1587159 - undefined shift in media/webrtc/trunk/webrtc/modules/audio_coding/codecs/g722/g722_encode.c:78

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect, P2)

Description

[Tyson Smith [:tsmith]]

This is triggered with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="shift"
ac_add_options --disable-jemalloc

Found via test-linux64-asan/opt-mochitest-media-e10s-2

src/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/g722/g722_encode.c:78:39: runtime error: left shift of negative value -192
    #0 0x7fec5b775bd5 in block4 src/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/g722/g722_encode.c:78:39
    #1 0x7fec5b7736c1 in WebRtc_g722_encode src/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/g722/g722_encode.c:369:9
    #2 0x7fec5b7781c6 in webrtc::AudioEncoderG722Impl::EncodeImpl(unsigned int, rtc::ArrayView<short const, -4711l>, rtc::BufferT<unsigned char>*) src/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/g722/audio_encoder_g722.cc:117:34
    #3 0x7fec5b664835 in webrtc::AudioEncoder::Encode(unsigned int, rtc::ArrayView<short const, -4711l>, rtc::BufferT<unsigned char>*) src/media/webrtc/trunk/webrtc/api/audio_codecs/audio_encoder.cc:44:22
    #4 0x7fec5b74d656 in Encode src/media/webrtc/trunk/webrtc/modules/audio_coding/acm2/audio_coding_module.cc:496:34
    #5 0x7fec5b74d656 in webrtc::(anonymous namespace)::AudioCodingModuleImpl::Add10MsData(webrtc::AudioFrame const&) src/media/webrtc/trunk/webrtc/modules/audio_coding/acm2/audio_coding_module.cc:662
    #6 0x7fec5bc217b5 in webrtc::voe::Channel::ProcessAndEncodeAudioOnTaskQueue(webrtc::AudioFrame*) src/media/webrtc/trunk/webrtc/voice_engine/channel.cc:1763:22
    #7 0x7fec5bc342c9 in webrtc::voe::Channel::ProcessAndEncodeAudioTask::Run() src/media/webrtc/trunk/webrtc/voice_engine/channel.cc:535:15
    #8 0x7fec5bb84f5d in rtc::TaskQueue::Impl::OnWakeup(int, short, void*) src/media/webrtc/trunk/webrtc/rtc_base/task_queue_libevent.cc:438:18
    #9 0x7fec531ad15e in event_persist_closure src/ipc/chromium/src/third_party/libevent/event.c:1580:9
    #10 0x7fec531ad15e in event_process_active_single_queue src/ipc/chromium/src/third_party/libevent/event.c:1639
    #11 0x7fec531a44d1 in event_process_active src/ipc/chromium/src/third_party/libevent/event.c
    #12 0x7fec531a44d1 in event_base_loop src/ipc/chromium/src/third_party/libevent/event.c:1961
    #13 0x7fec5bb846ac in rtc::TaskQueue::Impl::ThreadMain(void*) src/media/webrtc/trunk/webrtc/rtc_base/task_queue_libevent.cc:407:5
    #14 0x7fec5bb70a82 in rtc::PlatformThread::Run() src/media/webrtc/trunk/webrtc/rtc_base/platform_thread.cc:242:5
    #15 0x7fec5bb7017c in rtc::PlatformThread::StartThread(void*) src/media/webrtc/trunk/webrtc/rtc_base/platform_thread.cc:158:40
    #16 0x7fec726826b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #17 0x7fec7170b41c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Dan Minor [:dminor]]

This problem also exists upstream: https://cs.chromium.org/chromium/src/third_party/webrtc/modules/third_party/g722/g722_encode.c?l=77&rcl=955f8fd0477ea2d4137eff032184e02de8508043

After getting a fix reviewed and landed here I'll open an upstream bug.

Comment 2

[Dan Minor [:dminor]]

Attachment: Bug 1587159 - Fix undefined shift in g722_encode.c; r=ng!

Left shifting a negative value results in undefined behaviour. It safer to
multiply in this case.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/385d660fac35
Fix undefined shift in g722_encode.c; r=ng

Comment 4

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/385d660fac35