CHECK failure: video_decoder_config.IsValidConfig() in mp2t_stream_parser.cc |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6021584140894208 Fuzzer: libFuzzer_mediasource_MP2T_AACSBR_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: video_decoder_config.IsValidConfig() in mp2t_stream_parser.cc base::debug::DebugBreak media::mp2t::Mp2tStreamParser::OnVideoConfigChanged Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=499783:499873 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6021584140894208 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 8 2017
=>servolk@ Sergey, our new MSE fuzzers are triggering this DCHECK that damienv@ touched last in https://chromium.googlesource.com/chromium/src/+/990e3f9e6b878a9a0f1c84626090180390972fd0 I'm uncertain what would happen in release builds (of this Chromecast-specific code path) if such an invalid config were undetected, hence I'm leaving it P1. Perhaps parse error is best in this case. Can you please make a fix; assign it back to either Dale or me if you don't have bandwidth for this. Thanks!
,
Sep 8 2017
It's also interesting that there's a video config involved at all in an audio-only mediasource (just AACSBR is expected per mime-type in addSourceBuffer()). Please investigate that, too.
,
Oct 1 2017
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 2 2017
Ping servolk.
,
Oct 2 2017
Re #2, good question, I'm not entirely sure, I suspect this could lead to a crash somewhere down the road, because we would ignore the DCHECK in release builds and would continue with an invalid video config. Re #3, I think that's expected, because the crash happens in mp2t parser before it reports configs to SourceBufferState. If there was no crash due to the DCHECK, SourceBufferState::OnNewConfigs would try to check received configs against the expected codecs from the mime type and would reject this stream. I believe the best course of action here is to check that the video config is actually valid in EsParserH264::UpdateVideoDecoderConfig, before we get to this DCHECK. I'll prepare a CL.
,
Oct 2 2017
@#6 SGTM Thanks for looking into this, servolK@. I've provided initial comment on your CL.
,
Oct 2 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1b00c058d243fe00970562f1d6a369617e5ecac7 commit 1b00c058d243fe00970562f1d6a369617e5ecac7 Author: Sergey Volk <servolk@google.com> Date: Mon Oct 02 22:45:38 2017 Validate video config in EsParserH264 before emitting it This issue was uncovered by a libFuzzer test, apparently the video config read from the input stream might be invalid. Bug: 763023 Change-Id: I83b181ad2ce0a9f0e1cbae27497252b339381f51 Reviewed-on: https://chromium-review.googlesource.com/695386 Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org> Commit-Queue: Sergey Volk <servolk@chromium.org> Cr-Commit-Position: refs/heads/master@{#505826} [modify] https://crrev.com/1b00c058d243fe00970562f1d6a369617e5ecac7/media/formats/mp2t/es_parser_adts.cc [modify] https://crrev.com/1b00c058d243fe00970562f1d6a369617e5ecac7/media/formats/mp2t/es_parser_h264.cc [modify] https://crrev.com/1b00c058d243fe00970562f1d6a369617e5ecac7/media/formats/mp2t/es_parser_mpeg1audio.cc
,
Oct 2 2017
,
Oct 3 2017
ClusterFuzz has detected this issue as fixed in range 505783:505840. Detailed report: https://clusterfuzz.com/testcase?key=6021584140894208 Fuzzer: libFuzzer_mediasource_MP2T_AACSBR_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: video_decoder_config.IsValidConfig() in mp2t_stream_parser.cc media::mp2t::Mp2tStreamParser::OnVideoConfigChanged void base::internal::FunctorTraits<void Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=499783:499873 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=505783:505840 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6021584140894208 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 3 2017
ClusterFuzz testcase 6021584140894208 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 7 2017
|
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by msrchandra@chromium.org
, Sep 8 2017Labels: Test-Predator-Wrong-CLs M-63
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)