New issue
Advanced search Search tips

Issue 864883 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 18
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Integer-overflow in WebRtcAgc_ProcessVad

Project Member Reported by ClusterFuzz, Jul 18

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5362222902280192

Fuzzer: libFuzzer_audio_processing_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  WebRtcAgc_ProcessVad
  WebRtcAgc_ProcessDigital
  WebRtcAgc_Process
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572608:573019

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5362222902280192

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 18

Cc: ale...@webrtc.org saza@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Stereo in APM fuzzer. by aleloi@webrtc.org - https://webrtc.googlesource.com/src/+/c480e9d7a86d8d5ab0f45ff4a0e9160c3b34c1a0

Fuzz key presses in APM by saza@webrtc.org - https://webrtc.googlesource.com/src/+/1f5de53a8c62ed418b8bf22513368fb5bb571e41

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Components: Blink>WebRTC>Audio
Labels: -Pri-2 Pri-3
Owner: saza@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 3 by ClusterFuzz, Jul 18

ClusterFuzz has detected this issue as fixed in range 575824:575840.

Detailed report: https://clusterfuzz.com/testcase?key=5362222902280192

Fuzzer: libFuzzer_audio_processing_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  WebRtcAgc_ProcessVad
  WebRtcAgc_ProcessDigital
  WebRtcAgc_Process
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572608:573019
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=575824:575840

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5362222902280192

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Jul 18

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5362222902280192 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Owner: aleloi@chromium.org
Project Member

Comment 6 by bugdroid1@chromium.org, Jul 19

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/e714ed6427906347f1e90a492cf7339a9023b865

commit e714ed6427906347f1e90a492cf7339a9023b865
Author: Alex Loiko <aleloi@webrtc.org>
Date: Thu Jul 19 12:11:22 2018

Fuzzer finds fixedpoint failure.

A 32-bit number overflows. It's then capped to compute a 16-bit value.
This CL introduces a 64-bit variable on which equivalent operations are
performed instead.

Bug:  chromium:864883 
Change-Id: I371af869c6586256b900356491f467bed357e11d
Reviewed-on: https://webrtc-review.googlesource.com/89584
Reviewed-by: Sam Zackrisson <saza@webrtc.org>
Commit-Queue: Alex Loiko <aleloi@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#24041}
[modify] https://crrev.com/e714ed6427906347f1e90a492cf7339a9023b865/modules/audio_processing/agc/legacy/digital_agc.c

Project Member

Comment 7 by bugdroid1@chromium.org, Jul 22

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c0419ddbcbef45e6966ac1dbf28663bd68c8f1b0

commit c0419ddbcbef45e6966ac1dbf28663bd68c8f1b0
Author: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Sun Jul 22 06:08:49 2018

Roll src/third_party/webrtc 881fe53d1fae..0c3ad73948e4 (46 commits)

