Data race in ff_init_mpadsp_tabs_fixed |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6079107329949696 Fuzzer: attekett_dom_fuzzer Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 4 Crash Address: 0x7fab6f86e3a0 Crash State: ff_init_mpadsp_tabs_fixed ff_mpadsp_init decode_init Sanitizer: thread (TSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6079107329949696 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 13 2017
Unable to provide possible suspect using Predator, CL and Code Search. Could someone please look into the issue. Thank You...
,
Nov 13 2017
,
Nov 13 2017
,
Nov 17 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/cc413498fb0c4fde931304c4327cf06aa7c4777f commit cc413498fb0c4fde931304c4327cf06aa7c4777f Author: Dale Curtis <dalecurtis@chromium.org> Date: Fri Nov 17 23:31:28 2017 Use ff_thread_once for fixed, float table init. These tables are static so they should only be initialized once instead of on every call to ff_mpadsp_init(). BUG= 784159 Signed-off-by: Dale Curtis <dalecurtis@chromium.org> Change-Id: I5c8088fa9cb967d6ad6f99996e0bf6ab8fc9c587 Reviewed-on: https://chromium-review.googlesource.com/777616 Reviewed-by: Dan Sanders <sandersd@chromium.org> [modify] https://crrev.com/cc413498fb0c4fde931304c4327cf06aa7c4777f/libavcodec/mpegaudiodsp.c [modify] https://crrev.com/cc413498fb0c4fde931304c4327cf06aa7c4777f/chromium/patches/README
,
Nov 18 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/aea3d2d4d8d304df1a029ef83d248508073bd066 commit aea3d2d4d8d304df1a029ef83d248508073bd066 Author: Dale Curtis <dalecurtis@chromium.org> Date: Sat Nov 18 06:56:26 2017 Roll ffmpeg DEPS and fix additional ubsan issues. This change enables AV_EF_EXPLODE such that all serious errors encountered during demuxing are fatal. Previously ffmpeg would try to ignore these in some cases; leading to ubsan or other issues. Specifically crbug.com/698524 and crbug.com/710791 . Due to the removal of the speex parser from ogg, there is one test that needs updating with the roll too. https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/1e816bccb5ff..252244150ad7 $ git log 1e816bccb..252244150 --date=short --no-merges --format='%ad %ae %s' 2017-11-17 dalecurtis [mpeg4video] Fix undefined shift on assumed 8-bit input. 2017-11-17 dalecurtis Disable unused ogg codec parsers; they have bugs we don't care about. 2017-11-17 dalecurtis Use ff_thread_once for fixed, float table init. 2017-11-17 dalecurtis Fixup some patches messages. 2017-11-17 dalecurtis [mov] Fix leak of frame_duration_buffer in mov_fix_index(). 2017-11-17 dalecurtis Prevent undefined shift with wrap_bits >= 63. 2017-11-15 hubbe avformat/mov: Check size of STSC allocation 2017-11-17 jstebbins [PATCH] lavf/mov: don't read outside frag_index bounds Created with: roll-dep src/third_party/ffmpeg BUG= 786269 , 782074 , 783459 , 784159 , 654612 , 779924 , 710791 , 698524 TEST=security test cases no longer fail. Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: Ibbf3c32080705d6484682351a351663c51a7f752 Reviewed-on: https://chromium-review.googlesource.com/777408 Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Reviewed-by: Dan Sanders <sandersd@chromium.org> Cr-Commit-Position: refs/heads/master@{#517709} [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/DEPS [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/media/filters/ffmpeg_demuxer_unittest.cc [modify] https://crrev.com/aea3d2d4d8d304df1a029ef83d248508073bd066/media/filters/ffmpeg_glue.cc
,
Nov 19 2017
ClusterFuzz has detected this issue as fixed in range 517698:517712. Detailed report: https://clusterfuzz.com/testcase?key=6079107329949696 Fuzzer: attekett_dom_fuzzer Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 4 Crash Address: 0x7fab6f86e3a0 Crash State: ff_init_mpadsp_tabs_fixed ff_mpadsp_init decode_init Sanitizer: thread (TSAN) Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=517698:517712 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6079107329949696 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 19 2017
ClusterFuzz testcase 6079107329949696 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by dtapu...@chromium.org
, Nov 12 2017