Automatically adding ccs based on suspected regression changelists:

Implement VideoQualityObserver by ilnik@webrtc.org - https://webrtc.googlesource.com/src/+/94150ee487f433ac12622f16f0052e42cfe0b97c

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

This is very strange. I looked at the function, it has only 4 local variables (half are int64_t, half are rtc::Optional<> class), no loops, no buffers... nothing which may cause stack buffer overflow. Is there any chance that the crash happened in some other thread instead?

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Can anyone from security team to remove the releaseBlock-Stable label? I've no access to this bug with my @chromium account, and with my @webrtc account i can't even see the labels/cc fields.

The CL is landed after m68 cut in webrtc: https://webrtc.googlesource.com/src/+log/branch-heads/68

Removing the release block.

ilnik: I CC'ed your chromium.org account. Let me know if you can still not edit the labels.

Thank you Mustafa, now I can edit the bug.

IT probably wasn't a stack buffer overflow - there was an empty optional dereference.
The fix is going to land soon: https://webrtc-review.googlesource.com/c/src/+/80040

ClusterFuzz has detected this issue as fixed in range 563106:563107.

Detailed report: https://clusterfuzz.com/testcase?key=5736531130843136

Fuzzer: cpaulin_mediarecorder
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Stack-buffer-overflow READ 4
Crash Address: 0x7f951ce79b24
Crash State:
  webrtc::VideoQualityObserver::OnDecodedFrame
  webrtc::ReceiveStatisticsProxy::OnDecodedFrame
  webrtc::VideoStreamDecoder::FrameToRender
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=562202:562203
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=563106:563107

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5736531130843136

Additional requirements: Requires HTTP

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5736531130843136 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 849437  has been merged into this issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot