Integer-overflow in FindInvArSpec |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6255955862618112 Fuzzer: libFuzzer_audio_decoder_isac_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: FindInvArSpec WebRtcIsac_DecodeSpec WebRtcIsac_DecodeLb Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6255955862618112 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 14
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue. Thanks!
,
Nov 20
,
Nov 22
,
Nov 23
,
Nov 26
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/622eedaf0fd3362b05085b7dfbd1b986bb072dce commit 622eedaf0fd3362b05085b7dfbd1b986bb072dce Author: Jonas Olsson <jonasolsson@webrtc.org> Date: Mon Nov 26 16:16:50 2018 Bump variable sizes in response to fuzzer bug The fuzzers detected a possible overflow in the multiplication of sum and gainQ10. Since gainQ10 cannot be larger than 2048000 (see WebRtcIsac_kQGain2Levels) and sum cannot be larger than 2^16, a int64 is large enough to hold the result. Bug: chromium:904909 Change-Id: Icb12821d4006aaaaf70a5735d2abd2b96f7a2f0e Reviewed-on: https://webrtc-review.googlesource.com/c/111921 Reviewed-by: Ivo Creusen <ivoc@webrtc.org> Commit-Queue: Jonas Olsson <jonasolsson@webrtc.org> Cr-Commit-Position: refs/heads/master@{#25787} [modify] https://crrev.com/622eedaf0fd3362b05085b7dfbd1b986bb072dce/modules/audio_coding/codecs/isac/main/source/entropy_coding.c
,
Nov 27
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d3403a1bb6bf08fdd9b4dec5ec6b30ef4f77e89c commit d3403a1bb6bf08fdd9b4dec5ec6b30ef4f77e89c Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Tue Nov 27 18:05:18 2018 Roll src/third_party/webrtc f1c194decd51..6b3d18164b4a (21 commits) https://webrtc.googlesource.com/src.git/+log/f1c194decd51..6b3d18164b4a git log f1c194decd51..6b3d18164b4a --date=short --no-merges --format='%ad %ae %s' 2018-11-27 terelius@webrtc.org Remove unused BWE field trial strings. 2018-11-27 kron@webrtc.org Add setters to ColorSpace class 2018-11-27 crodbro@webrtc.org Specific pacing configuration. 2018-11-27 ilnik@webrtc.org Various VP9 high fps fixes 2018-11-27 danilchap@webrtc.org Populate VideoSendTime extension network2 field when configured 2018-11-27 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 208bb982f7..81c26a093b (610939:611047) 2018-11-27 mbonadei@webrtc.org Fix wrong forward declaration namespace. 2018-11-26 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 00f78b5b14..208bb982f7 (610831:610939) 2018-11-26 michel.promonet.1@gmail.com add cstring include need for strncmp 2018-11-26 steveanton@webrtc.org Small cleanup to mediasession_unittest.cc 2018-11-26 ouj@fb.com Rebase std::is_trivially_* with absl::is_trivially_* 2018-11-26 jonasolsson@webrtc.org Bump variable sizes in response to fuzzer bug 2018-11-26 saza@webrtc.org Add AudioProcessingCaptureStats and a level estimator replacement 2018-11-26 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 7579fcbc1c..00f78b5b14 (610728:610831) 2018-11-26 nisse@webrtc.org Delete ChannelSend::RegisterTransport, replacing by construction argument 2018-11-26 phoglund@webrtc.org Add magjed as owner of rtc_tools. 2018-11-26 danilchap@webrtc.org In ReceiveStatistics use monotonic clock instead of ntp clock 2018-11-26 robin@opticaltone.com Add a new Task Queue for WinUWP. 2018-11-26 saza@webrtc.org Delete the WebRTC.Call.TimeSendingAudioRtpPacketsInSeconds metric 2018-11-26 danilchap@webrtc.org In ReceiveStatistic require callbacks during construction 2018-11-26 emircan@webrtc.org Reland Profile 2 to default profiles Created with: gclient setdep -r src/third_party/webrtc@6b3d18164b4a The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng BUG=chromium:None,chromium:None,chromium:None,chromium:None,chromium:None,chromium:904909,chromium:None,chromium:None,chromium:None,chromium:None TBR=webrtc-chromium-sheriffs-robots@google.com Change-Id: I1848d2b4a6fc7fd65655128454244ec7f0916727 Reviewed-on: https://chromium-review.googlesource.com/c/1352235 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#611184} [modify] https://crrev.com/d3403a1bb6bf08fdd9b4dec5ec6b30ef4f77e89c/DEPS
,
Dec 1
ClusterFuzz testcase 6255955862618112 appears to be flaky, updating reproducibility label.
,
Dec 1
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
,
Dec 5
|
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Nov 13Labels: ClusterFuzz-Auto-CC