New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 834531 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in WebRtcIsacfix_NormLatticeFilterAr

Project Member Reported by ClusterFuzz, Apr 19 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4631592023883776

Fuzzer: libFuzzer_audio_decoder_isacfix_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  WebRtcIsacfix_NormLatticeFilterAr
  WebRtcIsacfix_DecodeImpl
  WebRtcIsacfix_Decode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4631592023883776

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: brajkumar@chromium.org
Components: Blink>WebRTC>Audio
Labels: M-66 Test-Predator-Wrong
Owner: kwiberg@chromium.org
Status: Assigned (was: Untriaged)
This issue looks similar to  bug 615819 , hence assigning to the same owner for more updates on this issue.

kwiberg@ Could you please take a look in to this issue?

Thanks!
Project Member

Comment 2 by bugdroid1@chromium.org, Apr 19 2018

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/36b096c38ee846143ea7acbe82b5cdf27e0388f9

commit 36b096c38ee846143ea7acbe82b5cdf27e0388f9
Author: Karl Wiberg <kwiberg@webrtc.org>
Date: Thu Apr 19 21:22:49 2018

Ignore overflowing left shift

It's audio data, not an index or anything like that, so the most an
overflow can do is make it sound worse.

Bug:  chromium:834531 
Change-Id: Icb39c1bb011219c1a6fe67bc582390daa2693379
Reviewed-on: https://webrtc-review.googlesource.com/71160
Reviewed-by: Henrik Lundin <henrik.lundin@webrtc.org>
Commit-Queue: Karl Wiberg <kwiberg@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#22947}
[modify] https://crrev.com/36b096c38ee846143ea7acbe82b5cdf27e0388f9/modules/audio_coding/codecs/isac/fix/source/lattice.c

Project Member

Comment 3 by bugdroid1@chromium.org, Apr 20 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9ce8e73c5841dadda7a5413d875b502ed03f8e42

commit 9ce8e73c5841dadda7a5413d875b502ed03f8e42
Author: webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Fri Apr 20 05:19:39 2018

Roll src/third_party/webrtc/ e63d38ba3..36b096c38 (1 commit)

https://webrtc.googlesource.com/src.git/+log/e63d38ba342a..36b096c38ee8

$ git log e63d38ba3..36b096c38 --date=short --no-merges --format='%ad %ae %s'

Created with:
  roll-dep src/third_party/webrtc
BUG= chromium:834531 


The AutoRoll server is located here: https://webrtc-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_archive_rel_ng;master.tryserver.chromium.mac:mac_chromium_archive_rel_ng
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I243238a52447afc4bd4e67fe5170b1879d807c59
Reviewed-on: https://chromium-review.googlesource.com/1020528
Reviewed-by: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#552265}
[modify] https://crrev.com/9ce8e73c5841dadda7a5413d875b502ed03f8e42/DEPS

Project Member

Comment 4 by ClusterFuzz, Apr 20 2018

ClusterFuzz has detected this issue as fixed in range 552254:552265.

Detailed report: https://clusterfuzz.com/testcase?key=4631592023883776

Fuzzer: libFuzzer_audio_decoder_isacfix_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  WebRtcIsacfix_NormLatticeFilterAr
  WebRtcIsacfix_DecodeImpl
  WebRtcIsacfix_Decode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=552254:552265

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4631592023883776

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Apr 20 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4631592023883776 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment