New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 763676 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in content::VideoTrackAdapter::CalculateTargetSize

Project Member Reported by ClusterFuzz, Sep 10 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6563480714084352

Fuzzer: inferno_twister_c
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  content::VideoTrackAdapter::CalculateTargetSize
  content::MediaStreamVideoSource::FinalizeAddTrack
  content::MediaStreamVideoCapturerSource::OnRunStateChanged
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=499930:499940

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6563480714084352

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org a...@chromium.org pnangunoori@chromium.org
Labels: M-63 Test-Predator-Wrong-CLs
Owner: c.pa...@samsung.com
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “media_stream_video_capturer_source.cc” assigning to concern owner from GIT revision log.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/5cd1ba20c49f6a1cbff480bf5f42065d59e2ab6e

@c.padhi -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Please ignore the Comment#1, which is wrongly assigned.

Thank You.
Please ignore the below line in C#1, it is a typo:

"Please ignore the Comment#1, which is wrongly assigned."

Comment 3 by c.pa...@samsung.com, Sep 11 2017

Cc: guidou@chromium.org
My commit only replaces StreamDeviceInfo struct with MediaStreamDevice struct while keeping the datatypes of the fields the same. It doesn't modify any of the fields or their types, which are being used inside VideoTrackAdapter::CalculateTargetSize() method. So, I don't think this issue has anything to do with my commit.

pnangunoori@chromium.org: Is it possible for you to share the reproduction steps for the crash or the exact line number of the crash inside VideoTrackAdapter::CalculateTargetSize()? Seems to be some issue with int to double cast.

Comment 4 by guidou@chromium.org, Sep 11 2017

Owner: guidou@chromium.org
I'll take a look.
Project Member

Comment 5 by bugdroid1@chromium.org, Sep 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e8e870d5783695bf1566cf348f4b79f36081cc5c

commit e8e870d5783695bf1566cf348f4b79f36081cc5c
Author: Guido Urdaneta <guidou@chromium.org>
Date: Wed Sep 13 01:41:18 2017

Fix VideoTrackAdapter issues with zero-size frames.

This patch makes VideoTrackAdapter ignore aspect-ratio limits when
the input or output frame has zero area.
Also, output dimensions are clamped to media::limits::kMaxDimension.

Before this CL, an input source with zero area (e.g., from element capture)
could result in undefined behavior when trying to correct the frame's
aspect ratio due to casting of infinite or NaN floating-point values to int.

Bug:  763676 
Change-Id: I23794e7aba965ee8443bde5c36ef2adfe8cc2ba3
Reviewed-on: https://chromium-review.googlesource.com/663177
Commit-Queue: Guido Urdaneta <guidou@chromium.org>
Reviewed-by: Henrik Boström <hbos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501506}
[modify] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/renderer/media/video_track_adapter.cc
[modify] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/renderer/media/video_track_adapter.h
[add] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/renderer/media/video_track_adapter_unittest.cc
[modify] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/test/BUILD.gn

Project Member

Comment 6 by ClusterFuzz, Sep 13 2017

ClusterFuzz has detected this issue as fixed in range 501477:501529.

Detailed report: https://clusterfuzz.com/testcase?key=6563480714084352

Fuzzer: inferno_twister_c
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  content::VideoTrackAdapter::CalculateTargetSize
  content::MediaStreamVideoSource::FinalizeAddTrack
  content::MediaStreamVideoCapturerSource::OnRunStateChanged
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=499930:499940
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=501477:501529

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6563480714084352

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 7 by guidou@chromium.org, Sep 13 2017

Status: Fixed (was: Assigned)
Project Member

Comment 8 by ClusterFuzz, Sep 13 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6563480714084352 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment