Integer-overflow in WebRtcAgc_ProcessVad |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4998361890684928 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: WebRtcAgc_ProcessVad WebRtcAgc_ProcessDigital WebRtcAgc_Process Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=513121:513142 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4998361890684928 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 2 2017
I only removed myself from OWNERS files, this suggestion is bonkers.
,
Nov 7 2017
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/7cfbf3a0ffc888e411a677a3402961792bba92aa commit 7cfbf3a0ffc888e411a677a3402961792bba92aa Author: Alex Loiko <aleloi@webrtc.org> Date: Tue Nov 07 15:37:55 2017 Make energy calculation in AGC not overflow. An energy value is calculated by summing squares of processed audio samples. The expression 'out*out >> 6' could overflow. In this CL we change it to 'out*(out>>6) + out*(out*(out%(1<<6))>>6)'. The which is verified and proven to be equal, but doesn't overflow. The change also passes our change-detection tests in GainControlBitExactnessTest.* We verified with Godbolt that the modulo and divisions are converted into branch-free bitwise operations. NOTRY=True # changing comment, tests just passed. Bug: chromium:780638 , chromium:780376 Change-Id: I415535193433a2fbc275c643fb4e4026ba3e0bdd Reviewed-on: https://webrtc-review.googlesource.com/20867 Commit-Queue: Alex Loiko <aleloi@webrtc.org> Reviewed-by: Sam Zackrisson <saza@webrtc.org> Cr-Commit-Position: refs/heads/master@{#20589} [modify] https://crrev.com/7cfbf3a0ffc888e411a677a3402961792bba92aa/modules/audio_processing/agc/legacy/digital_agc.c
,
Nov 8 2017
ClusterFuzz has detected this issue as fixed in range 514680:514707. Detailed report: https://clusterfuzz.com/testcase?key=4998361890684928 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: WebRtcAgc_ProcessVad WebRtcAgc_ProcessDigital WebRtcAgc_Process Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=513121:513142 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=514680:514707 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4998361890684928 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 8 2017
ClusterFuzz testcase 4998361890684928 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Nov 2 2017Owner: pbos@webrtc.org
Status: Assigned (was: Untriaged)