New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 921933 link

Starred by 2 users

Issue metadata

Status: Verified
Owner: ----
Closed: Jan 16
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux , Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in webrtc::video_coding::DecodedFramesHistory::InsertDecoded

Project Member Reported by ClusterFuzz, Jan 15

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5122459971616768

Fuzzer: libFuzzer_frame_buffer2_fuzzer
Fuzz target binary: frame_buffer2_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  webrtc::video_coding::DecodedFramesHistory::InsertDecoded
  webrtc::video_coding::FrameBuffer::NextFrame
  webrtc::FuzzOneInput
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=622697:622701

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5122459971616768

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Jan 15

Labels: OS-Chrome
Project Member

Comment 2 by ClusterFuzz, Jan 15

Cc: kwiberg@webrtc.org niklas.enbom@webrtc.org stefan@webrtc.org mflodman@webrtc.org phoglund@webrtc.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jan 15

Cc: ilnik@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Introduce DecodedFramesHistory class and use it in FrameBuffer by ilnik@webrtc.org - https://webrtc.googlesource.com/src/+/13717842dfcf39c310ad5825fa0689511a922dd4

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
I've identified the problem. The required call sequence is impossible in prod. However, I am preparing a fix right away.
Project Member

Comment 5 by bugdroid1@chromium.org, Jan 15

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/49ea47b90e570644a23abfb3f307a1eeb4cecce5

commit 49ea47b90e570644a23abfb3f307a1eeb4cecce5
Author: Ilya Nikolaevskiy <ilnik@webrtc.org>
Date: Tue Jan 15 10:26:13 2019

Fix fuzzer identified crash in DecodeFramesHistory

Bug:  chromium:921933 ,chromium:921935
Change-Id: I10f2a4783a717d9541bfc9f9bc0c76eaa2e62f30
Reviewed-on: https://webrtc-review.googlesource.com/c/117562
Commit-Queue: Ilya Nikolaevskiy <ilnik@webrtc.org>
Reviewed-by: Sergey Silkin <ssilkin@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#26258}
[modify] https://crrev.com/49ea47b90e570644a23abfb3f307a1eeb4cecce5/modules/video_coding/utility/decoded_frames_history.cc
[modify] https://crrev.com/49ea47b90e570644a23abfb3f307a1eeb4cecce5/modules/video_coding/utility/decoded_frames_history_unittest.cc

Can anyone please add ilnik@chromium.org to cc? I can't edit anything with my webrtc account and my chromioum doesn't have access to this issue.
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 16

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/256f7db493ba0c6a2e9be58980280efffb4dc778

commit 256f7db493ba0c6a2e9be58980280efffb4dc778
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Wed Jan 16 02:13:53 2019

Roll src/third_party/webrtc dcfe484f2e12..ccc1b57e32bd (20 commits)

https://webrtc.googlesource.com/src.git/+log/dcfe484f2e12..ccc1b57e32bd


git log dcfe484f2e12..ccc1b57e32bd --date=short --no-merges --format='%ad %ae %s'
2019-01-15 mirtad@webrtc.org Poll is_hardware_accelerated from VideoEncoder instead of VideoEncoderFactory.
2019-01-15 mbonadei@webrtc.org Fix rtc_media_unittests deps ( crbug.com/908819  is now fixed).
2019-01-15 mbonadei@webrtc.org Remove comments about using std::shared_ptr.
2019-01-15 nisse@webrtc.org Delete setting of unused variable nack_window_ms
2019-01-15 ilnik@webrtc.org Revert "Ensure correct decoding for unfiltered KSVC streams"
2019-01-15 eladalon@webrtc.org Avoid repeated semi-expensive field_trials read in frame_buffer2.cc
2019-01-15 chromium-webrtc-autoroll@webrtc-ci.iam.gserviceaccount.com Roll chromium_revision 783044b798..c6a258bb5d (621838:622808)
2019-01-15 alessiob@webrtc.org RNN VAD: fix pitch gain type and change pitch period type
2019-01-15 ilnik@webrtc.org Fix fuzzer identified crash in DecodeFramesHistory
2019-01-15 mbonadei@webrtc.org Roll //third_party/ffmpeg and disable H264 when MSVC is used.
2019-01-15 nisse@webrtc.org Don't set the screenshare flag on FakeVideoCapturerWithTaskQueue
2019-01-15 benwright@webrtc.org Added JSON generator for VideoReceiveStream::Config objects.
2019-01-14 qiangchen@chromium.org Bug Fix: iOS H264 Encoder Crash Issue
2019-01-14 mbonadei@webrtc.org Remove unused methods from cricket::BaseChannel.
2019-01-14 benwright@webrtc.org Move VideoStreamReceiver JSON configuration parser to test source_set.
2019-01-14 titovartem@webrtc.org Introduce EncodedImageIdInjector.
2019-01-14 benwright@webrtc.org Add benwright@webrtc.org to test/fuzzers/OWNERS.
2019-01-14 mbonadei@webrtc.org Remove unneeded deps from api:call_api.
2019-01-14 saza@webrtc.org Add noise suppression settings to AudioProcessing::Config
2019-01-14 ilnik@webrtc.org Ensure correct decoding for unfiltered KSVC streams


Created with:
  gclient setdep -r src/third_party/webrtc@ccc1b57e32bd

The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng

BUG= chromium:908819 ,chromium:912122,chromium:None,chromium:921933,chromium:921935,chromium:912122
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I7068ef84a375456cd908cf3041393a4fe562513e
Reviewed-on: https://chromium-review.googlesource.com/c/1412801
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#623039}
[modify] https://crrev.com/256f7db493ba0c6a2e9be58980280efffb4dc778/DEPS

Project Member

Comment 8 by ClusterFuzz, Jan 16 (6 days ago)

ClusterFuzz has detected this issue as fixed in range 623008:623051.

Detailed report: https://clusterfuzz.com/testcase?key=5122459971616768

Fuzzer: libFuzzer_frame_buffer2_fuzzer
Fuzz target binary: frame_buffer2_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  webrtc::video_coding::DecodedFramesHistory::InsertDecoded
  webrtc::video_coding::FrameBuffer::NextFrame
  webrtc::FuzzOneInput
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=622697:622701
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=623008:623051

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5122459971616768

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jan 16 (6 days ago)

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 5122459971616768 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment