New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 762545 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: mp4::AAC().Parse(*extra_data, media_log()) in adts_stream_parser.cc

Project Member Reported by ClusterFuzz, Sep 6 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6500039483719680

Fuzzer: libFuzzer_mediasource_ADTS_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  mp4::AAC().Parse(*extra_data, media_log()) in adts_stream_parser.cc
  base::debug::DebugBreak
  media::ADTSStreamParser::ParseFrameHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=499783:499873

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6500039483719680

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-63
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "adts_stream_parser.cc" assigning to the concern owner who might be related.

@dalecurtis -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Thank you.
Cc: wolenetz@chromium.org
Components: Internals>Media>Source
note - that conditional-on-media-log DCHECK is ugly.

Project Member

Comment 4 by bugdroid1@chromium.org, Sep 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/57c45707de19f39915e12f6909a7594f0d3ff04e

commit 57c45707de19f39915e12f6909a7594f0d3ff04e
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Tue Sep 12 01:37:25 2017

Delete useless DCHECK in adts parser.

The code above this DCHECK already reports media logs for various
failures, so there's no point in running the parser just for the
purposes of a DCHECK. It also fails out on some things that are
not errors within this code.

BUG= 762545 
TEST=none

Change-Id: Iedf423ba4f8dcb4074bcc3f143c47b762e210829
Reviewed-on: https://chromium-review.googlesource.com/661887
Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501142}
[modify] https://crrev.com/57c45707de19f39915e12f6909a7594f0d3ff04e/media/formats/mpeg/adts_stream_parser.cc

Status: Fixed (was: Assigned)
Project Member

Comment 6 by ClusterFuzz, Sep 12 2017

ClusterFuzz has detected this issue as fixed in range 501134:501161.

Detailed report: https://clusterfuzz.com/testcase?key=6500039483719680

Fuzzer: libFuzzer_mediasource_ADTS_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  mp4::AAC().Parse(*extra_data, media_log()) in adts_stream_parser.cc
  base::debug::DebugBreak
  media::ADTSStreamParser::ParseFrameHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=499783:499873
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=501134:501161

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6500039483719680

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Sep 12 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6500039483719680 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment