testcase 5584643159228416 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by msrchandra@chromium.org
, Sep 5 2017Labels: Test-Predator-Wrong-CLs M-63
Owner: erickung@chromium.org
Status: Assigned (was: Untriaged)