Issue metadata
Sign in to add a comment
|
Crash in get_chroma_qp |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5103307656527872 Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7faec6422a04 Crash State: get_chroma_qp loop_filter Sanitizer: address (ASAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497191 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5103307656527872 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jan 26 2018
,
Jan 26 2018
,
Jan 29 2018
dalecurtis: Can you PTAL? Thanks.
,
Jan 29 2018
,
Jan 29 2018
Note this is an M64 crash so we'll need a backport if latest roll fixes this.
,
Feb 5 2018
,
Feb 13 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/58a80d15568fa98c07bd5e89ab8afcb018291c58 commit 58a80d15568fa98c07bd5e89ab8afcb018291c58 Author: Xiaohan Wang <xhwang@chromium.org> Date: Tue Feb 13 21:46:29 2018 ffmpeg: Set valid qscale value in ff_h264_decode_mb_cavlc() When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values, e.g. dquant out of range, set the qscale to be a valid value before returning -1 and exiting the function. The qscale value can be used later e.g. in loop filter. BUG= 806122 Change-Id: Icd00cd6fddb443559706b8bd6d4bde763b032519 Reviewed-on: https://chromium-review.googlesource.com/900465 Reviewed-by: Dale Curtis <dalecurtis@chromium.org> [modify] https://crrev.com/58a80d15568fa98c07bd5e89ab8afcb018291c58/libavcodec/h264_cavlc.c [modify] https://crrev.com/58a80d15568fa98c07bd5e89ab8afcb018291c58/chromium/patches/README
,
Feb 14 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/16f39edca89c5cfc5930f06f81f09491f69829d7 commit 16f39edca89c5cfc5930f06f81f09491f69829d7 Author: Xiaohan Wang <xhwang@chromium.org> Date: Wed Feb 14 01:05:38 2018 Roll src/third_party/ffmpeg/ f5964c36e..58a80d155 (2 commits) https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/f5964c36e1dc..58a80d15568f $ git log f5964c36e..58a80d155 --date=short --no-merges --format='%ad %ae %s' 2018-02-13 xhwang ffmpeg: Set valid qscale value in ff_h264_decode_mb_cavlc() 2018-02-09 xhwang ffmpeg: Fix ctts_index calculation Created with: roll-dep src/third_party/ffmpeg BUG= 806122 , 804097 , 804606 Change-Id: I1dfb85059290569fcde7a5e90e7802c7e5a0bf64 Reviewed-on: https://chromium-review.googlesource.com/917199 Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Xiaohan Wang <xhwang@chromium.org> Cr-Commit-Position: refs/heads/master@{#536581} [modify] https://crrev.com/16f39edca89c5cfc5930f06f81f09491f69829d7/DEPS
,
Feb 14 2018
ClusterFuzz testcase 6325818891698176 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Feb 14 2018
ClusterFuzz has detected this issue as fixed in range 536580:536620. Detailed report: https://clusterfuzz.com/testcase?key=5103307656527872 Fuzzer: libFuzzer_mediasource_MP4_AVC1_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7faec6422a04 Crash State: get_chroma_qp loop_filter Sanitizer: address (ASAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497063:497191 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=536580:536620 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5103307656527872 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Feb 14 2018
,
Feb 14 2018
I don't feel we want to merge this to M64, which is already kinda late. But we can try to merge this in M65.
,
Feb 14 2018
xhwang@ - will this patch (#8) remain downstream-only or is it being upstreamed to ffmpeg?
,
Feb 14 2018
All my CLs have been sent upstream and will be applied at some point, hopefully before M67 roll. Please look for them and update README accordingly. Thanks!
,
Feb 16 2018
Request to merge to M65. I don't feel we want to touch M64 at this point.
,
Feb 16 2018
This bug requires manual review: DEPS changes referenced in bugdroid comments. Please contact the milestone owner if you have questions. Owners: cmasso@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Feb 16 2018
+ awhalley@ for M65 merge review.
,
Feb 20 2018
,
Feb 20 2018
The following revision refers to this bug: https://chrome-internal.googlesource.com/chrome/tools/buildspec/+/adbd83a88ab3aaf9aeb72cfc0b7e2c7e37922f40 commit adbd83a88ab3aaf9aeb72cfc0b7e2c7e37922f40 Author: Xiaohan Wang <xhwang@chromium.org> Date: Tue Feb 20 19:43:51 2018
,
Feb 20 2018
For the record, the merge to M65 in #20 is covered by the merge approval in issue 804097 .
,
Mar 6 2018
,
May 26 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Jan 26 2018Labels: Test-Predator-Auto-Components