New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 855900 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Last visit 19 days ago
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in WebRtcAgc_ProcessDigital

Project Member Reported by ClusterFuzz, Jun 24 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6436980519600128

Fuzzer: libFuzzer_agc_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  WebRtcAgc_ProcessDigital
  WebRtcAgc_Process
  webrtc::GainControlImpl::ProcessCaptureAudio
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=569334:569350

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6436980519600128

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 24 2018

Cc: mflodman@webrtc.org kwiberg@webrtc.org henrika@webrtc.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Jun 24 2018

Cc: saza@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Add AGC1 fuzzer by saza@webrtc.org - https://webrtc.googlesource.com/src/+/f341f3feb505733ef57a8ddf9571b6b462a44e91

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -saza@webrtc.org
Owner: saza@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 4 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/762289ed13fb5c3f970bb155bcc4418603d1acc0

commit 762289ed13fb5c3f970bb155bcc4418603d1acc0
Author: Sam Zackrisson <saza@webrtc.org>
Date: Tue Jun 26 10:31:09 2018

Fix overflow in digital AGC1

Bug:  chromium:855900 
Change-Id: I966d5d977cee2862f7c0dd07e35561e475269d20
Reviewed-on: https://webrtc-review.googlesource.com/85368
Reviewed-by: Alex Loiko <aleloi@google.com>
Commit-Queue: Sam Zackrisson <saza@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23737}
[modify] https://crrev.com/762289ed13fb5c3f970bb155bcc4418603d1acc0/modules/audio_processing/agc/legacy/digital_agc.c

Project Member

Comment 5 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bcf6505d36d59cb147bb219ed7dbfa88de57be4f

commit bcf6505d36d59cb147bb219ed7dbfa88de57be4f
Author: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Jun 26 17:38:33 2018

Roll src/third_party/webrtc f7789c6e8958..fe288eb687b8 (10 commits)

https://webrtc.googlesource.com/src.git/+log/f7789c6e8958..fe288eb687b8


git log f7789c6e8958..fe288eb687b8 --date=short --no-merges --format='%ad %ae %s'
2018-06-26 ssilkin@webrtc.org Don't call deprecated FFmpeg API.
2018-06-26 titovartem@webrtc.org Extract fft4g into separate build target
2018-06-26 brandtr@webrtc.org Fix potential division by zero in VP9 VideoCodecTest.
2018-06-26 terelius@webrtc.org Style fixes in event log unittest.
2018-06-26 terelius@webrtc.org Revert "Add Timestamp accessor methods to the EncodedImage class."
2018-06-26 minyue@webrtc.org Adding NetEq lifetime stats to event log visualizer.
2018-06-26 saza@webrtc.org Fix overflow in digital AGC1
2018-06-26 terelius@webrtc.org Rewrite the RtcEventLog unit test.
2018-06-26 nisse@webrtc.org Delete unused class TransformAdapter.
2018-06-26 nisse@webrtc.org Add Timestamp accessor methods to the EncodedImage class.


Created with:
  gclient setdep -r src/third_party/webrtc@fe288eb687b8

The AutoRoll server is located here: https://webrtc-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;master.tryserver.chromium.mac:mac_chromium_archive_rel_ng

BUG=chromium:None,chromium:855900
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I595f6469b0e05b8bc636c6a7edb5dd8bf5033ab8
Reviewed-on: https://chromium-review.googlesource.com/1115060
Reviewed-by: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#570451}
[modify] https://crrev.com/bcf6505d36d59cb147bb219ed7dbfa88de57be4f/DEPS

Project Member

Comment 6 by ClusterFuzz, Jun 27 2018

ClusterFuzz has detected this issue as fixed in range 570441:570456.

Detailed report: https://clusterfuzz.com/testcase?key=6436980519600128

Fuzzer: libFuzzer_agc_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  WebRtcAgc_ProcessDigital
  WebRtcAgc_Process
  webrtc::GainControlImpl::ProcessCaptureAudio
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=569334:569350
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=570441:570456

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6436980519600128

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 7 by saza@chromium.org, Jun 27 2018

Components: Blink>WebRTC>Audio
Status: Verified (was: Assigned)

Sign in to add a comment