Undefined-shift in decode_user_data |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5812135493107712 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: decode_user_data ff_mpeg4_decode_picture_header mpeg4_decode_header Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=423338:423416 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5812135493107712 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Oct 31 2017
Will pick this up with ffmpeg roll.
,
Nov 18 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/252244150ad759fe86470f40642514bf2a7aec98 commit 252244150ad759fe86470f40642514bf2a7aec98 Author: Dale Curtis <dalecurtis@chromium.org> Date: Sat Nov 18 00:25:32 2017 [mpeg4video] Fix undefined shift on assumed 8-bit input. decode_user_data() attempts to create an integer |build| value with 8 bits of spacing for 3 components. However each component is an int32_t, so shifting each component is undefined for values outside of the 8 bit range. This patch simply clamps input to 8-bits per component. BUG= 779924 Signed-off-by: Dale Curtis <dalecurtis@chromium.org> Change-Id: Ieb4112d10df3bba5ded04a60d709f44911644da8 Reviewed-on: https://chromium-review.googlesource.com/777850 Reviewed-by: Dan Sanders <sandersd@chromium.org> [modify] https://crrev.com/252244150ad759fe86470f40642514bf2a7aec98/libavcodec/mpeg4videodec.c [modify] https://crrev.com/252244150ad759fe86470f40642514bf2a7aec98/chromium/patches/README
,
Nov 18 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/aea3d2d4d8d304df1a029ef83d248508073bd066 commit aea3d2d4d8d304df1a029ef83d248508073bd066 Author: Dale Curtis <dalecurtis@chromium.org> Date: Sat Nov 18 06:56:26 2017 Roll ffmpeg DEPS and fix additional ubsan issues. This change enables AV_EF_EXPLODE such that all serious errors encountered during demuxing are fatal. Previously ffmpeg would try to ignore these in some cases; leading to ubsan or other issues. Specifically crbug.com/698524 and crbug.com/710791 . Due to the removal of the speex parser from ogg, there is one test that needs updating with the roll too. https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/1e816bccb5ff..252244150ad7 $ git log 1e816bccb..252244150 --date=short --no-merges --format='%ad %ae %s' 2017-11-17 dalecurtis [mpeg4video] Fix undefined shift on assumed 8-bit input. 2017-11-17 dalecurtis Disable unused ogg codec parsers; they have bugs we don't care about. 2017-11-17 dalecurtis Use ff_thread_once for fixed, float table init. 2017-11-17 dalecurtis Fixup some patches messages. 2017-11-17 dalecurtis [mov] Fix leak of frame_duration_buffer in mov_fix_index(). 2017-11-17 dalecurtis Prevent undefined shift with wrap_bits >= 63. 2017-11-15 hubbe avformat/mov: Check size of STSC allocation 2017-11-17 jstebbins [PATCH] lavf/mov: don't read outside frag_index bounds Created with: roll-dep src/third_party/ffmpeg BUG= 786269 , 782074 , 783459 , 784159 , 654612 , 779924 , 710791 , 698524 TEST=security test cases no longer fail. Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: Ibbf3c32080705d6484682351a351663c51a7f752 Reviewed-on: https://chromium-review.googlesource.com/777408 Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Reviewed-by: Dan Sanders <sandersd@chromium.org> Cr-Commit-Position: refs/heads/master@{#517709} [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/DEPS [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/media/filters/ffmpeg_demuxer_unittest.cc [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/media/filters/ffmpeg_glue.cc
,
Nov 18 2017
ClusterFuzz has detected this issue as fixed in range 517703:517710. Detailed report: https://clusterfuzz.com/testcase?key=5812135493107712 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: decode_user_data ff_mpeg4_decode_picture_header mpeg4_decode_header Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=423338:423416 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=517703:517710 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5812135493107712 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 18 2017
ClusterFuzz testcase 5812135493107712 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by kkaluri@chromium.org
, Oct 31 2017Components: Internals>Media>Codecs
Labels: M-63 CF-NeedsTriage Test-Predator-Wrong