Issue metadata
Sign in to add a comment
|
Heap-buffer-overflow in avio_read |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5015143155761152 Fuzzer: inferno_layout_test_unmodified Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Heap-buffer-overflow WRITE {*} Crash Address: 0x12218662cc77 Crash State: avio_read mov_read_sample_encryption_info mov_parse_auxiliary_info Sanitizer: address (ASAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=560376:560384 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5015143155761152 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 3 2018
Automatically adding ccs based on suspected regression changelists: avformat/mov: Increase support for common encryption. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/f7221d8e670ec05471a16cc4cc1cc8e0040b5b5f avformat/mov: Fix parsing of saio/siaz atoms in encrypted content. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/e5ba5fab493bd2edb24da47940626b024ebd0371 avformat/mov: Fix memory leak in encryption info. by modmaker-at-google.com@ffmpeg.org - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/606c5c7f3ad1d289ef745b9053024ad318646c7e If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jun 3 2018
,
Jun 3 2018
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it. If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 3 2018
,
Jun 4 2018
,
Jun 4 2018
I think this is caused by the same thing as http://crbug.com/847060 .
,
Jun 4 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/5e5a8e81925df95a88356b410c1374b33b920455 commit 5e5a8e81925df95a88356b410c1374b33b920455 Author: Jacob Trimble <modmaker@google.com> Date: Mon Jun 04 21:20:16 2018 Fix heap buffer overflow. Bug: 847060 Bug: 849062 Change-Id: Ibf18b3c0fd375ddd09addb019888bdd6ec576355 Reviewed-on: https://chromium-review.googlesource.com/1081148 Reviewed-by: Frank Liberato <liberato@chromium.org> [modify] https://crrev.com/5e5a8e81925df95a88356b410c1374b33b920455/libavformat/mov.c [modify] https://crrev.com/5e5a8e81925df95a88356b410c1374b33b920455/chromium/patches/README
,
Jun 5 2018
,
Jun 6 2018
,
Jun 8 2018
,
Jun 8 2018
This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review Please contact the milestone owner if you have questions. Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 8 2018
Approved. branch:3440
,
Jun 12 2018
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 12 2018
ClusterFuzz testcase 5015143155761152 is still reproducing on tip-of-tree build (trunk). Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
,
Jun 14 2018
,
Jun 18 2018
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 18 2018
=>liberato for handling any merge necessities.
,
Jun 18 2018
Pls merge you change to M68 branch 3440 ASAP so we can pick it up for this week Beta release. Merge has to happen latest by 1:00 PM PT tomorrow, Tuesday (06/19), so we can pick it up for Wednesday Beta release.
,
Jun 18 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/90cefb3857c34972d1bd0fa88627846c2b4236fa commit 90cefb3857c34972d1bd0fa88627846c2b4236fa Author: liberato@chromium.org <liberato@chromium.org> Date: Mon Jun 18 22:55:04 2018 Roll deps for ffmpeg fixes. This rolls the following into the ffmpeg tree: commit 8f9a277d4e4870586365f168a4e38c2b381401ec Author: liberato@chromium.org <liberato@chromium.org> Add null check for encryption info. commit beef790ce19168db60da173f04028d6bba8c9127 Author: Jacob Trimble <modmaker@google.com> Fix heap buffer overflow. Bug: 849062 Change-Id: I7944a0e02fc5b01871e4b8efc8d3d1ee7fdb51df Reviewed-on: https://chromium-review.googlesource.com/1105318 Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/branch-heads/3440@{#429} Cr-Branched-From: 010ddcfda246975d194964ccf20038ebbdec6084-refs/heads/master@{#561733} [modify] https://crrev.com/90cefb3857c34972d1bd0fa88627846c2b4236fa/DEPS
,
Jun 20 2018
,
Jun 22 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/0d0c062e8cefdfdc777cd36ab23a2b4ddac65fcd commit 0d0c062e8cefdfdc777cd36ab23a2b4ddac65fcd Author: Dale Curtis <dalecurtis@chromium.org> Date: Fri Jun 22 16:57:36 2018 Update ffmpeg DEPs for rest of iv size fixes. BUG= 849062 , 853416 Change-Id: Ida5bff50f4095dadd9314c49c836ec6b80101a4b Reviewed-on: https://chromium-review.googlesource.com/1111276 Reviewed-by: Frank Liberato <liberato@chromium.org> Cr-Commit-Position: refs/branch-heads/3440@{#490} Cr-Branched-From: 010ddcfda246975d194964ccf20038ebbdec6084-refs/heads/master@{#561733} [modify] https://crrev.com/0d0c062e8cefdfdc777cd36ab23a2b4ddac65fcd/DEPS
,
Sep 12
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Jun 3 2018Labels: Test-Predator-Auto-Components