New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 761938 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: AVC::IsValidAnnexB(*buffer, *subsamples) in avc.cc

Project Member Reported by ClusterFuzz, Sep 5 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5584643159228416

Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  AVC::IsValidAnnexB(*buffer, *subsamples) in avc.cc
  base::debug::DebugBreak
  media::mp4::AVC::InsertParamSetsAnnexB
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5584643159228416

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-63
Owner: erickung@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "avc.cc" assigning to the concern owner.

Suspect Commit#
https://chromium.googlesource.com/chromium/src/+/2cca0f26776baa99251145cc158b259c1c6fd4c7

@erickung -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Owner: servolk@chromium.org
I haven't touched this code for a very long time. Sergey, can you please take a look?
Cc: servolk@chromium.org
Owner: wolenetz@chromium.org
Matt, I believe this has been fixed by https://chromium-review.googlesource.com/c/630636/ ?
Cc: wolenetz@chromium.org
Labels: -Pri-1 Pri-2
Owner: sande...@chromium.org
@#3, I don't think so. That CL (https://chromium-review.googlesource.com/c/630636/) hasn't landed yet, and its approach is to *remove* a different DCHECK (and perhaps add some logging).

This bug (761938) is hitting a different DCHECK.

Dan, can you take both this bug (761938) and completing the landing of https://chromium-review.googlesource.com/c/630636/ (the latter probably needs a new bug for tracking it, since 750518 got repurposed for merging a fix for a different specific issue)? 
(in #4, s/750518/750818/... sorry for spam...)
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 8 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6

commit d95c2a9ca61a92f3baca34cfd05565fb53ed40a6
Author: Dan Sanders <sandersd@chromium.org>
Date: Fri Sep 08 22:59:13 2017

[media] Refactor IsValidAnnexB checks.

Since we don't validate the stream before converting, it is possible for
the conversion to operate correctly and still return an invalid buffer.

This CL extracts the check to a separate method on the bitstream
converter, and logs a media log entry when it fails.

Bug:  761938 
Change-Id: Ic9be88197e2aaedd79b46b6b46792e83af4b2151
Reviewed-on: https://chromium-review.googlesource.com/656307
Commit-Queue: Dan Sanders <sandersd@chromium.org>
Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#500723}
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/avc.cc
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/avc.h
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/avc_unittest.cc
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/bitstream_converter.h
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/box_definitions.cc
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/hevc.cc
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/hevc.h
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/mp4_stream_parser.cc
[modify] https://crrev.com/d95c2a9ca61a92f3baca34cfd05565fb53ed40a6/media/formats/mp4/mp4_stream_parser.h

Project Member

Comment 7 by ClusterFuzz, Sep 9 2017

ClusterFuzz has detected this issue as fixed in range 500678:500748.

Detailed report: https://clusterfuzz.com/testcase?key=5584643159228416

Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  AVC::IsValidAnnexB(*buffer, *subsamples) in avc.cc
  base::debug::DebugBreak
  media::mp4::AVC::InsertParamSetsAnnexB
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500678:500748

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5584643159228416

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Sep 10 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5584643159228416 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment