Direct-leak in av_malloc |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6391647201132544 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: av_malloc ff_mov_read_stsd_entries mov_read_stsd Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=433064:433298 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6391647201132544 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 20 2017
CL tagged in Issue 786803 is Mac-only and has nothing to do with ffmpeg. Unfortunately I'm not familiar with ffmpeg and can't really help here.
,
Nov 21 2017
Predator has provided 9 possible suspects avformat/mov: Do not allocate empty extradata by michael@niedermayer.cc *Suspected changelist touched the crashing line in mov.c *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. mov: move stsd finalization to an appropriate place by h.leppkes@gmail.com *Suspected changelist touched the crashing line in mov.c *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. mov: Implement support for multiple sample description tables by vittorio.giovara@gmail.com *Suspected changelist touched the crashing line in mov.c *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. avformat/mov: Check STSD atom more completely by michael@niedermayer.cc *Suspected changelist touched the crashing line in mov.c *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. lavf/mov: improve `tref/chap` chapter handling by rodger.combs@gmail.com *Suspected changelist touched the crashing line in mov.c *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. avformat/mov: parse rtmd track timecode by onemda@gmail.com *Suspected changelist touched line(s) near the crashing line in mov.c (1 line away) *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. avutil/mem: fix memleak by wantlamy@gmail.com *Suspected changelist touched line(s) near the crashing line in mem.c (62 lines away) *Suspected changelist touched file(s) in the directory libavutil, which appears in the stack trace. *Suspected changelist touched file mem.c, which appears in the stack trace. mov: Fix the format specifier type for size by vittorio.giovara@gmail.com *Suspected changelist touched line(s) near the crashing line in mov.c (51 lines away) *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. mov: Use the correct type for size by lu_zero@gentoo.org *Suspected changelist touched line(s) near the crashing line in mov.c (60 lines away) *Suspected changelist touched file(s) in the directory libavformat, which appears in the stack trace. *Suspected changelist touched file mov.c, which appears in the stack trace. Since the suspected owners are not from chromium, hence adding CF-NeedsTriage label for further triage from FFMEG team
,
Nov 21 2017
,
Nov 22 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7f1b654208478be9851c8b2a2ee2591d88d3b99c commit 7f1b654208478be9851c8b2a2ee2591d88d3b99c Author: Dale Curtis <dalecurtis@chromium.org> Date: Wed Nov 22 03:24:28 2017 Roll src/third_party/ffmpeg/ 168dfaa19..abead8cbc (6 commits) https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/168dfaa19bfd..abead8cbcf89 $ git log 168dfaa19..abead8cbc --date=short --no-merges --format='%ad %ae %s' 2017-11-21 dalecurtis [vorbis] 1 << 31 > int32_t::max(), so use 1u << 31 instead. 2017-11-21 dalecurtis [mov] Increment stsd_count while processing stsd data; avoids leaks. 2017-11-21 dalecurtis Update wrap_bits fix to work with wrap_bits == 63,64. 2017-11-21 dalecurtis Free extradata before reallocating. 2017-11-21 dalecurtis Add mips64el build files based. 2017-11-21 milko.leporis [MIPS] Put mips64el Linux configuration options BUG= 787347 , 786803 , 786808 , 783459 TEST=test cases no longer fail. TBR=tguilbert Created with: roll-dep src/third_party/ffmpeg Change-Id: I20b262e221d31a6449b9de966d312e14df67b6b9 Reviewed-on: https://chromium-review.googlesource.com/784104 Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Reviewed-by: Thomas Guilbert <tguilbert@chromium.org> Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#518523} [modify] https://crrev.com/7f1b654208478be9851c8b2a2ee2591d88d3b99c/DEPS
,
Nov 22 2017
ClusterFuzz has detected this issue as fixed in range 518505:518524. Detailed report: https://clusterfuzz.com/testcase?key=6391647201132544 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: av_malloc ff_mov_read_stsd_entries mov_read_stsd Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=433064:433298 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=518505:518524 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6391647201132544 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2017
ClusterFuzz testcase 6391647201132544 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by kkaluri@chromium.org
, Nov 20 2017Components: Internals>Media>FFmpeg
Labels: M-63
Owner: olka@chromium.org
Status: Assigned (was: Untriaged)