CHECK failure: type_ == AUDIO in ffmpeg_demuxer.cc |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5285590462627840 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: type_ == AUDIO in ffmpeg_demuxer.cc media::FFmpegDemuxerStream::audio_decoder_config media::FFmpegDemuxerStream::EnqueuePacket Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=459526:459578 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5285590462627840 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jan 6 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/83bbe324e42ebe5b1205d6caeb1ea4149bad31f1 (Buffer 2 seconds of data in the ffmpeg demuxer.). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Jan 8 2018
This is harmless, we'll just end up with a zero valued discard padding on a video stream (which won't even look at this data). Fix incoming though.
,
Jan 8 2018
,
Jan 8 2018
Ah, I take that back. We don't have a audio decoder config in this case, so this is a nullptr dereference in the worst case.
,
Jan 9 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e1ff77ffa122add73f2e496e817289c4ff8ee223 commit e1ff77ffa122add73f2e496e817289c4ff8ee223 Author: Dale Curtis <dalecurtis@chromium.org> Date: Tue Jan 09 02:58:35 2018 Only inspect discard padding if non-zero. We only expected discard padding to be set when audio is present, but it looks like it can be set to zero value even when audio is not present. This change avoids trying to use a non-existent audio decoder config with a zero valued discard padding and adds a clearer DCHECK in case this occurs in the future. BUG= 799689 TEST=clusterfuzz testcase passes. Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: I667c866d5877cc723610e44e736cc23f62f8ebfa Reviewed-on: https://chromium-review.googlesource.com/854621 Reviewed-by: Fredrik Hubinette <hubbe@chromium.org> Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#527880} [modify] https://crrev.com/e1ff77ffa122add73f2e496e817289c4ff8ee223/media/filters/ffmpeg_demuxer.cc
,
Jan 9 2018
ClusterFuzz has detected this issue as fixed in range 527869:527885. Detailed report: https://clusterfuzz.com/testcase?key=5285590462627840 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: type_ == AUDIO in ffmpeg_demuxer.cc media::FFmpegDemuxerStream::audio_decoder_config media::FFmpegDemuxerStream::EnqueuePacket Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=459526:459578 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=527869:527885 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5285590462627840 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 9 2018
ClusterFuzz testcase 5285590462627840 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Jan 6 2018Labels: Test-Predator-Auto-Components