New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 904909 link

Starred by 2 users

Issue metadata

Status: Started
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in FindInvArSpec

Project Member Reported by ClusterFuzz, Nov 13

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6255955862618112

Fuzzer: libFuzzer_audio_decoder_isac_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  FindInvArSpec
  WebRtcIsac_DecodeSpec
  WebRtcIsac_DecodeLb
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6255955862618112

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 13

Cc: kwiberg@webrtc.org mflodman@webrtc.org henrika@webrtc.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Cc: kkaluri@chromium.org
Labels: Test-Predator-Wrong CF-NeedsTriage
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue.

Thanks!
Components: Blink>WebRTC
Components: -Blink>WebRTC Blink>WebRTC>Audio
Owner: jonasolsson@chromium.org
Status: Started (was: Untriaged)
Project Member

Comment 6 by bugdroid1@chromium.org, Nov 26

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/622eedaf0fd3362b05085b7dfbd1b986bb072dce

commit 622eedaf0fd3362b05085b7dfbd1b986bb072dce
Author: Jonas Olsson <jonasolsson@webrtc.org>
Date: Mon Nov 26 16:16:50 2018

Bump variable sizes in response to fuzzer bug

The fuzzers detected a possible overflow in the multiplication of sum and gainQ10.
Since gainQ10 cannot be larger than 2048000 (see WebRtcIsac_kQGain2Levels) and sum cannot be larger than 2^16, a int64 is large enough to hold the result.

Bug: chromium:904909
Change-Id: Icb12821d4006aaaaf70a5735d2abd2b96f7a2f0e
Reviewed-on: https://webrtc-review.googlesource.com/c/111921
Reviewed-by: Ivo Creusen <ivoc@webrtc.org>
Commit-Queue: Jonas Olsson <jonasolsson@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#25787}
[modify] https://crrev.com/622eedaf0fd3362b05085b7dfbd1b986bb072dce/modules/audio_coding/codecs/isac/main/source/entropy_coding.c

Project Member

Comment 7 by bugdroid1@chromium.org, Nov 27

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d3403a1bb6bf08fdd9b4dec5ec6b30ef4f77e89c

commit d3403a1bb6bf08fdd9b4dec5ec6b30ef4f77e89c
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Tue Nov 27 18:05:18 2018

Roll src/third_party/webrtc f1c194decd51..6b3d18164b4a (21 commits)

https://webrtc.googlesource.com/src.git/+log/f1c194decd51..6b3d18164b4a


git log f1c194decd51..6b3d18164b4a --date=short --no-merges --format='%ad %ae %s'
2018-11-27 terelius@webrtc.org Remove unused BWE field trial strings.
2018-11-27 kron@webrtc.org Add setters to ColorSpace class
2018-11-27 crodbro@webrtc.org Specific pacing configuration.
2018-11-27 ilnik@webrtc.org Various VP9 high fps fixes
2018-11-27 danilchap@webrtc.org Populate VideoSendTime extension network2 field when configured
2018-11-27 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 208bb982f7..81c26a093b (610939:611047)
2018-11-27 mbonadei@webrtc.org Fix wrong forward declaration namespace.
2018-11-26 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 00f78b5b14..208bb982f7 (610831:610939)
2018-11-26 michel.promonet.1@gmail.com add cstring include need for strncmp
2018-11-26 steveanton@webrtc.org Small cleanup to mediasession_unittest.cc
2018-11-26 ouj@fb.com Rebase std::is_trivially_* with absl::is_trivially_*
2018-11-26 jonasolsson@webrtc.org Bump variable sizes in response to fuzzer bug
2018-11-26 saza@webrtc.org Add AudioProcessingCaptureStats and a level estimator replacement
2018-11-26 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 7579fcbc1c..00f78b5b14 (610728:610831)
2018-11-26 nisse@webrtc.org Delete ChannelSend::RegisterTransport, replacing by construction argument
2018-11-26 phoglund@webrtc.org Add magjed as owner of rtc_tools.
2018-11-26 danilchap@webrtc.org In ReceiveStatistics use monotonic clock instead of ntp clock
2018-11-26 robin@opticaltone.com Add a new Task Queue for WinUWP.
2018-11-26 saza@webrtc.org Delete the WebRTC.Call.TimeSendingAudioRtpPacketsInSeconds metric
2018-11-26 danilchap@webrtc.org In ReceiveStatistic require callbacks during construction
2018-11-26 emircan@webrtc.org Reland Profile 2 to default profiles


Created with:
  gclient setdep -r src/third_party/webrtc@6b3d18164b4a

The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng

BUG=chromium:None,chromium:None,chromium:None,chromium:None,chromium:None,chromium:904909,chromium:None,chromium:None,chromium:None,chromium:None
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I1848d2b4a6fc7fd65655128454244ec7f0916727
Reviewed-on: https://chromium-review.googlesource.com/c/1352235
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#611184}
[modify] https://crrev.com/d3403a1bb6bf08fdd9b4dec5ec6b30ef4f77e89c/DEPS

Project Member

Comment 8 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 6255955862618112 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Labels: -CF-NeedsTriage

Sign in to add a comment