Float-cast-overflow in content::VideoTrackAdapter::CalculateTargetSize |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6563480714084352 Fuzzer: inferno_twister_c Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: content::VideoTrackAdapter::CalculateTargetSize content::MediaStreamVideoSource::FinalizeAddTrack content::MediaStreamVideoCapturerSource::OnRunStateChanged Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=499930:499940 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6563480714084352 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 11 2017
Please ignore the below line in C#1, it is a typo: "Please ignore the Comment#1, which is wrongly assigned."
,
Sep 11 2017
My commit only replaces StreamDeviceInfo struct with MediaStreamDevice struct while keeping the datatypes of the fields the same. It doesn't modify any of the fields or their types, which are being used inside VideoTrackAdapter::CalculateTargetSize() method. So, I don't think this issue has anything to do with my commit. pnangunoori@chromium.org: Is it possible for you to share the reproduction steps for the crash or the exact line number of the crash inside VideoTrackAdapter::CalculateTargetSize()? Seems to be some issue with int to double cast.
,
Sep 11 2017
I'll take a look.
,
Sep 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e8e870d5783695bf1566cf348f4b79f36081cc5c commit e8e870d5783695bf1566cf348f4b79f36081cc5c Author: Guido Urdaneta <guidou@chromium.org> Date: Wed Sep 13 01:41:18 2017 Fix VideoTrackAdapter issues with zero-size frames. This patch makes VideoTrackAdapter ignore aspect-ratio limits when the input or output frame has zero area. Also, output dimensions are clamped to media::limits::kMaxDimension. Before this CL, an input source with zero area (e.g., from element capture) could result in undefined behavior when trying to correct the frame's aspect ratio due to casting of infinite or NaN floating-point values to int. Bug: 763676 Change-Id: I23794e7aba965ee8443bde5c36ef2adfe8cc2ba3 Reviewed-on: https://chromium-review.googlesource.com/663177 Commit-Queue: Guido Urdaneta <guidou@chromium.org> Reviewed-by: Henrik Boström <hbos@chromium.org> Cr-Commit-Position: refs/heads/master@{#501506} [modify] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/renderer/media/video_track_adapter.cc [modify] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/renderer/media/video_track_adapter.h [add] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/renderer/media/video_track_adapter_unittest.cc [modify] https://crrev.com/e8e870d5783695bf1566cf348f4b79f36081cc5c/content/test/BUILD.gn
,
Sep 13 2017
ClusterFuzz has detected this issue as fixed in range 501477:501529. Detailed report: https://clusterfuzz.com/testcase?key=6563480714084352 Fuzzer: inferno_twister_c Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: content::VideoTrackAdapter::CalculateTargetSize content::MediaStreamVideoSource::FinalizeAddTrack content::MediaStreamVideoCapturerSource::OnRunStateChanged Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=499930:499940 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=501477:501529 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6563480714084352 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 13 2017
,
Sep 13 2017
ClusterFuzz testcase 6563480714084352 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by pnangunoori@chromium.org
, Sep 11 2017Labels: M-63 Test-Predator-Wrong-CLs
Owner: c.pa...@samsung.com
Status: Assigned (was: Untriaged)