814699 - WebRTC crash [@webrtc::ACMOpus::InternalInitDecoder]

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This is a first try of fuzzing RTP. The callstack file includes information about  the intercepted packets, 'bt' and 'bt full'. The seed value shall be able to reproduce it. I will make the patch available after some tuning / reviews and probably add it to the WebRTC fuzzing meta-bug.

Comment 1

[Christoph Diehl [:posidron]]

Assertion failed: (_decoderInstPtr == NULL), function InternalInitDecoder, file /Users/cdiehl/Code/Mozilla/mc-debug/media/webrtc/trunk/src/modules/audio_coding/main/source/acm_opus.cc, line 210

Comment 2

[Timothy B. Terriberry (:derf)]

Comment on attachment 684702 [details]
callstack

This particular issue will be fixed by the CL in <http://review.webrtc.org/933022/>, though it may be indicative of larger problems.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Christoph, do you have any testcase or not? Would be nice if you could mention that when you file a bug.

Comment 4

[Christoph Diehl [:posidron]]

I wrote, I will make the patch available soon after some tuning / reviews and will attach it to the WebRTC fuzzing meta-bug. The seed value is printed in the callstack.
You later need just to enter the seed value as an environment variable to reproduce.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to Christoph Diehl [:cdiehl] from comment #4)
> I wrote, I will make the patch available soon after some tuning / reviews
> and will attach it to the WebRTC fuzzing meta-bug. The seed value is printed
> in the callstack.
> You later need just to enter the seed value as an environment variable to
> reproduce.

It would be great if you can give the information on that bug to lower the amount of confusion and reduce the search time. A link to the appropriate comment in the other bug would be enough. Thanks.

Comment 6

[Randell Jesup [:jesup] (needinfo me)]

Fixed by the webrtc.org checkin for 3.20 (bug 830247)