New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 813328 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Out-of-memory in sdp_parser_fuzzer

Project Member Reported by ClusterFuzz, Feb 17 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6568212653932544

Fuzzer: libFuzzer_sdp_parser_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  sdp_parser_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=419171:419261

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6568212653932544

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: phoglund@chromium.org brajkumar@chromium.org
Components: Blink>WebRTC
Labels: -Pri-1 M-65 Test-Predator-Wrong CF-NeedsTriage Pri-2
Predator could not provide any possible suspects.

From the below CL observing some changes related to 'sdp_parser_fuzzer' might caused this issue
https://chromium.googlesource.com/chromium/src/+log/d4d44f9ccbce0cd089a3066c438952863921cd40..445bc6ed815628dcff5231d1c8f11135c589edf1?pretty=fuller&n=10000

Suspect CL: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/cf41f6ff74abab7a7847d582806c759ce8dd785a

phoglund@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

Comment 2 by guidou@chromium.org, Feb 19 2018

Components: -Blink>WebRTC Blink>WebRTC>Network
Ha, yeah it sure caused it, in a sense, since it's the CL that enabled the fuzzer like two years ago :)

There is probably no culprit here, it probably just grew in mem usage over time or something. I'll leave it to the component triager to triage this.
Project Member

Comment 4 by ClusterFuzz, Feb 26 2018

Labels: OS-Mac
Ping for triaging.
Ping.
Status: WontFix (was: Untriaged)
It looks like the problematic SDP here is just an "a=ice-options:            " with lots of spaces (hundreds of thousands), causing "rtc::split" to make hundreds of thousands of substrings.

Closing this as WontFix, since it's expected that large SDP strings could take a lot of memory to store in parsed form; it's just something that should never happen with real SDP.

phoglund@: is there a way to limit the max input size of a fuzzer? Or is that something we should implement in the fuzzer itself "if (size > kMaxSize) return;", expecting the fuzzer to learn the limitation?
Owner: phoglund@chromium.org
Status: Assigned (was: WontFix)
Yes, as it turns out. Send you a CL: https://webrtc-review.googlesource.com/c/src/+/78280
Project Member

Comment 9 by bugdroid1@chromium.org, May 23 2018

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/547e3169d9e059117de6a22f34c6e959707598e7

commit 547e3169d9e059117de6a22f34c6e959707598e7
Author: Patrik Höglund <phoglund@webrtc.org>
Date: Wed May 23 10:33:40 2018

Limit input length for SDP fuzzer.

This limits the SDP to 16KB, which sounds enough.

Bug:  chromium:813328 
Change-Id: I58c7b3e073108fd7b3495e8182b5c632e9619fe7
Reviewed-on: https://webrtc-review.googlesource.com/78280
Reviewed-by: Taylor Brandstetter <deadbeef@webrtc.org>
Commit-Queue: Patrik Höglund <phoglund@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23360}
[modify] https://crrev.com/547e3169d9e059117de6a22f34c6e959707598e7/test/fuzzers/BUILD.gn

Project Member

Comment 10 by bugdroid1@chromium.org, May 23 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/349158ec7d7da1de29628c682e1b26a476e6381d

commit 349158ec7d7da1de29628c682e1b26a476e6381d
Author: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed May 23 15:38:33 2018

Roll src/third_party/webrtc/ a832019f4..547e3169d (45 commits)

https://webrtc.googlesource.com/src.git/+log/a832019f4e3a..547e3169d9e0

$ git log a832019f4..547e3169d --date=short --no-merges --format='%ad %ae %s'

Created with:
  roll-dep src/third_party/webrtc
BUG= chromium:813328 , chromium:845135 ,chromium:none,chromium:841962,chromium:888042,chromium:None,chromium:845158,chromium:None,chromium:None


The AutoRoll server is located here: https://webrtc-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_archive_rel_ng;master.tryserver.chromium.mac:mac_chromium_archive_rel_ng
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I1d118a77cf2b61247d8720d3c9b93091416454a9
Reviewed-on: https://chromium-review.googlesource.com/1070209
Reviewed-by: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#561102}
[modify] https://crrev.com/349158ec7d7da1de29628c682e1b26a476e6381d/DEPS

Status: Fixed (was: Assigned)
Project Member

Comment 12 by ClusterFuzz, Jun 5 2018

Labels: Needs-Feedback
ClusterFuzz testcase 6568212653932544 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
Cc: infe...@chromium.org
I don't understand. I added 

libfuzzer_options = [ "max_len=16384" ]

which I thought meant "don't feed more than 16K of input into the fuzzer". Why is it still failing?

Sign in to add a comment