New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 799689 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: type_ == AUDIO in ffmpeg_demuxer.cc

Project Member Reported by ClusterFuzz, Jan 6 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5285590462627840

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  type_ == AUDIO in ffmpeg_demuxer.cc
  media::FFmpegDemuxerStream::audio_decoder_config
  media::FFmpegDemuxerStream::EnqueuePacket
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=459526:459578

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5285590462627840

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 6 2018

Components: Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 6 2018

Labels: Test-Predator-Auto-Owner
Owner: hubbe@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/83bbe324e42ebe5b1205d6caeb1ea4149bad31f1 (Buffer 2 seconds of data in the ffmpeg demuxer.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Cc: hubbe@chromium.org
Owner: dalecur...@chromium.org
This is harmless, we'll just end up with a zero valued discard padding on a video stream (which won't even look at this data). Fix incoming though.
Cc: brajkumar@chromium.org dalecur...@chromium.org
 Issue 799544  has been merged into this issue.
Ah, I take that back. We don't have a audio decoder config in this case, so this is a nullptr dereference in the worst case.
Project Member

Comment 6 by bugdroid1@chromium.org, Jan 9 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e1ff77ffa122add73f2e496e817289c4ff8ee223

commit e1ff77ffa122add73f2e496e817289c4ff8ee223
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Tue Jan 09 02:58:35 2018

Only inspect discard padding if non-zero.

We only expected discard padding to be set when audio is present,
but it looks like it can be set to zero value even when audio is
not present. This change avoids trying to use a non-existent
audio decoder config with a zero valued discard padding and adds
a clearer DCHECK in case this occurs in the future.

BUG= 799689 
TEST=clusterfuzz testcase passes.

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: I667c866d5877cc723610e44e736cc23f62f8ebfa
Reviewed-on: https://chromium-review.googlesource.com/854621
Reviewed-by: Fredrik Hubinette <hubbe@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#527880}
[modify] https://crrev.com/e1ff77ffa122add73f2e496e817289c4ff8ee223/media/filters/ffmpeg_demuxer.cc

Project Member

Comment 7 by ClusterFuzz, Jan 9 2018

ClusterFuzz has detected this issue as fixed in range 527869:527885.

Detailed report: https://clusterfuzz.com/testcase?key=5285590462627840

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  type_ == AUDIO in ffmpeg_demuxer.cc
  media::FFmpegDemuxerStream::audio_decoder_config
  media::FFmpegDemuxerStream::EnqueuePacket
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=459526:459578
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=527869:527885

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5285590462627840

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jan 9 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5285590462627840 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment