forked from n132/ARVO-Meta
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path10574.json
168 lines (168 loc) · 13.8 KB
/
10574.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
{
"fix": "https://aomedia.googlesource.com/aom/+/2dffbafc910846896f1fb77b4a47173ba26f781e%5E%21/",
"verify": "0",
"localId": 10574,
"project": "aom",
"fuzzer": "libfuzzer",
"sanitizer": "ubsan",
"crash_type": "Index-out-of-bounds",
"severity": "Medium",
"report": {
"comments": [
{
"projectName": "oss-fuzz",
"localId": 10574,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537499865,
"content": "Detailed report: https://oss-fuzz.com/testcase?key=5173013356478464\n\nProject: libaom\nFuzzer: libFuzzer_libaom_av1_dec_fuzzer\nFuzz target binary: av1_dec_fuzzer\nJob Type: libfuzzer_ubsan_libaom\nPlatform Id: linux\n\nCrash Type: Index-out-of-bounds\nCrash Address: \nCrash State:\n filter_selectively_horiz\n av1_filter_block_plane_bitmask_horz\n av1_loop_filter_frame\n \nSanitizer: undefined (UBSAN)\n\nRecommended Security Severity: Medium\n\nRegressed: https://oss-fuzz.com/revisions?job=libfuzzer_ubsan_libaom&range=201809200127:201809210123\n\nReproducer Testcase: https://oss-fuzz.com/download?testcase_id=5173013356478464\n\nIssue filed automatically.\n\nSee https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md for more information.\n\nThis bug is subject to a 90 day disclosure deadline. If 90 days elapse\nwithout an upstream patch, then the bug report will automatically\nbecome visible to the public.\n\nWhen you fix this bug, please\n * mention the fix revision(s).\n * state whether the bug was a short-lived regression or an old bug in any stable releases.\n * add any other useful information.\nThis information can help downstream consumers.\n\nIf you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at https://github.com/google/oss-fuzz/issues.",
"descriptionNum": 1
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 1,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537500550,
"amendments": [
{
"fieldName": "Labels",
"newOrDeltaValue": "OS-Linux"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 2,
"commenter": {
"userId": "171122292",
"displayName": "[email protected]"
},
"timestamp": 1537500962,
"content": "Cheng: Could you take a look at this fuzzing bug? It is in av1_loopfilter.c.\r\nI can help you reproduce the bug. Thanks!",
"amendments": [
{
"fieldName": "Owner",
"newOrDeltaValue": "[email protected]"
},
{
"fieldName": "Cc",
"newOrDeltaValue": "[email protected] [email protected]"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 3,
"commenter": {
"userId": "171122292",
"displayName": "[email protected]"
},
"timestamp": 1537555114,
"content": "Cheng:\r\n\r\nHere is some information from the debugger:\r\n\r\n#0 filter_selectively_horiz (s=0x7ffff469300c '\\200' <repeats 80 times>, \r\n pitch=528, plane=2, subsampling=1, mask_16x16=0, mask_8x8=0, mask_4x4=1, \r\n lfi_n=0x7ffff7f53460, \r\n lfl=0x7ffff4bca15f \";\", '\\377' <repeats 32 times>, \"\\021\\001\\021\\001\\021\\001\\021\\001\\001\\001\\001\\001\\001\\001\\001\\001Q\\021Q\\021Q\\021Q\\021QQQQQ\\021Q\\021\\377\\377\")\r\n at aom/av1/common/av1_loopfilter.c:1324\r\n#1 0x0000000000f90c49 in av1_filter_block_plane_bitmask_horz (\r\n cm=0x7ffff7f4dda0, plane_ptr=0x7ffff7f434c0, pl=2, mi_row=16, mi_col=64)\r\n at aom/av1/common/av1_loopfilter.c:1766\r\n#2 0x0000000000fa31ae in loop_filter_rows (frame_buffer=0x4bc5e20, \r\n cm=0x7ffff7f4dda0, xd=0x7ffff7f42020, start=0, stop=128, is_decoding=1, \r\n plane_start=0, plane_end=3)\r\n at aom/av1/common/av1_loopfilter.c:2379\r\n#3 0x0000000000fa23a5 in av1_loop_filter_frame (frame=0x4bc5e20, \r\n cm=0x7ffff7f4dda0, xd=0x7ffff7f42020, is_decoding=1, plane_start=0, \r\n plane_end=3, partial_frame=0)\r\n at aom/av1/common/av1_loopfilter.c:2466\r\n#4 0x00000000004b36cf in av1_decode_tg_tiles_and_wrapup (pbi=0x7ffff7f42020, \r\n data=0x4c45212 \"\\320\\375BR=>\\274\\377\\216\\371/\", data_end=0x4c4550c \"\", \r\n p_data_end=0x7fffffffbd70, start_tile=0, end_tile=0, initialize_flag=1)\r\n at aom/av1/decoder/decodeframe.c:5524\r\n#5 0x00000000005b86c7 in read_one_tile_group_obu (pbi=0x7ffff7f42020, \r\n rb=0x7fffffffb5f8, is_first_tg=1, \r\n data=0x4c45212 \"\\320\\375BR=>\\274\\377\\216\\371/\", data_end=0x4c4550c \"\", \r\n p_data_end=0x7fffffffbd70, is_last_tg=0x7fffffffb64c, \r\n tile_start_implicit=1)\r\n at aom/av1/decoder/obu.c:342\r\n#6 0x00000000005b1a56 in aom_decode_frame_from_obus (pbi=0x7ffff7f42020, \r\n data=0x4c451c5 \"1 I \\001\\320\\377\\377 \\274\", '\\377' <repeats 52 times>, \" \\377\\061\\006 \", data_end=0x4c4550c \"\", p_data_end=0x7fffffffbd70)\r\n at aom/av1/decoder/obu.c:783\r\n#7 0x0000000000590e1e in av1_receive_compressed_data (pbi=0x7ffff7f42020, \r\n size=844, psource=0x7fffffffbd70)\r\n at aom/av1/decoder/decoder.c:500\r\n#8 0x000000000048d0af in frame_worker_hook (arg1=0x4bb9fa0, arg2=0x0)\r\n at aom/av1/av1_dx_iface.c:357\r\n#9 0x0000000000f490e8 in execute (worker=0x4bb9f40)\r\n at aom/aom_util/aom_thread.c:153\r\n#10 0x000000000048caae in decode_one (ctx=0x4bbe000, data=0x7fffffffc360, \r\n data_sz=844, user_priv=0x0)\r\n at aom/av1/av1_dx_iface.c:516\r\n#11 0x0000000000472a50 in decoder_decode (ctx=0x4bbe000, \r\n data=0x4c451c0 \"\\022\", data_sz=844, user_priv=0x0)\r\n at aom/av1/av1_dx_iface.c:605\r\n#12 0x00000000004681cf in aom_codec_decode (ctx=0x7fffffffc570, \r\n data=0x4c451c0 \"\\022\", data_sz=844, user_priv=0x0)\r\n at aom/aom/src/aom_decoder.c:109\r\n#13 0x0000000000455bf9 in LLVMFuzzerTestOneInput (\r\n data=0x4bb99e0 ' ' <repeats 32 times>, \"0\", size=949)\r\n at oss-fuzz/projects/libaom/av1_dec_fuzzer.cc:53\r\n#14 0x0000000000418a21 in ExecuteCallback ()\r\n at /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:575\r\n#15 0x0000000000409303 in RunOneTest ()\r\n at /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:280\r\n#16 0x000000000040e222 in FuzzerDriver ()\r\n at /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:715\r\n#17 0x0000000000434cb3 in main ()\r\n at /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20\r\n(gdb) p step\r\n$10 = 2\r\n(gdb) p lfl[0]\r\n$11 = 59 ';'\r\n(gdb) p lfl[1]\r\n$12 = 255 '\\377'\r\n(gdb) p lfl[2]\r\n$13 = 255 '\\377'\r\n(gdb) p lfl[3]\r\n$14 = 255 '\\377'\r\n(gdb) p *(lfl + step)\r\n$15 = 255 '\\377'\r\n(gdb)"
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 4,
"commenter": {
"userId": "171122292",
"displayName": "[email protected]"
},
"timestamp": 1537555530,
"content": "More info from the debugger in the function one level up:\r\n\r\n(gdb) up\r\n#1 0x0000000000f90c49 in av1_filter_block_plane_bitmask_horz (\r\n cm=0x7ffff7f4dda0, plane_ptr=0x7ffff7f434c0, pl=2, mi_row=16, mi_col=64)\r\n at aom/av1/common/av1_loopfilter.c:1766\r\n1766\t filter_selectively_horiz(dst->buf, dst->stride, pl, ssx, mask_16x16,\r\n(gdb) p row\r\n$16 = 15\r\n(gdb) p col\r\n$17 = 1\r\n(gdb) p pl\r\n$18 = 2\r\n(gdb) p &lfm->lfl_v_hor[row][col]\r\n$19 = (uint8_t *) 0x7ffff4bca151 ';' <repeats 15 times>, '\\377' <repeats 32 times>, \"\\021\\001\\021\\001\\021\\001\\021\\001\\001\\001\\001\\001\\001\\001\\001\\001Q\\021Q\\021Q\\021Q\\021QQQQQ\\021Q\\021\\377\\377\"\r\n(gdb) p lfl\r\n$20 = (uint8_t *) 0x7ffff4bca151 ';' <repeats 15 times>, '\\377' <repeats 32 times>, \"\\021\\001\\021\\001\\021\\001\\021\\001\\001\\001\\001\\001\\001\\001\\001\\001Q\\021Q\\021Q\\021Q\\021QQQQQ\\021Q\\021\\377\\377\"\r\n(gdb) p cm->seq_params.use_highbitdepth\r\n$21 = 0\r\n(gdb) p row_stride\r\n$22 = 2112\r\n(gdb) p r\r\n$23 = 14\r\n(gdb) p ssx\r\n$24 = 1\r\n(gdb) p ssy\r\n$25 = 1\r\n(gdb) p row_step\r\n$26 = 2\r\n(gdb) p cm->width\r\n$27 = 465\r\n(gdb) p cm->height\r\n$28 = 512\r\n(gdb) p index\r\n$29 = 3\r\n(gdb) p shift\r\n$30 = 49\r\n(gdb) p mask_cutoff\r\n$31 = 65535\r\n(gdb)"
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 5,
"commenter": {
"userId": "171122292",
"displayName": "[email protected]"
},
"timestamp": 1537563553,
"amendments": [
{
"fieldName": "Status",
"newOrDeltaValue": "Started",
"oldValue": "New"
},
{
"fieldName": "Owner",
"newOrDeltaValue": "[email protected]"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 6,
"commenter": {
"userId": "3275348242",
"displayName": "[email protected]"
},
"timestamp": 1537570736,
"content": "The following revision refers to this bug:\n https://aomedia.googlesource.com/aom/+/2dffbafc910846896f1fb77b4a47173ba26f781e\n\ncommit 2dffbafc910846896f1fb77b4a47173ba26f781e\nAuthor: Cheng Chen <[email protected]>\nDate: Fri Sep 21 22:58:05 2018\n\nFix a fuzzer bug for loop filter bitmask\n\nHorizontal loop filter takes two edges to filter together.\nThis CL fix the bug where the next edge is out of bound of current\n64x64 block.\n\nBUG=oss-fuzz:10574\n\nChange-Id: I3fbe27ec1c33a1bb9728413b3b883539653b7fdb\n\n[modify] https://crrev.com/2dffbafc910846896f1fb77b4a47173ba26f781e/av1/common/av1_loopfilter.c\n"
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 7,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537599875,
"content": "ClusterFuzz has detected this issue as fixed in range 201809210123:201809220126.\n\nDetailed report: https://oss-fuzz.com/testcase?key=5173013356478464\n\nProject: libaom\nFuzzer: libFuzzer_libaom_av1_dec_fuzzer\nFuzz target binary: av1_dec_fuzzer\nJob Type: libfuzzer_ubsan_libaom\nPlatform Id: linux\n\nCrash Type: Index-out-of-bounds\nCrash Address: \nCrash State:\n filter_selectively_horiz\n av1_filter_block_plane_bitmask_horz\n av1_loop_filter_frame\n \nSanitizer: undefined (UBSAN)\n\nRecommended Security Severity: Medium\n\nRegressed: https://oss-fuzz.com/revisions?job=libfuzzer_ubsan_libaom&range=201809200127:201809210123\nFixed: https://oss-fuzz.com/revisions?job=libfuzzer_ubsan_libaom&range=201809210123:201809220126\n\nReproducer Testcase: https://oss-fuzz.com/download?testcase_id=5173013356478464\n\nSee https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md for more information.\n\nIf you suspect that the result above is incorrect, try re-doing that job on the test case report page."
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 8,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537600928,
"content": "ClusterFuzz testcase 5173013356478464 is verified as fixed, so closing issue as verified.\n\nIf this is incorrect, please file a bug on https://github.com/google/oss-fuzz/issues/new",
"amendments": [
{
"fieldName": "Status",
"newOrDeltaValue": "Verified",
"oldValue": "Started"
},
{
"fieldName": "Labels",
"newOrDeltaValue": "ClusterFuzz-Verified"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10574,
"sequenceNum": 9,
"commenter": {
"userId": "4164592774",
"displayName": "[email protected]"
},
"timestamp": 1540221874,
"content": "This bug has been fixed for 30 days. It has been opened to the public.\n\n- Your friendly Sheriffbot",
"amendments": [
{
"fieldName": "Labels",
"newOrDeltaValue": "-restrict-view-commit"
}
]
}
]
},
"fix_commit": "2dffbafc910846896f1fb77b4a47173ba26f781e",
"repo_addr": "https://aomedia.googlesource.com/aom"
}