New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 844313 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in webrtc::video_coding::EncodedFrame::is_keyframe

Project Member Reported by ClusterFuzz, May 18 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5711998478974976

Fuzzer: libFuzzer_frame_buffer2_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  webrtc::video_coding::EncodedFrame::is_keyframe
  webrtc::video_coding::FrameBuffer::NextFrame
  webrtc::FuzzOneInput
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=559597:559618

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5711998478974976

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 18 2018

Cc: kwiberg@webrtc.org mflodman@webrtc.org henrika@webrtc.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, May 18 2018

Cc: philipel@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Fuzzing for video_coding::FrameBuffer2. by philipel@webrtc.org - https://webrtc.googlesource.com/src/+/1e9cf7faf8c979066679307a77c753f7cab597eb

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Owner: a-...@yandex-team.ru
Status: Assigned (was: Untriaged)
Owner: philipel@chromium.org
Project Member

Comment 5 by ClusterFuzz, May 23 2018

Labels: OS-Mac
Project Member

Comment 6 by bugdroid1@chromium.org, Jun 12 2018

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/798b28279e7dea21a71adfe4be011ec7e7e72d27

commit 798b28279e7dea21a71adfe4be011ec7e7e72d27
Author: philipel <philipel@webrtc.org>
Date: Tue Jun 12 09:26:09 2018

Don't update internal state of the FrameBuffer2 when an undecodable frame is inserted.

Bug:  chromium:844313 
Change-Id: I034bcb47092815695084e37c81150bafbfbc6b9c
Reviewed-on: https://webrtc-review.googlesource.com/79944
Commit-Queue: Philip Eliasson <philipel@webrtc.org>
Reviewed-by: Björn Terelius <terelius@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23577}
[modify] https://crrev.com/798b28279e7dea21a71adfe4be011ec7e7e72d27/modules/video_coding/frame_buffer2.cc
[modify] https://crrev.com/798b28279e7dea21a71adfe4be011ec7e7e72d27/modules/video_coding/frame_buffer2_unittest.cc

Status: Fixed (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Jun 13 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/852af1c95f971f154463d6c243332395c904b88d

commit 852af1c95f971f154463d6c243332395c904b88d
Author: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed Jun 13 06:10:20 2018

Roll src/third_party/webrtc 9614a313b836..241d0c16c0d3 (18 commits)

https://webrtc.googlesource.com/src.git/+log/9614a313b836..241d0c16c0d3


git log 9614a313b836..241d0c16c0d3 --date=short --no-merges --format='%ad %ae %s'
2018-06-13 qingsi@google.com Remove ContinualGatheringPolicy::GATHER_CONTINUALLY_AND_RECOVER.
2018-06-13 shampson@webrtc.org Updated PeerConnection integration test to fix race condition.
2018-06-13 buildbot@webrtc.org Roll chromium_revision ef538e3112..9df92afb16 (566490:566630)
2018-06-12 qingsi@google.com Refactor the regathering of candidates in P2PTransportChannel.
2018-06-12 zhihuang@webrtc.org Add a flag to actively reset the SRTP parameters
2018-06-12 danilchap@webrtc.org Reland "Use absl::optional instead or rtc::Optional"
2018-06-12 buildbot@webrtc.org Roll chromium_revision ffaf1e2ba6..ef538e3112 (565764:566490)
2018-06-12 orphis@webrtc.org Add HeaderExtensions to RtpParameters
2018-06-12 alexnarest@webrtc.org Enable send side audio TWCC only if WebRTC-Audio-ForceNoTWCC is not enabled.
2018-06-12 mbonadei@webrtc.org Explicitly setting use_lld=false on MSVC bots.
2018-06-12 peterhanspers@webrtc.org Metal renderer does not handle i420 frames correctly.
2018-06-12 andersc@webrtc.org Make rtc_software_fallback_wrappers target visible.
2018-06-12 phensman@webrtc.org Release ADM after passing it to PCF in AppRTC
2018-06-12 kwiberg@webrtc.org LogMessage::UpdateMinLogSeverity: Don't ignore all but the last stream
2018-06-12 philipel@webrtc.org Don't update internal state of the FrameBuffer2 when an undecodable frame is inserted.
2018-06-12 jonasolsson@webrtc.org Remove stringstreams from p2p/
2018-06-12 jonasolsson@webrtc.org remove unused UNSHIPPED trace macros
2018-06-12 sakal@webrtc.org Delay the creation of the platform thread in TestAudioDeviceModule.


Created with:
  gclient setdep -r src/third_party/webrtc@241d0c16c0d3

The AutoRoll server is located here: https://webrtc-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_archive_rel_ng;master.tryserver.chromium.mac:mac_chromium_archive_rel_ng

BUG=chromium:None,chromium:None,chromium:None,chromium:None,chromium:835958,chromium:None,chromium:None,chromium:844313,chromium:b/79961243
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I7b4bcb1330e3b4206e7a0d20aa3bb776e04949b2
Reviewed-on: https://chromium-review.googlesource.com/1098237
Reviewed-by: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#566734}
[modify] https://crrev.com/852af1c95f971f154463d6c243332395c904b88d/DEPS

Project Member

Comment 9 by ClusterFuzz, Jun 14 2018

ClusterFuzz has detected this issue as fixed in range 566730:566735.

Detailed report: https://clusterfuzz.com/testcase?key=5711998478974976

Fuzzer: libFuzzer_frame_buffer2_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  webrtc::video_coding::EncodedFrame::is_keyframe
  webrtc::video_coding::FrameBuffer::NextFrame
  webrtc::FuzzOneInput
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=559597:559618
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=566730:566735

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5711998478974976

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jun 14 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5711998478974976 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Components: Blink>WebRTC>Video
Labels: M-69

Sign in to add a comment