New issue
Advanced search Search tips

Issue 877887 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 28
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: frames > 0 in audio_bus.cc

Project Member Reported by ClusterFuzz, Aug 27

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5147478538846208

Fuzzer: libFuzzer_audio_decoder_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  frames > 0 in audio_bus.cc
  media::ValidateConfig
  media::AudioBus::AudioBus
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=570456:570473

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5147478538846208

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 27

Components: Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Aug 27

Labels: Test-Predator-Auto-Owner
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/75fe9b33ef2ec997b32582ef801ccc15c0fb34d7 (Avoid trailing silence in AAC decodes with WebAudio.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: tguilbert@chromium.org
Latest ffmpeg roll seems to be returning 0 frame AVFrame objects in some cases.
Above statement is wrong, the packet just has a duration of zero, so we delete all the frames. It's an unhandled case in AudioFileReader. Fix in CQ.
Project Member

Comment 5 by bugdroid1@chromium.org, Aug 28

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f594fb5545dab895758c358c17657b2e5e626711

commit f594fb5545dab895758c358c17657b2e5e626711
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Tue Aug 28 00:49:52 2018

Handle the case where AAC duration trim erases everything.

75fe9b33ef2ec997b32582ef801ccc15c0fb34d7 added support for
trimming AAC silence based on packet duration. It did not
handle the case when the duration is zero though, so when
a packet is entirely discarded based on duration we would
crash... whoops.

This changes the code to mark the frame as processed if
no frames remain after duration based discard.

BUG= 877887 
TEST=none

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
Change-Id: I9d4dcfa5fbd7f55ef43d3340dc3f53adc2a69d34
Reviewed-on: https://chromium-review.googlesource.com/1192342
Reviewed-by: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#586527}
[modify] https://crrev.com/f594fb5545dab895758c358c17657b2e5e626711/media/filters/audio_file_reader.cc

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Aug 29

ClusterFuzz has detected this issue as fixed in range 586508:586527.

Detailed report: https://clusterfuzz.com/testcase?key=5147478538846208

Fuzzer: libFuzzer_audio_decoder_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  frames > 0 in audio_bus.cc
  media::ValidateConfig
  media::AudioBus::AudioBus
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=570456:570473
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=586508:586527

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5147478538846208

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Aug 29

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5147478538846208 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment