CHECK failure: frames > 0 in audio_bus.cc |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5147478538846208 Fuzzer: libFuzzer_audio_decoder_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: frames > 0 in audio_bus.cc media::ValidateConfig media::AudioBus::AudioBus Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=570456:570473 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5147478538846208 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 27
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/75fe9b33ef2ec997b32582ef801ccc15c0fb34d7 (Avoid trailing silence in AAC decodes with WebAudio.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Aug 27
Latest ffmpeg roll seems to be returning 0 frame AVFrame objects in some cases.
,
Aug 27
Above statement is wrong, the packet just has a duration of zero, so we delete all the frames. It's an unhandled case in AudioFileReader. Fix in CQ.
,
Aug 28
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f594fb5545dab895758c358c17657b2e5e626711 commit f594fb5545dab895758c358c17657b2e5e626711 Author: Dale Curtis <dalecurtis@chromium.org> Date: Tue Aug 28 00:49:52 2018 Handle the case where AAC duration trim erases everything. 75fe9b33ef2ec997b32582ef801ccc15c0fb34d7 added support for trimming AAC silence based on packet duration. It did not handle the case when the duration is zero though, so when a packet is entirely discarded based on duration we would crash... whoops. This changes the code to mark the frame as processed if no frames remain after duration based discard. BUG= 877887 TEST=none Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel Change-Id: I9d4dcfa5fbd7f55ef43d3340dc3f53adc2a69d34 Reviewed-on: https://chromium-review.googlesource.com/1192342 Reviewed-by: Thomas Guilbert <tguilbert@chromium.org> Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#586527} [modify] https://crrev.com/f594fb5545dab895758c358c17657b2e5e626711/media/filters/audio_file_reader.cc
,
Aug 28
,
Aug 29
ClusterFuzz has detected this issue as fixed in range 586508:586527. Detailed report: https://clusterfuzz.com/testcase?key=5147478538846208 Fuzzer: libFuzzer_audio_decoder_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: frames > 0 in audio_bus.cc media::ValidateConfig media::AudioBus::AudioBus Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=570456:570473 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=586508:586527 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5147478538846208 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 29
ClusterFuzz testcase 5147478538846208 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Aug 27Labels: Test-Predator-Auto-Components