https://webrtc.googlesource.com/src.git/+log/881fe53d1fae..0c3ad73948e4


git log 881fe53d1fae..0c3ad73948e4 --date=short --no-merges --format='%ad %ae %s'
2018-07-21 buildbot@webrtc.org Roll chromium_revision 86c90e3417..5e7b1029e2 (576937:577041)
2018-07-20 benwright@webrtc.org Adds SSLCertificateVerifier to the Java API.
2018-07-20 mbonadei@webrtc.org Enable clang::find_bad_constructs for sdk/android (part 1/2).
2018-07-20 buildbot@webrtc.org Roll chromium_revision 7002a7d325..86c90e3417 (576827:576937)
2018-07-20 aleloi@webrtc.org Reset level estimator when analog gain changes.
2018-07-20 mbonadei@webrtc.org Enable clang::find_bad_constructs for audio_coding (part 1/2).
2018-07-20 mbonadei@webrtc.org Enable clang::find_bad_constructs for api/video/test.
2018-07-20 mbonadei@webrtc.org Enable clang::find_bad_constructs for rtc_tools (part 1/2).
2018-07-20 buildbot@webrtc.org Roll chromium_revision bc3d35fc98..7002a7d325 (576524:576827)
2018-07-20 mbonadei@webrtc.org Enable clang::find_bad_constructs for remote_bitrate_estimator.
2018-07-19 qingsi@google.com Remove MetricsObserverInterface.
2018-07-19 mbonadei@webrtc.org Enabling clang::find_bad_constructs for desktop_capture.
2018-07-19 braveyao@webrtc.org [Window capture] filter out sibling windows with same title.
2018-07-19 mbonadei@webrtc.org Reland "Removing unneeded dependency."
2018-07-19 buildbot@webrtc.org Roll chromium_revision ecaca1be48..bc3d35fc98 (576410:576524)
2018-07-19 oprypin@webrtc.org Follow "Migrate the Android Support Lib to android_deps" from Chromium
2018-07-19 yvesg@webrtc.org Expose audio codec factories in libwebrtc.
2018-07-19 aleloi@webrtc.org Fuzzer finds fixedpoint failure.
2018-07-19 mbonadei@webrtc.org Enabling clang::find_bad_constructs for libjingle_peerconnection_api.
2018-07-19 stefan@webrtc.org Rename PayloadRouter to RtpVideoSender.
2018-07-19 mbonadei@webrtc.org Enabling clang::find_bad_constructs in modules/BUILD.gn.
2018-07-19 buildbot@webrtc.org Roll chromium_revision 6374eaa6aa..ecaca1be48 (576310:576410)
2018-07-19 mbonadei@webrtc.org Clean up unneeded includes in common_video/BUILD.gn.
2018-07-19 mbonadei@webrtc.org Clean up unneeded includes in common_audio/BUILD.gn.
2018-07-19 mbonadei@webrtc.org Clean up unneeded includes in audio_device/BUILD.gn.
2018-07-19 buildbot@webrtc.org Roll chromium_revision 9e818a5aef..6374eaa6aa (576197:576310)
2018-07-19 hta@webrtc.org Add UMA metric for ICE candidate addition outcome
2018-07-19 jeroendb@webrtc.org Added explicit EOR to sctp messages and coalesce messages on the receiving side.
2018-07-18 benwright@webrtc.org Adds flag to enable AES_GCM from the Java API.
2018-07-18 buildbot@webrtc.org Roll chromium_revision 7e9fce12da..9e818a5aef (576093:576197)
2018-07-18 benwright@webrtc.org Added API to Objective-C PeerConnectionFactoryOptions to enable GCM Ciphers.
2018-07-18 buildbot@webrtc.org Roll chromium_revision 9159e523ff..7e9fce12da (575979:576093)
2018-07-18 mbonadei@webrtc.org Cleanup unneeded includes in audio_coding/BUILD.gn.
2018-07-18 sakal@webrtc.org Allow calling SoftwareVideoDecoderFactory#createDecoder(String).
2018-07-18 orphis@webrtc.org Implement changing degradation preference with setParameters()
2018-07-18 mbonadei@webrtc.org Revert "Removing unneeded dependency."
2018-07-18 stefan@webrtc.org Properly clean up RtpVideoSender.
2018-07-18 terelius@webrtc.org Limit BWE reductions before first measured throughput.
2018-07-18 mbonadei@webrtc.org Enabling clang::find_bad_constructs for modules/pacing.
2018-07-18 mbonadei@webrtc.org Removing unneeded dependency.
2018-07-18 mbonadei@webrtc.org Enabling clang::find_bad_constructs for common_video.
2018-07-18 mbonadei@webrtc.org Removing clang:find_bad_constructs from logging (part 1).
2018-07-18 mbonadei@webrtc.org Revert "Remove linux_internal_compile_lite from CQ."
2018-07-18 mbonadei@webrtc.org Adding oprypin to infra/config/OWNERS.
2018-07-18 buildbot@webrtc.org Roll chromium_revision 9ec8cfdbc9..9159e523ff (575625:575979)
2018-07-18 ilnik@webrtc.org Reland "Enable simulcast screenshare by default"


Created with:
  gclient setdep -r src/third_party/webrtc@0c3ad73948e4

The AutoRoll server is located here: https://webrtc-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;master.tryserver.chromium.mac:mac_chromium_archive_rel_ng

BUG=chromium:None,chromium:None,chromium:None,chromium:865193,chromium:None,chromium:864883,chromium:None,chromium:None,chromium:713701,chromium:None,chromium:713701,chromium:None,chromium:None,chromium:None,chromium:None,chromium:690537
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I761335ea240c6da495ddad33ad073d42bd446453
Reviewed-on: https://chromium-review.googlesource.com/1146084
Reviewed-by: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: webrtc-chromium-autoroll <webrtc-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#577089}
[modify] https://crrev.com/c0419ddbcbef45e6966ac1dbf28663bd68c8f1b0/DEPS

Labels: M-70

Sign in to add a comment