Abrt in webrtc::RtpGenericFrameDescriptor::RtpGenericFrameDescriptor |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5372898519547904 Fuzzer: libFuzzer_packet_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x053900205abc Crash State: webrtc::RtpGenericFrameDescriptor::RtpGenericFrameDescriptor void absl::optional_internal::optional_data_base<webrtc::RtpGenericFrameDescript void absl::optional_internal::optional_data_base<webrtc::RtpGenericFrameDescript Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=595906:595916 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5372898519547904 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Oct 3
Automatically adding ccs based on suspected regression changelists: Make RtpGenericFrameDescriptor available for E2EE. by philipel@webrtc.org - https://webrtc.googlesource.com/src/+/2837edce997b469a702bb96f84ac49dfb727531d If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Oct 3
Predator has provided one possible suspect Suspect CL:https://webrtc.googlesource.com/src/+/2837edce997b469a702bb96f84ac49dfb727531d philipel@ Could you please look into it.
,
Oct 3
Looking at it now, the problem is caused by the fuzzer writing random data into a complex type, putting it in an invalid state. I will change how the packets we insert into the packet buffer are generated.
,
Oct 4
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/c71cd6c31d2712cea0cd15a22ade2b6764f7794b commit c71cd6c31d2712cea0cd15a22ade2b6764f7794b Author: philipel <philipel@webrtc.org> Date: Thu Oct 04 09:22:13 2018 Don't ovewrite complex member VCMPacket::generic_descriptor when fuzzing. In https://webrtc-review.googlesource.com/c/src/+/102720 a new complex member was added to VCMPacket. This member was overwritten with random data in the fuzzer, which put it in an invalid state. To avoid that we save/restore it. Bug: chromium:891597 Change-Id: I7b489afa727a028a542fbec55a4ee27ac54fa698 Reviewed-on: https://webrtc-review.googlesource.com/c/103462 Reviewed-by: Alex Loiko <aleloi@webrtc.org> Commit-Queue: Philip Eliasson <philipel@webrtc.org> Cr-Commit-Position: refs/heads/master@{#24972} [modify] https://crrev.com/c71cd6c31d2712cea0cd15a22ade2b6764f7794b/test/fuzzers/packet_buffer_fuzzer.cc
,
Oct 4
,
Oct 4
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1d921b743511b38fa52055a7aae641acb9f88123 commit 1d921b743511b38fa52055a7aae641acb9f88123 Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Thu Oct 04 14:32:08 2018 Roll src/third_party/webrtc 4a72ba99a704..bc2959072dc5 (9 commits) https://webrtc.googlesource.com/src.git/+log/4a72ba99a704..bc2959072dc5 git log 4a72ba99a704..bc2959072dc5 --date=short --no-merges --format='%ad %ae %s' 2018-10-04 barrerap@webrtc.org NetEq: Fix an UBSan error 2018-10-04 mbonadei@webrtc.org Remove noop system_wrappers_default build target. 2018-10-04 minyue@webrtc.org Adding field trial to force target level percentile in NetEQ. 2018-10-04 mbonadei@webrtc.org Revert "Export symbols needed by the Chromium component build (part 1)." 2018-10-04 oprypin@webrtc.org Allow the autoroller service account to commit 2018-10-04 philipel@webrtc.org Don't ovewrite complex member VCMPacket::generic_descriptor when fuzzing. 2018-10-04 saza@webrtc.org Delete deprecated AEC interfaces 2018-10-04 kwiberg@webrtc.org Remove `using` declaration for rtc::Buffer 2018-10-04 mbonadei@webrtc.org Export symbols needed by the Chromium component build (part 1). Created with: gclient setdep -r src/third_party/webrtc@bc2959072dc5 The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng BUG= chromium:886904 ,chromium:836566, chromium:891597 TBR=webrtc-chromium-sheriffs-robots@google.com Change-Id: Ie1e5ee706877b2abfac26b0f61da440764ba750e Reviewed-on: https://chromium-review.googlesource.com/c/1261420 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#596659} [modify] https://crrev.com/1d921b743511b38fa52055a7aae641acb9f88123/DEPS
,
Oct 5
ClusterFuzz has detected this issue as fixed in range 596655:596661. Detailed report: https://clusterfuzz.com/testcase?key=5372898519547904 Fuzzer: libFuzzer_packet_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x053900205abc Crash State: webrtc::RtpGenericFrameDescriptor::RtpGenericFrameDescriptor void absl::optional_internal::optional_data_base<webrtc::RtpGenericFrameDescript void absl::optional_internal::optional_data_base<webrtc::RtpGenericFrameDescript Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=595906:595916 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=596655:596661 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5372898519547904 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 5
ClusterFuzz testcase 5372898519547904 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Oct 18
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Oct 3Labels: ClusterFuzz-Auto-CC