1492248 - UBSan: undefined-behavior media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1803:13

Reporter

Description

•

6 years ago

As discussed with drno on IRC marking this s-s until further investigated.


The following testcase crashes on mozilla-central revision 20180915-5d14d1e9f74d

m=o-<	5<	AAL2/ITU	AAL2/ITU	AAL2/ITU	s	AAL2/ITU	AAL2/ITUeli
0\

Backtrace:

NEW_PC: 0x7f2cf3d58990 in sdp_parse_multiple_profile_payload_types media/webrtc/signaling/src/sdp/sipcc/sdp_token.c

	NEW_PC: 0x7f2cf3d59220 in sdp_parse_multiple_profile_payload_types media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1801:5

#892686	RELOAD cov: 691 ft: 1726 corp: 827/16Kb lim: 58 exec/s: 2580 rss: 717Mb

#892740	REDUCE cov: 691 ft: 1726 corp: 827/16Kb lim: 58 exec/s: 2580 rss: 717Mb L: 39/58 MS: 1 EraseBytes-

#893304	REDUCE cov: 691 ft: 1726 corp: 827/16Kb lim: 58 exec/s: 2581 rss: 717Mb L: 30/58 MS: 2 ShuffleBytes-EraseBytes-

#893329	NEW    cov: 691 ft: 1728 corp: 828/16Kb lim: 58 exec/s: 2581 rss: 717Mb L: 58/58 MS: 2 CMP-CrossOver- DE: "\x14\x00\x00\x00"-

#893506	REDUCE cov: 691 ft: 1728 corp: 828/16Kb lim: 58 exec/s: 2582 rss: 717Mb L: 40/58 MS: 1 EraseBytes-

#894013	REDUCE cov: 691 ft: 1728 corp: 828/16Kb lim: 58 exec/s: 2583 rss: 717Mb L: 45/58 MS: 1 EraseBytes-

#895441	REDUCE cov: 691 ft: 1728 corp: 828/16Kb lim: 58 exec/s: 2580 rss: 717Mb L: 39/58 MS: 1 EraseBytes-

#896376	REDUCE cov: 691 ft: 1728 corp: 828/16Kb lim: 58 exec/s: 2583 rss: 717Mb L: 17/58 MS: 1 EraseBytes-

#898239	RELOAD cov: 691 ft: 1729 corp: 829/16Kb lim: 58 exec/s: 2581 rss: 717Mb

#900336	REDUCE cov: 691 ft: 1729 corp: 829/16Kb lim: 58 exec/s: 2579 rss: 717Mb L: 31/58 MS: 2 CopyPart-EraseBytes-

#900487	REDUCE cov: 691 ft: 1729 corp: 829/16Kb lim: 58 exec/s: 2580 rss: 717Mb L: 39/58 MS: 1 EraseBytes-

#900998	RELOAD cov: 691 ft: 1735 corp: 831/16Kb lim: 58 exec/s: 2581 rss: 717Mb

#902816	REDUCE cov: 691 ft: 1735 corp: 831/16Kb lim: 58 exec/s: 2579 rss: 717Mb L: 23/58 MS: 3 ChangeASCIIInt-ChangeBit-EraseBytes-

#903714	RELOAD cov: 691 ft: 1736 corp: 832/16Kb lim: 58 exec/s: 2582 rss: 717Mb

#903950	REDUCE cov: 691 ft: 1736 corp: 832/16Kb lim: 58 exec/s: 2582 rss: 718Mb L: 29/58 MS: 2 InsertRepeatedBytes-EraseBytes-

#904554	REDUCE cov: 691 ft: 1738 corp: 833/16Kb lim: 58 exec/s: 2584 rss: 718Mb L: 58/58 MS: 1 CopyPart-

#905458	REDUCE cov: 691 ft: 1738 corp: 833/16Kb lim: 58 exec/s: 2579 rss: 718Mb L: 15/58 MS: 1 EraseBytes-

#906432	RELOAD cov: 691 ft: 1741 corp: 836/16Kb lim: 58 exec/s: 2582 rss: 718Mb

#907257	REDUCE cov: 691 ft: 1741 corp: 836/16Kb lim: 58 exec/s: 2577 rss: 718Mb L: 16/58 MS: 1 EraseBytes-

#907566	REDUCE cov: 691 ft: 1741 corp: 836/16Kb lim: 58 exec/s: 2578 rss: 718Mb L: 6/58 MS: 1 EraseBytes-

#907586	REDUCE cov: 691 ft: 1741 corp: 836/16Kb lim: 58 exec/s: 2578 rss: 718Mb L: 46/58 MS: 1 EraseBytes-

#908297	REDUCE cov: 691 ft: 1741 corp: 836/16Kb lim: 58 exec/s: 2580 rss: 718Mb L: 36/58 MS: 1 EraseBytes-

#909011	REDUCE cov: 691 ft: 1741 corp: 836/16Kb lim: 58 exec/s: 2582 rss: 718Mb L: 17/58 MS: 1 EraseBytes-

#911848	RELOAD cov: 691 ft: 1742 corp: 837/16Kb lim: 58 exec/s: 2583 rss: 718Mb

#911969	REDUCE cov: 691 ft: 1742 corp: 837/16Kb lim: 58 exec/s: 2583 rss: 718Mb L: 26/58 MS: 2 CMP-EraseBytes- DE: "o="-

#912920	REDUCE cov: 691 ft: 1742 corp: 837/16Kb lim: 58 exec/s: 2578 rss: 718Mb L: 52/58 MS: 2 ChangeByte-EraseBytes-

#914208	REDUCE cov: 691 ft: 1742 corp: 837/16Kb lim: 58 exec/s: 2582 rss: 718Mb L: 15/58 MS: 1 EraseBytes-

#914503	RELOAD cov: 691 ft: 1747 corp: 839/16Kb lim: 58 exec/s: 2576 rss: 718Mb

#916943	REDUCE cov: 691 ft: 1747 corp: 839/16Kb lim: 58 exec/s: 2582 rss: 718Mb L: 37/58 MS: 1 EraseBytes-

	NEW_PC: 0x7f2cf3d303f0 in sdp_parse_attr_extmap media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c:4933:5

	NEW_PC: 0x7f2cf3d56e3b in sdp_parse_media media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1208:56

	NEW_PC: 0x7f2cf3d5731b in sdp_parse_media media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1363:54

	NEW_PC: 0x7f2cf3d5736f in sdp_parse_media media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1381:34

#917174	RELOAD cov: 695 ft: 1752 corp: 842/17Kb lim: 58 exec/s: 2576 rss: 718Mb

#917263	REDUCE cov: 695 ft: 1752 corp: 842/17Kb lim: 58 exec/s: 2576 rss: 718Mb L: 40/58 MS: 1 EraseBytes-

#917851	REDUCE cov: 695 ft: 1752 corp: 842/17Kb lim: 58 exec/s: 2578 rss: 718Mb L: 21/58 MS: 1 EraseBytes-

#918588	REDUCE cov: 695 ft: 1752 corp: 842/17Kb lim: 58 exec/s: 2580 rss: 718Mb L: 11/58 MS: 1 EraseBytes-

#918775	REDUCE cov: 695 ft: 1752 corp: 842/17Kb lim: 58 exec/s: 2580 rss: 718Mb L: 18/58 MS: 2 ChangeBit-EraseBytes-

	NEW_PC: 0x7f2cf3d4db5f in sdp_parse media/webrtc/signaling/src/sdp/sipcc/sdp_main.c:1097:13

	NEW_PC: 0x7f2cf3d51200 in sdp_parse_sessinfo media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:334:13

	NEW_PC: 0x7f2cf3d5110c in sdp_parse_sessinfo media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:335:20

#919835	RELOAD cov: 698 ft: 1757 corp: 843/17Kb lim: 58 exec/s: 2576 rss: 718Mb

#919909	REDUCE cov: 698 ft: 1757 corp: 843/17Kb lim: 58 exec/s: 2576 rss: 718Mb L: 36/58 MS: 1 EraseBytes-

#921493	REDUCE cov: 698 ft: 1757 corp: 843/17Kb lim: 58 exec/s: 2581 rss: 718Mb L: 38/58 MS: 1 EraseBytes-

	NEW_PC: 0x7f2cf3d58860 in sdp_parse_multiple_profile_payload_types media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1743:13

#922521	RELOAD cov: 699 ft: 1765 corp: 846/17Kb lim: 58 exec/s: 2576 rss: 718Mb

#922636	REDUCE cov: 699 ft: 1765 corp: 846/17Kb lim: 58 exec/s: 2577 rss: 718Mb L: 42/63 MS: 2 ChangeByte-EraseBytes-

#922657	REDUCE cov: 699 ft: 1765 corp: 846/17Kb lim: 58 exec/s: 2577 rss: 718Mb L: 40/63 MS: 3 CMP-ChangeBit-EraseBytes- DE: "selinuxfs"-

#924098	REDUCE cov: 699 ft: 1765 corp: 846/17Kb lim: 58 exec/s: 2581 rss: 718Mb L: 22/63 MS: 1 EraseBytes-

	NEW_PC: 0x7f2cf3d4dc48 in sdp_parse media/webrtc/signaling/src/sdp/sipcc/sdp_main.c:1015:5

#925230	RELOAD cov: 700 ft: 1766 corp: 847/17Kb lim: 58 exec/s: 2577 rss: 718Mb

#925687	REDUCE cov: 700 ft: 1766 corp: 847/17Kb lim: 58 exec/s: 2578 rss: 718Mb L: 13/63 MS: 1 EraseBytes-

#927954	RELOAD cov: 700 ft: 1767 corp: 848/17Kb lim: 58 exec/s: 2577 rss: 718Mb

#928235	REDUCE cov: 700 ft: 1767 corp: 848/17Kb lim: 58 exec/s: 2578 rss: 718Mb L: 37/63 MS: 1 EraseBytes-

#930647	RELOAD cov: 700 ft: 1768 corp: 849/17Kb lim: 58 exec/s: 2577 rss: 718Mb

#932175	REDUCE cov: 700 ft: 1768 corp: 849/17Kb lim: 58 exec/s: 2575 rss: 718Mb L: 26/63 MS: 2 ChangeBinInt-EraseBytes-

#932353	REDUCE cov: 700 ft: 1768 corp: 849/17Kb lim: 58 exec/s: 2575 rss: 718Mb L: 15/63 MS: 1 EraseBytes-

#933209	REDUCE cov: 700 ft: 1768 corp: 849/17Kb lim: 58 exec/s: 2577 rss: 718Mb L: 14/63 MS: 1 EraseBytes-

#933366	RELOAD cov: 700 ft: 1776 corp: 851/17Kb lim: 58 exec/s: 2578 rss: 718Mb

	NEW_PC: 0x7f2cf3d571a5 in sdp_parse_media media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1425:9

#935527	REDUCE cov: 701 ft: 1792 corp: 852/17Kb lim: 58 exec/s: 2577 rss: 718Mb L: 52/63 MS: 1 CopyPart-

#936075	RELOAD cov: 701 ft: 1799 corp: 857/17Kb lim: 58 exec/s: 2571 rss: 718Mb

#938824	RELOAD cov: 701 ft: 1800 corp: 858/17Kb lim: 58 exec/s: 2572 rss: 718Mb

#939848	REDUCE cov: 701 ft: 1801 corp: 859/17Kb lim: 58 exec/s: 2574 rss: 718Mb L: 57/63 MS: 1 CopyPart-

#940682	REDUCE cov: 701 ft: 1802 corp: 860/17Kb lim: 58 exec/s: 2577 rss: 718Mb L: 57/63 MS: 1 CopyPart-

#941499	RELOAD cov: 701 ft: 1804 corp: 862/17Kb lim: 58 exec/s: 2572 rss: 718Mb

#944144	REDUCE cov: 701 ft: 1804 corp: 862/17Kb lim: 58 exec/s: 2572 rss: 718Mb L: 34/63 MS: 1 EraseBytes-

#944202	RELOAD cov: 701 ft: 1809 corp: 865/18Kb lim: 58 exec/s: 2572 rss: 718Mb

#944257	REDUCE cov: 701 ft: 1809 corp: 865/18Kb lim: 58 exec/s: 2572 rss: 718Mb L: 33/66 MS: 1 EraseBytes-

#945630	REDUCE cov: 701 ft: 1809 corp: 865/18Kb lim: 58 exec/s: 2576 rss: 718Mb L: 21/66 MS: 1 EraseBytes-

#945658	REDUCE cov: 701 ft: 1809 corp: 865/18Kb lim: 58 exec/s: 2576 rss: 718Mb L: 56/66 MS: 1 EraseBytes-

#945970	REDUCE cov: 701 ft: 1809 corp: 865/18Kb lim: 58 exec/s: 2570 rss: 718Mb L: 30/66 MS: 2 InsertRepeatedBytes-EraseBytes-

#946882	RELOAD cov: 701 ft: 1810 corp: 866/18Kb lim: 58 exec/s: 2573 rss: 718Mb

#946965	REDUCE cov: 701 ft: 1810 corp: 866/18Kb lim: 58 exec/s: 2573 rss: 718Mb L: 11/66 MS: 1 EraseBytes-

#947386	REDUCE cov: 701 ft: 1810 corp: 866/18Kb lim: 58 exec/s: 2574 rss: 718Mb L: 29/66 MS: 1 EraseBytes-

#947520	REDUCE cov: 701 ft: 1810 corp: 866/18Kb lim: 58 exec/s: 2574 rss: 718Mb L: 16/66 MS: 2 ChangeASCIIInt-EraseBytes-

#947793	REDUCE cov: 701 ft: 1810 corp: 866/18Kb lim: 58 exec/s: 2575 rss: 718Mb L: 36/66 MS: 1 EraseBytes-

#949107	REDUCE cov: 701 ft: 1810 corp: 866/18Kb lim: 58 exec/s: 2572 rss: 718Mb L: 21/66 MS: 1 EraseBytes-

#949642	RELOAD cov: 701 ft: 1813 corp: 869/18Kb lim: 58 exec/s: 2573 rss: 718Mb

#949925	REDUCE cov: 701 ft: 1813 corp: 869/18Kb lim: 58 exec/s: 2574 rss: 718Mb L: 51/66 MS: 2 ChangeBit-EraseBytes-

#950181	REDUCE cov: 701 ft: 1813 corp: 869/18Kb lim: 58 exec/s: 2575 rss: 718Mb L: 12/66 MS: 1 EraseBytes-

#952437	RELOAD cov: 701 ft: 1837 corp: 873/18Kb lim: 58 exec/s: 2574 rss: 718Mb

#952579	REDUCE cov: 701 ft: 1838 corp: 874/18Kb lim: 58 exec/s: 2574 rss: 718Mb L: 54/66 MS: 1 CopyPart-

#954185	REDUCE cov: 701 ft: 1838 corp: 874/18Kb lim: 58 exec/s: 2571 rss: 718Mb L: 20/66 MS: 1 EraseBytes-

#954304	REDUCE cov: 701 ft: 1838 corp: 874/18Kb lim: 58 exec/s: 2572 rss: 718Mb L: 23/66 MS: 1 EraseBytes-

#954598	REDUCE cov: 701 ft: 1838 corp: 874/18Kb lim: 58 exec/s: 2573 rss: 718Mb L: 18/66 MS: 1 EraseBytes-

#955030	REDUCE cov: 701 ft: 1838 corp: 874/18Kb lim: 58 exec/s: 2574 rss: 718Mb L: 18/66 MS: 2 InsertRepeatedBytes-EraseBytes-

	NEW_PC: 0x7f2cf3d4db77 in sdp_parse media/webrtc/signaling/src/sdp/sipcc/sdp_main.c:1097:13

	NEW_PC: 0x7f2cf3d5529a in sdp_parse_encryption media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1011:30

#955065	RELOAD cov: 703 ft: 1846 corp: 878/18Kb lim: 58 exec/s: 2574 rss: 718Mb

#956900	REDUCE cov: 703 ft: 1846 corp: 878/18Kb lim: 58 exec/s: 2572 rss: 718Mb L: 21/66 MS: 1 EraseBytes-

#957279	REDUCE cov: 703 ft: 1846 corp: 878/18Kb lim: 58 exec/s: 2573 rss: 718Mb L: 52/66 MS: 3 ChangeBit-ShuffleBytes-EraseBytes-

#957464	REDUCE cov: 703 ft: 1846 corp: 878/18Kb lim: 58 exec/s: 2573 rss: 718Mb L: 23/66 MS: 1 EraseBytes-

	NEW_PC: 0x7f2cf3d4db8f in sdp_parse media/webrtc/signaling/src/sdp/sipcc/sdp_main.c:1097:13

	NEW_PC: 0x7f2cf3d53ca4 in sdp_parse_bandwidth media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:736:25

	NEW_PC: 0x7f2cf3d56acb in sdp_parse_media media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1253:56

#957743	RELOAD cov: 706 ft: 1854 corp: 881/18Kb lim: 58 exec/s: 2567 rss: 719Mb

#958378	REDUCE cov: 706 ft: 1854 corp: 881/18Kb lim: 58 exec/s: 2569 rss: 719Mb L: 40/67 MS: 1 EraseBytes-

#960296	REDUCE cov: 706 ft: 1855 corp: 882/19Kb lim: 58 exec/s: 2567 rss: 719Mb L: 45/67 MS: 1 CopyPart-

#962531	NEW    cov: 706 ft: 1856 corp: 883/19Kb lim: 58 exec/s: 2566 rss: 719Mb L: 64/67 MS: 1 CopyPart-

#963169	RELOAD cov: 706 ft: 1861 corp: 885/19Kb lim: 58 exec/s: 2568 rss: 719Mb

#964197	REDUCE cov: 706 ft: 1861 corp: 885/19Kb lim: 58 exec/s: 2571 rss: 720Mb L: 42/67 MS: 1 EraseBytes-

#965918	RELOAD cov: 706 ft: 1872 corp: 888/19Kb lim: 58 exec/s: 2568 rss: 720Mb

	NEW_PC: 0x7f2cf3d59427 in sdp_parse_multiple_profile_payload_types media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1743:13

#968701	RELOAD cov: 707 ft: 1875 corp: 891/19Kb lim: 58 exec/s: 2569 rss: 720Mb

#969853	REDUCE cov: 707 ft: 1875 corp: 891/19Kb lim: 63 exec/s: 2565 rss: 720Mb L: 15/67 MS: 2 ShuffleBytes-EraseBytes-

#970161	REDUCE cov: 707 ft: 1875 corp: 891/19Kb lim: 63 exec/s: 2566 rss: 720Mb L: 37/67 MS: 1 EraseBytes-

#971126	REDUCE cov: 707 ft: 1875 corp: 891/19Kb lim: 63 exec/s: 2569 rss: 720Mb L: 30/67 MS: 2 InsertRepeatedBytes-EraseBytes-

