Null-dereference READ in webrtc::video_coding::DecodedFramesHistory::InsertDecoded |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5122459971616768 Fuzzer: libFuzzer_frame_buffer2_fuzzer Fuzz target binary: frame_buffer2_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: webrtc::video_coding::DecodedFramesHistory::InsertDecoded webrtc::video_coding::FrameBuffer::NextFrame webrtc::FuzzOneInput Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=622697:622701 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5122459971616768 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
,
Jan 15
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
Jan 15
Automatically adding ccs based on suspected regression changelists: Introduce DecodedFramesHistory class and use it in FrameBuffer by ilnik@webrtc.org - https://webrtc.googlesource.com/src/+/13717842dfcf39c310ad5825fa0689511a922dd4 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jan 15
I've identified the problem. The required call sequence is impossible in prod. However, I am preparing a fix right away.
,
Jan 15
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/49ea47b90e570644a23abfb3f307a1eeb4cecce5 commit 49ea47b90e570644a23abfb3f307a1eeb4cecce5 Author: Ilya Nikolaevskiy <ilnik@webrtc.org> Date: Tue Jan 15 10:26:13 2019 Fix fuzzer identified crash in DecodeFramesHistory Bug: chromium:921933 ,chromium:921935 Change-Id: I10f2a4783a717d9541bfc9f9bc0c76eaa2e62f30 Reviewed-on: https://webrtc-review.googlesource.com/c/117562 Commit-Queue: Ilya Nikolaevskiy <ilnik@webrtc.org> Reviewed-by: Sergey Silkin <ssilkin@webrtc.org> Cr-Commit-Position: refs/heads/master@{#26258} [modify] https://crrev.com/49ea47b90e570644a23abfb3f307a1eeb4cecce5/modules/video_coding/utility/decoded_frames_history.cc [modify] https://crrev.com/49ea47b90e570644a23abfb3f307a1eeb4cecce5/modules/video_coding/utility/decoded_frames_history_unittest.cc
,
Jan 15
Can anyone please add ilnik@chromium.org to cc? I can't edit anything with my webrtc account and my chromioum doesn't have access to this issue.
,
Jan 16
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/256f7db493ba0c6a2e9be58980280efffb4dc778 commit 256f7db493ba0c6a2e9be58980280efffb4dc778 Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Wed Jan 16 02:13:53 2019 Roll src/third_party/webrtc dcfe484f2e12..ccc1b57e32bd (20 commits) https://webrtc.googlesource.com/src.git/+log/dcfe484f2e12..ccc1b57e32bd git log dcfe484f2e12..ccc1b57e32bd --date=short --no-merges --format='%ad %ae %s' 2019-01-15 mirtad@webrtc.org Poll is_hardware_accelerated from VideoEncoder instead of VideoEncoderFactory. 2019-01-15 mbonadei@webrtc.org Fix rtc_media_unittests deps ( crbug.com/908819 is now fixed). 2019-01-15 mbonadei@webrtc.org Remove comments about using std::shared_ptr. 2019-01-15 nisse@webrtc.org Delete setting of unused variable nack_window_ms 2019-01-15 ilnik@webrtc.org Revert "Ensure correct decoding for unfiltered KSVC streams" 2019-01-15 eladalon@webrtc.org Avoid repeated semi-expensive field_trials read in frame_buffer2.cc 2019-01-15 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 783044b798..c6a258bb5d (621838:622808) 2019-01-15 alessiob@webrtc.org RNN VAD: fix pitch gain type and change pitch period type 2019-01-15 ilnik@webrtc.org Fix fuzzer identified crash in DecodeFramesHistory 2019-01-15 mbonadei@webrtc.org Roll //third_party/ffmpeg and disable H264 when MSVC is used. 2019-01-15 nisse@webrtc.org Don't set the screenshare flag on FakeVideoCapturerWithTaskQueue 2019-01-15 benwright@webrtc.org Added JSON generator for VideoReceiveStream::Config objects. 2019-01-14 qiangchen@chromium.org Bug Fix: iOS H264 Encoder Crash Issue 2019-01-14 mbonadei@webrtc.org Remove unused methods from cricket::BaseChannel. 2019-01-14 benwright@webrtc.org Move VideoStreamReceiver JSON configuration parser to test source_set. 2019-01-14 titovartem@webrtc.org Introduce EncodedImageIdInjector. 2019-01-14 benwright@webrtc.org Add benwright@webrtc.org to test/fuzzers/OWNERS. 2019-01-14 mbonadei@webrtc.org Remove unneeded deps from api:call_api. 2019-01-14 saza@webrtc.org Add noise suppression settings to AudioProcessing::Config 2019-01-14 ilnik@webrtc.org Ensure correct decoding for unfiltered KSVC streams Created with: gclient setdep -r src/third_party/webrtc@ccc1b57e32bd The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng BUG= chromium:908819 ,chromium:912122,chromium:None,chromium:921933,chromium:921935,chromium:912122 TBR=webrtc-chromium-sheriffs-robots@google.com Change-Id: I7068ef84a375456cd908cf3041393a4fe562513e Reviewed-on: https://chromium-review.googlesource.com/c/1412801 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#623039} [modify] https://crrev.com/256f7db493ba0c6a2e9be58980280efffb4dc778/DEPS
,
Jan 16
(6 days ago)
ClusterFuzz has detected this issue as fixed in range 623008:623051. Detailed report: https://clusterfuzz.com/testcase?key=5122459971616768 Fuzzer: libFuzzer_frame_buffer2_fuzzer Fuzz target binary: frame_buffer2_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: webrtc::video_coding::DecodedFramesHistory::InsertDecoded webrtc::video_coding::FrameBuffer::NextFrame webrtc::FuzzOneInput Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=622697:622701 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=623008:623051 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5122459971616768 See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 16
(6 days ago)
ClusterFuzz testcase 5122459971616768 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Jan 15