New issue
Advanced search Search tips

Issue 906392 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocked on:
issue 916298



Sign in to add a comment

Null-dereference READ in av_encryption_info_add_side_data

Project Member Reported by ClusterFuzz, Nov 17

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5072694221209600

Fuzzer: libFuzzer_audio_decoder_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000018
Crash State:
  av_encryption_info_add_side_data
  cenc_filter
  mov_read_packet
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=582232:582258

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5072694221209600

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 17

Components: Internals>Media>FFmpeg
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 17

Cc: mmoroz@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Nov 17

Cc: modma...@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

libavutil/encryption_info: Add unit tests. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/69bd73b3ff873abb43de9db062b04425de153643

libavutil/encryption_info: Allow multiple init info. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/b86c5757a2bf2a589b3982d6b85401165deb4958

avformat/mov: Expose encryption info to the app. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/7e22f5d457fa042292741c1f5c38232ba10dbea2

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Owner: chcunningham@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 5 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5072694221209600 appears to be flaky, updating reproducibility label.
Project Member

Comment 6 by ClusterFuzz, Dec 1

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5072694221209600 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Unreproducible Reproducible
Status: Assigned (was: WontFix)
Sorry for the inconvenience.
Blocking: 916298
Project Member

Comment 9 by bugdroid1@chromium.org, Dec 27

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/7954815a61c424c51ffc96101807809a1cd733b6

commit 7954815a61c424c51ffc96101807809a1cd733b6
Author: Jacob Trimble <modmaker@google.com>
Date: Thu Dec 27 19:48:13 2018

libavformat/mov: Fix NULL-dereference read for some encrypted content.

When reading frames, we need to use the fragment for the correct
stream.  Sometimes the "current" fragment is not the same as the one
the frame is for.

Bug: 906392
Bug:  915524 
Change-Id: I5ad5799ea9f966573d00fc8ef746446bfff85a16
Reviewed-on: https://chromium-review.googlesource.com/c/1385044
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Frank Liberato <liberato@chromium.org>

[modify] https://crrev.com/7954815a61c424c51ffc96101807809a1cd733b6/libavformat/mov.c

Blocking: -916298
Blockedon: 916298

Sign in to add a comment