1584660 - addition of unsigned offset overflowed in media/webrtc/trunk/webrtc/common_audio/signal_processing/filter_ar_fast_q12.c

Status: RESOLVED DUPLICATE of bug 1583967

(Core :: WebRTC: Audio/Video, defect, P3)

Description

[Tyson Smith [:tsmith]]

This is triggered with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="pointer-overflow"
ac_add_options --disable-jemalloc

dom/media/tests/mochitest/test_peerConnection_webAudio.html
...
src/media/webrtc/trunk/webrtc/common_audio/signal_processing/filter_ar_fast_q12.c:32:32: runtime error: addition of unsigned offset to 0x7f2369047b8c overflowed to 0x7f2369047b80
    #0 0x7f2385910875 in WebRtcSpl_FilterARFastQ12 src/media/webrtc/trunk/webrtc/common_audio/signal_processing/filter_ar_fast_q12.c
    #1 0x7f2385a46e23 in webrtc::Expand::Process(webrtc::AudioMultiVector*) src/media/webrtc/trunk/webrtc/modules/audio_coding/neteq/expand.cc:209:5
    #2 0x7f2385a672eb in webrtc::NetEqImpl::DoExpand(bool) src/media/webrtc/trunk/webrtc/modules/audio_coding/neteq/neteq_impl.cc:1584:33
    #3 0x7f2385a5ae90 in webrtc::NetEqImpl::GetAudioInternal(webrtc::AudioFrame*, bool*) src/media/webrtc/trunk/webrtc/modules/audio_coding/neteq/neteq_impl.cc:899:22
    #4 0x7f2385a59a8b in webrtc::NetEqImpl::GetAudio(webrtc::AudioFrame*, bool*) src/media/webrtc/trunk/webrtc/modules/audio_coding/neteq/neteq_impl.cc:200:7
    #5 0x7f238598255b in webrtc::acm2::AcmReceiver::GetAudio(int, webrtc::AudioFrame*, bool*) src/media/webrtc/trunk/webrtc/modules/audio_coding/acm2/acm_receiver.cc:126:15
    #6 0x7f238598e79a in webrtc::(anonymous namespace)::AudioCodingModuleImpl::PlayoutData10Ms(int, webrtc::AudioFrame*, bool*) src/media/webrtc/trunk/webrtc/modules/audio_coding/acm2/audio_coding_module.cc:1108:17
    #7 0x7f2385e510cf in webrtc::voe::Channel::GetAudioFrameWithInfo(int, webrtc::AudioFrame*) src/media/webrtc/trunk/webrtc/voice_engine/channel.cc:760:22
    #8 0x7f237dfae489 in mozilla::WebrtcAudioConduit::GetAudioFrame(short*, int, int, int&) src/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp:616:22
    #9 0x7f237e0305e5 in mozilla::MediaPipelineReceiveAudio::PipelineListener::NotifyPullImpl(long) src/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp:1350:17
    #10 0x7f2381ce996b in mozilla::SourceMediaStream::PullNewData(long) src/dom/media/MediaStreamGraph.cpp:2535:22
    #11 0x7f2381ce808d in mozilla::MediaStreamGraphImpl::UpdateGraph(long) src/dom/media/MediaStreamGraph.cpp:1188:34
    #12 0x7f2381cebf7b in mozilla::MediaStreamGraphImpl::OneIterationImpl(long) src/dom/media/MediaStreamGraph.cpp:1403:3
    #13 0x7f2381abf030 in mozilla::AudioCallbackDriver::DataCallback(float const*, float*, long) src/dom/media/GraphDriver.cpp:882:36
    #14 0x7f238853c2ff in _$LT$audioipc_client..stream..CallbackServer$u20$as$u20$audioipc..rpc..server..Server$GT$::process::_$u7b$$u7b$closure$u7d$$u7d$::ha43956b0eea91cf4 src/media/audioipc/client/src/stream.rs:113:24
    #15 0x7f238853c2ff in futures::future::lazy::Lazy$LT$F$C$R$GT$::get::h07d3c7d5fa23492d src/third_party/rust/futures/src/future/lazy.rs:64
    #16 0x7f238853c2ff in _$LT$futures..future..lazy..Lazy$LT$F$C$R$GT$$u20$as$u20$futures..future..Future$GT$::poll::h04c8f2a4b37c4cc4 src/third_party/rust/futures/src/future/lazy.rs:82
    #17 0x7f238853c2ff in futures::future::catch_unwind::_$LT$impl$u20$futures..future..Future$u20$for$u20$std..panic..AssertUnwindSafe$LT$F$GT$$GT$::poll::hbc95ddcc43778203 src/third_party/rust/futures/src/future/catch_unwind.rs:49
    #18 0x7f238853c2ff in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::_$u7b$$u7b$closure$u7d$$u7d$::h88fae40ae17fead0 src/third_party/rust/futures/src/future/catch_unwind.rs:32
    #19 0x7f238853c2ff in std::panicking::try::do_call::hb53a138c07811070 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
    #20 0x7f238853c2ff in __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29
    #21 0x7f238853c2ff in std::panicking::try::haf1bcccc99281b03 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:275
