New issue
Advanced search Search tips

Issue 806122 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security

Blocking:
issue 777484



Sign in to add a comment

Crash in get_chroma_qp

Project Member Reported by ClusterFuzz, Jan 26 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5103307656527872

Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7faec6422a04
Crash State:
  get_chroma_qp
  loop_filter
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497191

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5103307656527872

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 26 2018

Components: Internals>Media>FFmpeg
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Jan 26 2018

Labels: M-64
Project Member

Comment 3 by sheriffbot@chromium.org, Jan 26 2018

Labels: Pri-1

Comment 4 by mea...@chromium.org, Jan 29 2018

Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
dalecurtis: Can you PTAL? Thanks.
Blocking: 777484
Cc: dalecur...@chromium.org
Owner: xhw...@chromium.org
Note this is an M64 crash so we'll need a backport if latest roll fixes this.
Status: Started (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Feb 13 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/58a80d15568fa98c07bd5e89ab8afcb018291c58

commit 58a80d15568fa98c07bd5e89ab8afcb018291c58
Author: Xiaohan Wang <xhwang@chromium.org>
Date: Tue Feb 13 21:46:29 2018

ffmpeg: Set valid qscale value in ff_h264_decode_mb_cavlc()

When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.

BUG= 806122 

Change-Id: Icd00cd6fddb443559706b8bd6d4bde763b032519
Reviewed-on: https://chromium-review.googlesource.com/900465
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>

[modify] https://crrev.com/58a80d15568fa98c07bd5e89ab8afcb018291c58/libavcodec/h264_cavlc.c
[modify] https://crrev.com/58a80d15568fa98c07bd5e89ab8afcb018291c58/chromium/patches/README

Project Member

Comment 9 by bugdroid1@chromium.org, Feb 14 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/16f39edca89c5cfc5930f06f81f09491f69829d7

commit 16f39edca89c5cfc5930f06f81f09491f69829d7
Author: Xiaohan Wang <xhwang@chromium.org>
Date: Wed Feb 14 01:05:38 2018

Roll src/third_party/ffmpeg/ f5964c36e..58a80d155 (2 commits)

https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/f5964c36e1dc..58a80d15568f

$ git log f5964c36e..58a80d155 --date=short --no-merges --format='%ad %ae %s'
2018-02-13 xhwang ffmpeg: Set valid qscale value in ff_h264_decode_mb_cavlc()
2018-02-09 xhwang ffmpeg: Fix ctts_index calculation

Created with:
  roll-dep src/third_party/ffmpeg

BUG= 806122 , 804097 , 804606 

Change-Id: I1dfb85059290569fcde7a5e90e7802c7e5a0bf64
Reviewed-on: https://chromium-review.googlesource.com/917199
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: Xiaohan Wang <xhwang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#536581}
[modify] https://crrev.com/16f39edca89c5cfc5930f06f81f09491f69829d7/DEPS

Project Member

Comment 10 by ClusterFuzz, Feb 14 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6325818891698176 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 11 by ClusterFuzz, Feb 14 2018

ClusterFuzz has detected this issue as fixed in range 536580:536620.

Detailed report: https://clusterfuzz.com/testcase?key=5103307656527872

Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7faec6422a04
Crash State:
  get_chroma_qp
  loop_filter
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497191
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=536580:536620

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5103307656527872

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by sheriffbot@chromium.org, Feb 14 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Status: Started (was: Verified)
I don't feel we want to merge this to M64, which is already kinda late. But we can try to merge this in M65.
xhwang@ - will this patch (#8) remain downstream-only or is it being upstreamed to ffmpeg?
All my CLs have been sent upstream and will be applied at some point, hopefully before M67 roll. Please look for them and update README accordingly. Thanks!
Labels: Merge-Request-65
Status: Verified (was: Started)
Request to merge to M65. I don't feel we want to touch M64 at this point.
Project Member

Comment 17 by sheriffbot@chromium.org, Feb 16 2018

Labels: -Merge-Request-65 Merge-Review-65 Hotlist-Merge-Review
This bug requires manual review: DEPS changes referenced in bugdroid comments.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: awhalley@chromium.org
+ awhalley@ for M65 merge review.
Labels: -Hotlist-Merge-Review -M-64 -Merge-Review-65 M-65
Tracking ffmpeg roll in  issue 804097 
Project Member

Comment 20 by bugdroid1@chromium.org, Feb 20 2018

The following revision refers to this bug:
  https://chrome-internal.googlesource.com/chrome/tools/buildspec/+/adbd83a88ab3aaf9aeb72cfc0b7e2c7e37922f40

commit adbd83a88ab3aaf9aeb72cfc0b7e2c7e37922f40
Author: Xiaohan Wang <xhwang@chromium.org>
Date: Tue Feb 20 19:43:51 2018

Comment 21 Deleted

For the record, the merge to M65 in #20 is covered by the merge approval in   issue 804097 .
Labels: Release-0-M65
Project Member

Comment 24 by sheriffbot@chromium.org, May 26 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment