New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 822705 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug

Blocking:
issue 803898



Sign in to add a comment

Direct-leak in av_malloc

Project Member Reported by ClusterFuzz, Mar 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5959518698340352

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  av_malloc
  ff_mov_read_stsd_entries
  mov_read_stsd
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=529000:529009

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5959518698340352

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 16 2018

Components: Internals>Media>FFmpeg
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 16 2018

Cc: jdarn...@obe.tv tiejun.p...@foxmail.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

lavf/mov: add some useful warning log of eof by tiejun.peng@foxmail.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/ab651587a715dc59775650a4c8af3cddcdfd26f8

avutil: add alignment needed for AVX-512 by jdarnley@obe.tv - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/e2218ed8ce6e2f208b9279acc80b7e2b7f1eae6c

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Owner: wolenetz@chromium.org
Status: Assigned (was: Untriaged)
Blocking: 803898
Status: Started (was: Assigned)
I have a local repro with current upstream ffplay. I'll send the case upstream shortly to get fixed.
async: protocol is necessary to obtain the same error on upstream ffplay_g, with ASAN_OPTIONS.

I've also confirmed local repro w/debug asan media_pipeline_integration_fuzzer

I've sent the case upstream to Michael today.
Confirmed continued local repro.
Potential fix is in review since last Friday with Micheal upstream (I LGTM'ed it today).
Labels: M-67
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 12 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/c6aed052aba910a88d6e68c02946d17f94702da5

commit c6aed052aba910a88d6e68c02946d17f94702da5
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Thu Apr 12 22:16:45 2018

lavf/mov and lavc/h264_slice cherry-picks

Two cherry-picks:

avformat/mov: Fix extradata memleak

Fixes: crbug 822705

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a8133119ca5d087c7c7140d100406ff84c477ee)

avcodec/h264_slice: Fix integer overflow with last_poc

Fixes: signed integer overflow: 2147483646 - -2816 cannot be represented in type 'int'
Fixes: crbug 823145

Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c02cd8ca097871dcd00cf8e08ce51660873f405)

BUG=822705,823145
R=xhwang@chromium.org

Change-Id: I965760d7cdc3cb214e70bef66ce5896d6acca4ac
Reviewed-on: https://chromium-review.googlesource.com/1011382
Reviewed-by: Xiaohan Wang <xhwang@chromium.org>

[modify] https://crrev.com/c6aed052aba910a88d6e68c02946d17f94702da5/libavcodec/h264_slice.c
[modify] https://crrev.com/c6aed052aba910a88d6e68c02946d17f94702da5/libavformat/mov.c

Project Member

Comment 10 by bugdroid1@chromium.org, Apr 13 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d

commit c13b8c3fe0f2af202dc6c813cbe81f415147bf1d
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Fri Apr 13 01:04:22 2018

Roll src/third_party/ffmpeg/ 5af686b3c..c6aed052a (1 commit)

https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/5af686b3cfa2..c6aed052aba9

$ git log 5af686b3c..c6aed052a --date=short --no-merges --format='%ad %ae %s'
2018-04-12 wolenetz lavf/mov and lavc/h264_slice cherry-picks

Created with:
  roll-dep src/third_party/ffmpeg

BUG=823145,822705
TBR=xhwang@chromium.org

Change-Id: I05c5b0c781157a67454e8d624f68ad8adcc00136
Reviewed-on: https://chromium-review.googlesource.com/1011397
Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550451}
[modify] https://crrev.com/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d/DEPS

Project Member

Comment 11 by ClusterFuzz, Apr 13 2018

ClusterFuzz has detected this issue as fixed in range 550450:550451.

Detailed report: https://clusterfuzz.com/testcase?key=5959518698340352

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  av_malloc
  ff_mov_read_stsd_entries
  mov_read_stsd
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=529000:529009
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=550450:550451

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5959518698340352

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Apr 13 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5959518698340352 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 13 by bugdroid1@chromium.org, Apr 17 2018

Labels: merge-merged-testbranch
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d

commit c13b8c3fe0f2af202dc6c813cbe81f415147bf1d
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Fri Apr 13 01:04:22 2018

Roll src/third_party/ffmpeg/ 5af686b3c..c6aed052a (1 commit)

https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+log/5af686b3cfa2..c6aed052aba9

$ git log 5af686b3c..c6aed052a --date=short --no-merges --format='%ad %ae %s'
2018-04-12 wolenetz lavf/mov and lavc/h264_slice cherry-picks

Created with:
  roll-dep src/third_party/ffmpeg

BUG=823145,822705
TBR=xhwang@chromium.org

Change-Id: I05c5b0c781157a67454e8d624f68ad8adcc00136
Reviewed-on: https://chromium-review.googlesource.com/1011397
Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550451}
[modify] https://crrev.com/c13b8c3fe0f2af202dc6c813cbe81f415147bf1d/DEPS

Cc: wolenetz@chromium.org
Labels: -M-67 M-68
Owner: liber...@chromium.org
Status: Assigned (was: Verified)
#10 fixed the issue in trunk, but just missed the M67 branch cut.

--> liberato@, please check if either of the issues rolled in #10 (bug 823145 and bug 822705) meet the release managers' bar for merge-to-M67 and do the merge (buildspec change) if approved.

Sign in to add a comment