New issue
Advanced search Search tips

Issue 786719 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug

Blocking:
issue 777555



Sign in to add a comment

Direct-leak in ogg_new_stream

Project Member Reported by ClusterFuzz, Nov 18 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4952150794043392

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  ogg_new_stream
  ogg_read_page
  ogg_packet
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=517706:517712

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4952150794043392

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 18 2017

Labels: Test-Predator-Auto-Owner
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/aea3d2d4d8d304df1a029ef83d248508073bd066 (Roll ffmpeg DEPS and fix additional ubsan issues.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 2 by bugdroid1@chromium.org, Nov 20 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/f8e1db47e2817ff9390315711aba7caaf7eb327e

commit f8e1db47e2817ff9390315711aba7caaf7eb327e
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Mon Nov 20 20:12:13 2017

[ogg] Close ogg stream upon error when using AV_EF_EXPLODE.

Without this there can be multiple memory leaks.

BUG= 786719 , 786813 
TEST=no more leaks

Change-Id: I097d6c257718651b15b5a7c8d320e67566ffa22b
Reviewed-on: https://chromium-review.googlesource.com/779630
Reviewed-by: Dan Sanders <sandersd@chromium.org>

[modify] https://crrev.com/f8e1db47e2817ff9390315711aba7caaf7eb327e/libavformat/oggdec.c
[modify] https://crrev.com/f8e1db47e2817ff9390315711aba7caaf7eb327e/chromium/patches/README

Blocking: 777555
Components: Internals>Media>FFmpeg
Project Member

Comment 4 by bugdroid1@chromium.org, Nov 21 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fae89392a66bb069f3a17fce3af517838ffb9257

commit fae89392a66bb069f3a17fce3af517838ffb9257
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Tue Nov 21 01:35:05 2017

Roll src/third_party/ffmpeg/ 252244150..168dfaa19b (3 commits)

https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/252244150ad7..168dfaa19b

$ git log 252244150..168dfaa19b --date=short --no-merges --format='%ad %ae %s'

2017-11-20 dalecurtis Don't try to set HAVE_EBP_AVAILABLE except on posix x86.
2017-11-20 dalecurtis [ogg] Close ogg stream upon error when using AV_EF_EXPLODE.
2017-11-20 dalecurtis Fix sanitizer builds on ia32.

Created with:
  roll-dep src/third_party/ffmpeg

BUG=786760, 786813 , 786719 
TEST=no more leaks, ia32 asan compiles
TBR=chcunningham,sandersd

Change-Id: I01ff7d44fa0dacfd8d849a2791058286c25f9dc2
Reviewed-on: https://chromium-review.googlesource.com/779981
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Dan Sanders <sandersd@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#518038}
[modify] https://crrev.com/fae89392a66bb069f3a17fce3af517838ffb9257/DEPS

Status: Fixed (was: Assigned)
Project Member

Comment 6 by ClusterFuzz, Nov 21 2017

ClusterFuzz has detected this issue as fixed in range 518006:518061.

Detailed report: https://clusterfuzz.com/testcase?key=4952150794043392

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  ogg_new_stream
  ogg_read_page
  ogg_packet
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=517706:517712
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=518006:518061

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4952150794043392

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Nov 21 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4952150794043392 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment