Direct-leak in av_malloc |
|||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5959518698340352 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: av_malloc ff_mov_read_stsd_entries mov_read_stsd Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=529000:529009 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5959518698340352 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Mar 16 2018
Automatically adding ccs based on suspected regression changelists: lavf/mov: add some useful warning log of eof by tiejun.peng@foxmail.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/ab651587a715dc59775650a4c8af3cddcdfd26f8 avutil: add alignment needed for AVX-512 by jdarnley@obe.tv - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/e2218ed8ce6e2f208b9279acc80b7e2b7f1eae6c If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Mar 16 2018
,
Mar 19 2018
,
Mar 19 2018
I have a local repro with current upstream ffplay. I'll send the case upstream shortly to get fixed.
,
Mar 19 2018
async: protocol is necessary to obtain the same error on upstream ffplay_g, with ASAN_OPTIONS. I've also confirmed local repro w/debug asan media_pipeline_integration_fuzzer I've sent the case upstream to Michael today.
,
Apr 9 2018
Confirmed continued local repro. Potential fix is in review since last Friday with Micheal upstream (I LGTM'ed it today).
,
Apr 12 2018
,
Apr 12 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/c6aed052aba910a88d6e68c02946d17f94702da5 commit c6aed052aba910a88d6e68c02946d17f94702da5 Author: Matt Wolenetz <wolenetz@chromium.org> Date: Thu Apr 12 22:16:45 2018 lavf/mov and lavc/h264_slice cherry-picks Two cherry-picks: avformat/mov: Fix extradata memleak Fixes: crbug 822705 Reported-by: Matt Wolenetz <wolenetz@google.com> Reviewed-by: Matt Wolenetz <wolenetz@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 0a8133119ca5d087c7c7140d100406ff84c477ee) avcodec/h264_slice: Fix integer overflow with last_poc Fixes: signed integer overflow: 2147483646 - -2816 cannot be represented in type 'int' Fixes: crbug 823145 Reported-by: Matt Wolenetz <wolenetz@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 8c02cd8ca097871dcd00cf8e08ce51660873f405) BUG=822705,823145 R=xhwang@chromium.org Change-Id: I965760d7cdc3cb214e70bef66ce5896d6acca4ac Reviewed-on: https://chromium-review.googlesource.com/1011382 Reviewed-by: Xiaohan Wang <xhwang@chromium.org> [modify] https://crrev.com/c6aed052aba910a88d6e68c02946d17f94702da5/libavcodec/h264_slice.c [modify] https://crrev.com/c6aed052aba910a88d6e68c02946d17f94702da5/libavformat/mov.c
,
Apr 13 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d commit c13b8c3fe0f2af202dc6c813cbe81f415147bf1d Author: Matt Wolenetz <wolenetz@chromium.org> Date: Fri Apr 13 01:04:22 2018 Roll src/third_party/ffmpeg/ 5af686b3c..c6aed052a (1 commit) https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/5af686b3cfa2..c6aed052aba9 $ git log 5af686b3c..c6aed052a --date=short --no-merges --format='%ad %ae %s' 2018-04-12 wolenetz lavf/mov and lavc/h264_slice cherry-picks Created with: roll-dep src/third_party/ffmpeg BUG=823145,822705 TBR=xhwang@chromium.org Change-Id: I05c5b0c781157a67454e8d624f68ad8adcc00136 Reviewed-on: https://chromium-review.googlesource.com/1011397 Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org> Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org> Cr-Commit-Position: refs/heads/master@{#550451} [modify] https://crrev.com/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d/DEPS
,
Apr 13 2018
ClusterFuzz has detected this issue as fixed in range 550450:550451. Detailed report: https://clusterfuzz.com/testcase?key=5959518698340352 Fuzzer: libFuzzer_media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: av_malloc ff_mov_read_stsd_entries mov_read_stsd Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=529000:529009 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=550450:550451 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5959518698340352 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 13 2018
ClusterFuzz testcase 5959518698340352 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Apr 17 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d commit c13b8c3fe0f2af202dc6c813cbe81f415147bf1d Author: Matt Wolenetz <wolenetz@chromium.org> Date: Fri Apr 13 01:04:22 2018 Roll src/third_party/ffmpeg/ 5af686b3c..c6aed052a (1 commit) https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/5af686b3cfa2..c6aed052aba9 $ git log 5af686b3c..c6aed052a --date=short --no-merges --format='%ad %ae %s' 2018-04-12 wolenetz lavf/mov and lavc/h264_slice cherry-picks Created with: roll-dep src/third_party/ffmpeg BUG=823145,822705 TBR=xhwang@chromium.org Change-Id: I05c5b0c781157a67454e8d624f68ad8adcc00136 Reviewed-on: https://chromium-review.googlesource.com/1011397 Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org> Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org> Cr-Commit-Position: refs/heads/master@{#550451} [modify] https://crrev.com/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d/DEPS
,
Apr 24 2018
#10 fixed the issue in trunk, but just missed the M67 branch cut. --> liberato@, please check if either of the issues rolled in #10 (bug 823145 and bug 822705) meet the release managers' bar for merge-to-M67 and do the merge (buildspec change) if approved. |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by ClusterFuzz
, Mar 16 2018Labels: Test-Predator-Auto-Components