New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 827894 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug-Regression

Blocked on:
issue 916298



Sign in to add a comment

Integer-overflow in mov_read_stts

Project Member Reported by ClusterFuzz, Apr 1 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6116964238622720

Fuzzer: libFuzzer_audio_decoder_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mov_read_stts
  mov_read_default
  mov_read_default
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=546308:546319

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6116964238622720

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 2 2018

Components: Internals>Media>FFmpeg
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: brajkumar@chromium.org
Labels: -Type-Bug -Pri-2 M-67 Test-Predator-Wrong Pri-1 Type-Bug-Regression
Owner: mmoroz@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.

From the below CL observing some changes related to 'audio_decoder_fuzzer' , hence suspecting the same
https://chromium.googlesource.com/chromium/src/+log/6cf9e9ef8b09b264c8af672e9f1798acb3cb2260..bfd138a0d51fe3582b3e127561cc791c01460546?pretty=fuller&n=10000

Suspect CL: https://chromium.googlesource.com/chromium/src/+/4b5068a99a84ff2edb34aa0549afc89aa751ccb4

mmoroz@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Owner: ----
Status: Untriaged (was: Assigned)
I've added and fixed the fuzzer, but didn't touch the code that has a bug. Please assign this to ffmpeg OWNER.
Owner: chcunningham@chromium.org
Status: Assigned (was: Untriaged)
This bug has a stale milestone. Please close appropriately, update the milestone and set P1/P2, or drop the milestone and set as P3. I'll automatically punt these issues to M70 next week otherwise.
Labels: -M-67 Pri-3
These issues have seen no update and have stale milestones, dropping priority and removing milestone.
Project Member

Comment 7 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 6116964238622720 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 10 by ClusterFuzz, Dec 12

ClusterFuzz has detected this issue as fixed in range 615699:615711.

Detailed report: https://clusterfuzz.com/testcase?key=6116964238622720

Fuzzer: libFuzzer_audio_decoder_fuzzer
Fuzz target binary: audio_decoder_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mov_read_stts
  mov_read_default
  mov_read_default
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=546308:546319
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=615699:615711

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6116964238622720

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Dec 12

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6116964238622720 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Status: Assigned (was: Verified)
Blocking: 916298
Blocking: -916298
Blockedon: 916298

Sign in to add a comment