#971153	REDUCE cov: 707 ft: 1875 corp: 891/19Kb lim: 63 exec/s: 2569 rss: 720Mb L: 19/67 MS: 1 EraseBytes-

#971457	RELOAD cov: 707 ft: 1879 corp: 892/19Kb lim: 63 exec/s: 2569 rss: 720Mb

#971470	REDUCE cov: 707 ft: 1879 corp: 892/19Kb lim: 63 exec/s: 2570 rss: 720Mb L: 45/68 MS: 2 ChangeASCIIInt-EraseBytes-

#972247	REDUCE cov: 707 ft: 1879 corp: 892/19Kb lim: 63 exec/s: 2565 rss: 720Mb L: 37/68 MS: 1 EraseBytes-

#973681	REDUCE cov: 707 ft: 1879 corp: 892/19Kb lim: 63 exec/s: 2569 rss: 720Mb L: 16/68 MS: 1 EraseBytes-

#974267	RELOAD cov: 707 ft: 1881 corp: 894/19Kb lim: 63 exec/s: 2570 rss: 720Mb

#976258	REDUCE cov: 707 ft: 1881 corp: 894/19Kb lim: 63 exec/s: 2569 rss: 720Mb L: 51/68 MS: 5 ChangeBit-CopyPart-ChangeASCIIInt-ShuffleBytes-EraseBytes-

#976747	REDUCE cov: 707 ft: 1881 corp: 894/19Kb lim: 63 exec/s: 2570 rss: 720Mb L: 38/68 MS: 1 EraseBytes-

	NEW_PC: 0x7f2cf3d519c6 in sdp_parse_connection media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:465:16

#977061	RELOAD cov: 708 ft: 1887 corp: 896/19Kb lim: 63 exec/s: 2564 rss: 720Mb

#977124	REDUCE cov: 708 ft: 1887 corp: 896/19Kb lim: 63 exec/s: 2564 rss: 720Mb L: 14/68 MS: 1 EraseBytes-

media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1803:13: runtime error: index 3 out of bounds for type 'uint16_t [3]'

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1803:13 in 

MS: 1 CopyPart-; base unit: f4df35b7304b4f5e286ab1cf0f653fa0a62f106c

0x6d,0x3d,0x6f,0x2d,0x3c,0x9,0x35,0x3c,0x9,0x41,0x41,0x4c,0x32,0x2f,0x49,0x54,0x55,0x9,0x41,0x41,0x4c,0x32,0x2f,0x49,0x54,0x55,0x9,0x41,0x41,0x4c,0x32,0x2f,0x49,0x54,0x55,0x9,0x73,0x9,0x41,0x41,0x4c,0x32,0x2f,0x49,0x54,0x55,0x9,0x41,0x41,0x4c,0x32,0x2f,0x49,0x54,0x55,0x65,0x6c,0x69,0xa,0x30,0x5c,

m=o-<\x095<\x09AAL2/ITU\x09AAL2/ITU\x09AAL2/ITU\x09s\x09AAL2/ITU\x09AAL2/ITUeli\x0a0\\

artifact_prefix='./'; Test unit written to ./crash-9f193dbdd77e7f00fcccce20840b9b9759aa1d4f

Base64: bT1vLTwJNTwJQUFMMi9JVFUJQUFMMi9JVFUJQUFMMi9JVFUJcwlBQUwyL0lUVQlBQUwyL0lUVWVsaQowXA==

Christoph Diehl [:posidron]

Reporter

Comment 1

•

6 years ago

Attached file libfuzzer-testcase — Details

Nils Ohlmeier [:drno]

Comment 2

•

6 years ago

Byron, can you please have a look at how bad this is?

Flags: needinfo?(docfaraday)

Byron Campen [:bwc]

Assignee

Comment 3

•

6 years ago

This particular error doesn't look very dangerous, because we're reading a uint16_t past the end of an array (there is another array in the struct after this), comparing it to 0, and if it is 0, logging some stuff that looks safe.

Flags: needinfo?(docfaraday)

Byron Campen [:bwc]

Assignee

Comment 4

•

6 years ago

If we want to fix this, I would recommend ripping out all the "profiles" stuff in that function, as opposed to trying to fix this code that we don't need.

Byron Campen [:bwc]

Assignee

Comment 5

•

6 years ago

https://treeherder.mozilla.org/#/jobs?repo=try&revision=c20215b147416f27b5740fc7e6fd7fc3d4f85e00

Byron Campen [:bwc]

Assignee

Updated

•

6 years ago

Assignee: nobody → docfaraday

Rank: 25

Priority: -- → P3

Byron Campen [:bwc]

Assignee

Comment 6

•

6 years ago

Attached file Bug 1492248: Remove AAL2 profile stuff from the sipcc parser. r?mjf — Details

Michael Froman [:mjf]

Comment 7

•

6 years ago

Comment on attachment 9010379 [details]
Bug 1492248: Remove AAL2 profile stuff from the sipcc parser. r?mjf

Michael Froman [:mjf] has approved the revision.

Attachment #9010379 - Flags: review+

Ryan VanderMeulen [:RyanVM]

Comment 8

•

6 years ago

Can you suggest a sec rating for this bug?
https://wiki.mozilla.org/Security_Severity_Ratings

Group: core-security → media-core-security

status-firefox62: --- → wontfix

status-firefox63: --- → affected

status-firefox64: --- → affected

status-firefox-esr60: --- → affected

Flags: needinfo?(docfaraday)

Byron Campen [:bwc]

Assignee

Comment 9

•

6 years ago

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)
> Can you suggest a sec rating for this bug?
> https://wiki.mozilla.org/Security_Severity_Ratings

Honestly, I don't think this needs to be a sec bug.

Flags: needinfo?(docfaraday)

Ryan VanderMeulen [:RyanVM]

Updated

•

6 years ago

Group: media-core-security

status-firefox-esr60: affected → wontfix

Pulsebot

Comment 10

•

6 years ago

Pushed by bcampen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/35986c5568f6
Remove AAL2 profile stuff from the sipcc parser. r=mjf

Andreea Pavel [:apavel]

Comment 11

•

6 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/35986c5568f6

Status: NEW → RESOLVED

Closed: 6 years ago

status-firefox64: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla64

Pascal Chevrel:pascalc (PTO until April 26)

Comment 12

•

6 years ago

Byron, 63 is marked as affected, do you think that your patch would be safe to uplift to 63 beta or should it ride the trains? Thanks

Flags: needinfo?(docfaraday)

Byron Campen [:bwc]

Assignee

Comment 13

•

6 years ago

It would be safe, but it honestly won't make much difference to an end user, so let's let it ride the trains.

Flags: needinfo?(docfaraday)

Pascal Chevrel:pascalc (PTO until April 26)

Comment 14

•

6 years ago

Thanks Byron, marking as wontfix for 63 then.

status-firefox63: affected → wontfix

libfuzzer-testcase 6 years ago Christoph Diehl [:posidron] 61 bytes, application/octet-stream		Details
Bug 1492248: Remove AAL2 profile stuff from the sipcc parser. r?mjf 6 years ago Byron Campen [:bwc] 46 bytes, text/x-phabricator-request	mjf : review+	Details \| Review

Bugzilla

Quick Search

UBSan: undefined-behavior media/webrtc/signaling/src/sdp/sipcc/sdp_token.c:1803:13

Categories

(Core :: WebRTC: Signaling, defect, P3)

Tracking

()

People

(Reporter: posidron, Assigned: bwc)

References

Details

(Keywords: crash, testcase)

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Updated

Comment 6

Comment 7

Comment 8

Comment 9

Updated

Comment 10

Comment 11

Comment 12

Comment 13

Comment 14

Attachment

General

Description

File Name

Content Type