Undefined-shift in WebRtcAecm_ProcessBlock |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5933091108683776 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: WebRtcAecm_ProcessBlock WebRtcAecm_ProcessFrame WebRtcAecm_Process Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=529631:529648 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5933091108683776 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jan 22 2018
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/736d2f7d12a0302f467ee39c558adc3c4cda64ea commit 736d2f7d12a0302f467ee39c558adc3c4cda64ea Author: Alex Loiko <aleloi@webrtc.org> Date: Mon Jan 22 14:15:38 2018 Replace left shift with equivalent multiplication. This minor issue was found by the UBSAN fuzzer. We have used the Godbolt compiler explorer to check that similar changes produce identical compiled code. Bug: chromium:803078 Change-Id: Ib3fa38c101d7bda53d8d39062cb2c0a55144305f Reviewed-on: https://webrtc-review.googlesource.com/42580 Reviewed-by: Sam Zackrisson <saza@webrtc.org> Commit-Queue: Alex Loiko <aleloi@webrtc.org> Cr-Commit-Position: refs/heads/master@{#21713} [modify] https://crrev.com/736d2f7d12a0302f467ee39c558adc3c4cda64ea/modules/audio_processing/aecm/aecm_core_c.cc
,
Jan 23 2018
ClusterFuzz has detected this issue as fixed in range 530939:530958. Detailed report: https://clusterfuzz.com/testcase?key=5933091108683776 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: WebRtcAecm_ProcessBlock WebRtcAecm_ProcessFrame WebRtcAecm_Process Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=529631:529648 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=530939:530958 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5933091108683776 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 23 2018
ClusterFuzz testcase 5933091108683776 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jan 25 2018
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/600bdb4adc89a0f326c4d3ec37b840378e989f26 commit 600bdb4adc89a0f326c4d3ec37b840378e989f26 Author: Alex Loiko <aleloi@webrtc.org> Date: Thu Jan 25 12:26:51 2018 Undefined shifts. This change * replaces a left shift with multiplication, because the shiftee can be negative. * replaces a right shift (a >> b) with the expression (b >= 32 ? 0 : a >> b) because a is a 32-bit value, and b can be >= 32. cppreference quote relating to the second change: "In any case, if the value of the right operand is negative or is greater or equal to the number of bits in the promoted left operand, the behavior is undefined." Bug: chromium:805832 chromium:803078 Change-Id: I67db0c3fedb0af197b2205d424414a84f8fde474 Reviewed-on: https://webrtc-review.googlesource.com/43761 Reviewed-by: Oskar Sundbom <ossu@webrtc.org> Commit-Queue: Alex Loiko <aleloi@webrtc.org> Cr-Commit-Position: refs/heads/master@{#21760} [modify] https://crrev.com/600bdb4adc89a0f326c4d3ec37b840378e989f26/modules/audio_processing/aecm/aecm_core.cc [modify] https://crrev.com/600bdb4adc89a0f326c4d3ec37b840378e989f26/modules/audio_processing/aecm/aecm_core_c.cc |
||
►
Sign in to add a comment |
||
Comment 1 by ClusterFuzz
, Jan 17 2018Labels: Test-Predator-Auto-CC