New issue
Advanced search Search tips

Issue 803078 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Jan 2018
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in WebRtcAecm_ProcessBlock

Project Member Reported by ClusterFuzz, Jan 17 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5933091108683776

Fuzzer: libFuzzer_audio_processing_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  WebRtcAecm_ProcessBlock
  WebRtcAecm_ProcessFrame
  WebRtcAecm_Process
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=529631:529648

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5933091108683776

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 17 2018

Cc: ale...@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

AEC-m and AEC-2 fuzzing. by aleloi@webrtc.org - https://webrtc.googlesource.com/src/+/ab20a6016c5d0798a00dd566c78f5f49065a9492

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 2 by bugdroid1@chromium.org, Jan 22 2018

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/736d2f7d12a0302f467ee39c558adc3c4cda64ea

commit 736d2f7d12a0302f467ee39c558adc3c4cda64ea
Author: Alex Loiko <aleloi@webrtc.org>
Date: Mon Jan 22 14:15:38 2018

Replace left shift with equivalent multiplication.

This minor issue was found by the UBSAN fuzzer.

We have used the Godbolt compiler explorer to check that similar
changes produce identical compiled code.


Bug:  chromium:803078 
Change-Id: Ib3fa38c101d7bda53d8d39062cb2c0a55144305f
Reviewed-on: https://webrtc-review.googlesource.com/42580
Reviewed-by: Sam Zackrisson <saza@webrtc.org>
Commit-Queue: Alex Loiko <aleloi@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#21713}
[modify] https://crrev.com/736d2f7d12a0302f467ee39c558adc3c4cda64ea/modules/audio_processing/aecm/aecm_core_c.cc

Project Member

Comment 3 by ClusterFuzz, Jan 23 2018

ClusterFuzz has detected this issue as fixed in range 530939:530958.

Detailed report: https://clusterfuzz.com/testcase?key=5933091108683776

Fuzzer: libFuzzer_audio_processing_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  WebRtcAecm_ProcessBlock
  WebRtcAecm_ProcessFrame
  WebRtcAecm_Process
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=529631:529648
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=530939:530958

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5933091108683776

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Jan 23 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 5933091108683776 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Jan 25 2018

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/600bdb4adc89a0f326c4d3ec37b840378e989f26

commit 600bdb4adc89a0f326c4d3ec37b840378e989f26
Author: Alex Loiko <aleloi@webrtc.org>
Date: Thu Jan 25 12:26:51 2018

Undefined shifts.

This change

* replaces a left shift with multiplication, because the shiftee can
  be negative.

* replaces a right shift (a >> b) with the expression (b >= 32 ? 0 : a >> b)
  because a is a 32-bit value, and b can be >= 32.

cppreference quote relating to the second change:
"In any case, if the value of the right operand is
negative or is greater or equal to the number of bits in the promoted
left operand, the behavior is undefined."


Bug:  chromium:805832   chromium:803078 
Change-Id: I67db0c3fedb0af197b2205d424414a84f8fde474
Reviewed-on: https://webrtc-review.googlesource.com/43761
Reviewed-by: Oskar Sundbom <ossu@webrtc.org>
Commit-Queue: Alex Loiko <aleloi@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#21760}
[modify] https://crrev.com/600bdb4adc89a0f326c4d3ec37b840378e989f26/modules/audio_processing/aecm/aecm_core.cc
[modify] https://crrev.com/600bdb4adc89a0f326c4d3ec37b840378e989f26/modules/audio_processing/aecm/aecm_core_c.cc

Sign in to add a comment