    #22 0x7f238853c2ff in std::panic::catch_unwind::h4869e15ba6994726 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:394
    #23 0x7f238853c2ff in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::ha72049ee68bd070c src/third_party/rust/futures/src/future/catch_unwind.rs:32
    #24 0x7f238853c2ff in _$LT$futures_cpupool..MySender$LT$F$C$core..result..Result$LT$$LT$F$u20$as$u20$futures..future..Future$GT$..Item$C$$LT$F$u20$as$u20$futures..future..Future$GT$..Error$GT$$GT$$u20$as$u20$futures..future..Future$GT$::poll::h792cf0333f3aa894 src/third_party/rust/futures-cpupool/src/lib.rs:325
    #25 0x7f23885571e2 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::h54ddf78dbcbbe5d7 src/third_party/rust/futures/src/future/mod.rs:113:12
    #26 0x7f23885571e2 in futures::task_impl::Spawn$LT$T$GT$::poll_future_notify::_$u7b$$u7b$closure$u7d$$u7d$::h9087352d841f248c src/third_party/rust/futures/src/task_impl/mod.rs:289
    #27 0x7f23885571e2 in futures::task_impl::Spawn$LT$T$GT$::enter::_$u7b$$u7b$closure$u7d$$u7d$::hfb133f03c1046753 src/third_party/rust/futures/src/task_impl/mod.rs:363
    #28 0x7f23885571e2 in futures::task_impl::std::set::hb997ae7cc15a9b15 src/third_party/rust/futures/src/task_impl/std/mod.rs:78
    #29 0x7f23885571e2 in futures::task_impl::Spawn$LT$T$GT$::enter::h058bb783be7fc7a3 src/third_party/rust/futures/src/task_impl/mod.rs:363
    #30 0x7f23885571e2 in futures::task_impl::Spawn$LT$T$GT$::poll_future_notify::h74c95dca24aed8a8 src/third_party/rust/futures/src/task_impl/mod.rs:289
    #31 0x7f23885571e2 in futures::task_impl::std::Run::run::h1a0c4680ae006636 src/third_party/rust/futures/src/task_impl/std/mod.rs:450
    #32 0x7f23885571e2 in futures_cpupool::Inner::work::h4762dceb8410976a src/third_party/rust/futures-cpupool/src/lib.rs:257
    #33 0x7f23885571e2 in futures_cpupool::Builder::create::_$u7b$$u7b$closure$u7d$$u7d$::hce6c1b963e8c3ab1 src/third_party/rust/futures-cpupool/src/lib.rs:427
    #34 0x7f23885571e2 in std::sys_common::backtrace::__rust_begin_short_backtrace::hec0a26d17fbf8797 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/backtrace.rs:77
    #35 0x7f2388555f79 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::ha5c426bceccbf1ef /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:470:16
    #36 0x7f2388555f79 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h46726cdf78664f0c /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:315
    #37 0x7f2388555f79 in std::panicking::try::do_call::h96880815832064e4 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
    #38 0x7f2388555f79 in __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29
    #39 0x7f2388555f79 in std::panicking::try::h8eed1c6e8f11155c /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:275
    #40 0x7f2388555f79 in std::panic::catch_unwind::hf5c1edfc475e6579 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:394
    #41 0x7f2388555f79 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hba604fe8945ffb73 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:469
    #42 0x7f2388555f79 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h133f8224b7997b5a /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/ops/function.rs:231
    #43 0x7f2388c15b4d in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h42806b83647d4c79 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/liballoc/boxed.rs:746:8
    #44 0x7f2388c17df7 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h83c921c8e826dd1d /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/liballoc/boxed.rs:746:8
    #45 0x7f2388c17df7 in std::sys_common::thread::start_thread::h2613204ce513782e /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/thread.rs:13
    #46 0x7f2388c17df7 in std::sys::unix::thread::Thread::new::thread_start::h4570080769500bcd /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys/unix/thread.rs:79
    #47 0x7f239c8206b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #48 0x7f239b8a941c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Dan Minor [:dminor]]

I'll land the fix as part of Bug 1583967.