Integer-overflow in update_stream_timings |
||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6470519705305088 Fuzzer: libFuzzer_audio_decoder_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: update_stream_timings fill_all_stream_timings estimate_timings Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=546308:546319 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6470519705305088 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Apr 5 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/4b5068a99a84ff2edb34aa0549afc89aa751ccb4 (Add audio_decoder_fuzzer fuzz target.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Apr 6 2018
Another ffmpeg issue.
,
Apr 9 2018
Frank, since I'm syncing w/Michael this week, I'll start on this (though it may pass to you to fix in your roll). I have a confirmed local repro using *both* audio_decoder_fuzzer and media_pipeline_integration_fuzzer. The specific UBSAN_OPTIONS are unnecessary for repro. This also repros on current upstream ffplay. I've sent the case upstream to Michael today.
,
Apr 11 2018
,
Apr 11 2018
I LGTM'ed Michael's upstream fix today (in email). Pending upstream, I'll cherry-pick (or pass to Frank for that).
,
Apr 30 2018
this was picked up from upstream during the in-progress 68 roll. marking as fixed, since it will land with the rest of the roll.
,
May 7 2018
ClusterFuzz testcase 6470519705305088 is still reproducing on tip-of-tree build (trunk). Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
,
May 7 2018
okay, un-fixing. sorry, CF, forgot you were listening.
,
May 22 2018
ClusterFuzz has detected this issue as fixed in range 560367:560380. Detailed report: https://clusterfuzz.com/testcase?key=6470519705305088 Fuzzer: libFuzzer_audio_decoder_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: update_stream_timings fill_all_stream_timings estimate_timings Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=546308:546319 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=560367:560380 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6470519705305088 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 22 2018
ClusterFuzz testcase 6470519705305088 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by ClusterFuzz
, Apr 5 2018Labels: Test-Predator-Auto-Components