CHECK failure: pos_ == box_size_ in box_reader.cc |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4559812687036416 Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: pos_ == box_size_ in box_reader.cc media::mp4::BoxReader::ScanChildren media::mp4::AudioSampleEntry::Parse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=512266:512309 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4559812687036416 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Oct 31 2017
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 31 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4b28187dab3fec3bfe98a366ea5d07c1d9b110b4 commit 4b28187dab3fec3bfe98a366ea5d07c1d9b110b4 Author: Dan Sanders <sandersd@chromium.org> Date: Tue Oct 31 23:35:50 2017 [media] BoxReader: Cap |buf_size_| to |box_size_|. Before this change, BoxReader could read syntax elements outside of a box in cases where the MP4 was invalid. This isn't a security concern, since the reads were still bounded by the buffer size, but it did make it hard to interpret the later failures. This CL shrinks |buf_size_| to match |box_size_| when the box size is read. OOB reads will now result in Parse failures immediately. Bug: 779321 Change-Id: I54be6ba3815d1502233b5e95d099ce9d9a54b3cc Reviewed-on: https://chromium-review.googlesource.com/747080 Reviewed-by: Chrome Cunningham <chcunningham@chromium.org> Commit-Queue: Dan Sanders <sandersd@chromium.org> Cr-Commit-Position: refs/heads/master@{#513000} [modify] https://crrev.com/4b28187dab3fec3bfe98a366ea5d07c1d9b110b4/media/formats/mp4/box_reader.cc [modify] https://crrev.com/4b28187dab3fec3bfe98a366ea5d07c1d9b110b4/media/formats/mp4/box_reader.h [modify] https://crrev.com/4b28187dab3fec3bfe98a366ea5d07c1d9b110b4/media/formats/mp4/box_reader_unittest.cc
,
Nov 1 2017
ClusterFuzz has detected this issue as fixed in range 512996:513028. Detailed report: https://clusterfuzz.com/testcase?key=4559812687036416 Fuzzer: libFuzzer_mediasource_MP4_FLAC_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: pos_ == box_size_ in box_reader.cc media::mp4::BoxReader::ScanChildren media::mp4::AudioSampleEntry::Parse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=512266:512309 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=512996:513028 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4559812687036416 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 1 2017
ClusterFuzz testcase 4559812687036416 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 7 2017
|
||||
►
Sign in to add a comment |
||||
Comment 1 by kkaluri@chromium.org
, Oct 30 2017Components: Blink>Media
Labels: M-64 Test-Predator-Wrong
Owner: sande...@chromium.org
Status: Assigned (was: Untriaged)