New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 768114 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: size > 0 in es_parser.cc

Project Member Reported by ClusterFuzz, Sep 23 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6352433168252928

Fuzzer: libFuzzer_mediasource_MP2T_AACLC_AVC_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  size > 0 in es_parser.cc
  media::mp2t::EsParser::Parse
  media::mp2t::TsSectionPes::ParseInternal
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=499783:499873

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6352433168252928

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org kkaluri@chromium.org
Components: Blink>Media
Labels: M-63 CF-NeedsTriage Test-Predator-Wrong
Unable to find the possible suspect using Predator, CL and Code Search.Hence untriaging this issue, Could some one please look into the issue.

Thank You.
Components: -Blink>Media Internals>Media
Cc: wolenetz@chromium.org
Owner: hubbe@chromium.org
Status: Assigned (was: Untriaged)
Randomly assigning to a videostack team member, hubbe@ you're the lucky candidate.
Project Member

Comment 4 by bugdroid1@chromium.org, Sep 29 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b1ce939bdbfec417e8eb811877f8b81d6bee44d0

commit b1ce939bdbfec417e8eb811877f8b81d6bee44d0
Author: Fredrik Hubinette <hubbe@google.com>
Date: Fri Sep 29 19:03:13 2017

fix DCHECK error in es_parser found by fuzztesting

Transport streams allow for zero-length packets, while
the es_parser does not. I was not able to find out which
is correct from the spec, so I chose the change that
is most permissive and allow the zero-length packets.

Bug:  768114 
Change-Id: I34fd1a7f1adf68367ce4cce1d9da5bbcc01cd561
Reviewed-on: https://chromium-review.googlesource.com/691182
Commit-Queue: Fredrik Hubinette <hubbe@chromium.org>
Reviewed-by: Dan Sanders <sandersd@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505435}
[modify] https://crrev.com/b1ce939bdbfec417e8eb811877f8b81d6bee44d0/media/formats/mp2t/es_parser.cc

Project Member

Comment 5 by ClusterFuzz, Sep 30 2017

ClusterFuzz has detected this issue as fixed in range 505425:505455.

Detailed report: https://clusterfuzz.com/testcase?key=6352433168252928

Fuzzer: libFuzzer_mediasource_MP2T_AACLC_AVC_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  size > 0 in es_parser.cc
  media::mp2t::EsParser::Parse
  media::mp2t::TsSectionPes::ParseInternal
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=499783:499873
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=505425:505455

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6352433168252928

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Sep 30 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6352433168252928 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment