New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 886904 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Oct 5
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in webrtc::BufferLevelFilter::Update

Project Member Reported by ClusterFuzz, Sep 19

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5451093088403456

Fuzzer: libFuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  webrtc::BufferLevelFilter::Update
  webrtc::DecisionLogic::FilterBufferLevel
  webrtc::DecisionLogic::GetDecision
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=432467:432520

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5451093088403456

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Sep 19

Cc: henrik.lundin@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Avoid left-shifting negative values in a number of places by henrik.lundin@webrtc.org - https://chromium.googlesource.com/external/webrtc/trunk/webrtc/+/fa09b17ce12187edefb1948f81e08b4841c3b989

NetEq: Don't interpolate longer than the output size by henrik.lundin@webrtc.org - https://chromium.googlesource.com/external/webrtc/trunk/webrtc/+/b7c5e522f304e6f22a95ee0d94dbfc8939777588

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
henrik.lundin@ Could you please look into it.
Cc: yvesg@webrtc.org kkaluri@chromium.org
Components: Blink>WebRTC
Labels: M-70
Owner: yvesg@google.com
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "buffer_level_filter.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://webrtc.googlesource.com/src.git/+/665174fdbb4e0540eccb27cf7412348f1b65534c

yvesg@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Owner: ----
Status: Available (was: Assigned)
> Suspect CL: https://webrtc.googlesource.com/src.git/+/665174fdbb4e0540eccb27cf7412348f1b65534c

This CL is just a formatting cleanup. You might want to use git-hyper-blame to track real changes.
Also, a clang regression has been detected ( http://crbug.com/887464 ), running the fuzzer with an earlier version would be very instructive!
Owner: barrerap@chromium.org
Status: Assigned (was: Available)
Cc: minyue@chromium.org
Project Member

Comment 7 by bugdroid1@chromium.org, Oct 4

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/bc2959072dc590527d989e83ae9c899c82f45fd4

commit bc2959072dc590527d989e83ae9c899c82f45fd4
Author: Pablo Barrera González <barrerap@webrtc.org>
Date: Thu Oct 04 10:51:08 2018

NetEq: Fix an UBSan error

UBSan will trigger when time_stretched_samples overflows using a
big number. This change avoids this problem by storing the
intermediate result into a int64_t.

Bug:  chromium:886904 
Change-Id: Id09dc4b468f841f03b523d5f21763f610b163a42
Reviewed-on: https://webrtc-review.googlesource.com/c/103123
Reviewed-by: Karl Wiberg <kwiberg@webrtc.org>
Reviewed-by: Henrik Lundin <henrik.lundin@webrtc.org>
Commit-Queue: Pablo Barrera González <barrerap@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#24977}
[modify] https://crrev.com/bc2959072dc590527d989e83ae9c899c82f45fd4/modules/audio_coding/neteq/buffer_level_filter.cc

Project Member

Comment 8 by bugdroid1@chromium.org, Oct 4

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1d921b743511b38fa52055a7aae641acb9f88123

commit 1d921b743511b38fa52055a7aae641acb9f88123
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Thu Oct 04 14:32:08 2018

Roll src/third_party/webrtc 4a72ba99a704..bc2959072dc5 (9 commits)

https://webrtc.googlesource.com/src.git/+log/4a72ba99a704..bc2959072dc5


git log 4a72ba99a704..bc2959072dc5 --date=short --no-merges --format='%ad %ae %s'
2018-10-04 barrerap@webrtc.org NetEq: Fix an UBSan error
2018-10-04 mbonadei@webrtc.org Remove noop system_wrappers_default build target.
2018-10-04 minyue@webrtc.org Adding field trial to force target level percentile in NetEQ.
2018-10-04 mbonadei@webrtc.org Revert "Export symbols needed by the Chromium component build (part 1)."
2018-10-04 oprypin@webrtc.org Allow the autoroller service account to commit
2018-10-04 philipel@webrtc.org Don't ovewrite complex member VCMPacket::generic_descriptor when fuzzing.
2018-10-04 saza@webrtc.org Delete deprecated AEC interfaces
2018-10-04 kwiberg@webrtc.org Remove `using` declaration for rtc::Buffer
2018-10-04 mbonadei@webrtc.org Export symbols needed by the Chromium component build (part 1).


Created with:
  gclient setdep -r src/third_party/webrtc@bc2959072dc5

The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng

BUG= chromium:886904 ,chromium:836566, chromium:891597 
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: Ie1e5ee706877b2abfac26b0f61da440764ba750e
Reviewed-on: https://chromium-review.googlesource.com/c/1261420
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#596659}
[modify] https://crrev.com/1d921b743511b38fa52055a7aae641acb9f88123/DEPS

Project Member

Comment 9 by ClusterFuzz, Oct 5

ClusterFuzz has detected this issue as fixed in range 596654:596659.

Detailed report: https://clusterfuzz.com/testcase?key=5451093088403456

Fuzzer: libFuzzer_neteq_rtp_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  webrtc::BufferLevelFilter::Update
  webrtc::DecisionLogic::FilterBufferLevel
  webrtc::DecisionLogic::GetDecision
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=432467:432520
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=596654:596659

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5451093088403456

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Oct 5

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5451093088403456 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment