Discussion:
[webm-discuss] Issue 1572 in webm: add noise postproc crash
witaly.i… via monorail
2018-11-01 07:45:47 UTC
Permalink
Status: Untriaged
Owner: ----
Labels: Type-Bug Pri-2
Components: libvpx

New issue 1572 by ***@gmail.com: add noise postproc crash
https://bugs.chromium.org/p/webm/issues/detail?id=1572

vpx_setup_noise() corrupts stack on low add noise values
(vp8_postproc_cfg::noise_level = 3 leads to a quick crash with my video
setup). The problem is pretty obvious if you just look at the function in
question, there's no check if we're within char_dist array boundaries.
Here's some sample code showing overrun (it prints 256, 257 and 258, i.e.
it overwrites next var):
#include <iostream>
#include <cmath>

static double gaussian(double sigma, double mu, double x) {
return 1 / (sigma * sqrt(2.0 * 3.14159265)) *
(exp(-(x - mu) * (x - mu) / (2 * sigma * sigma)));
}

int vpx_setup_noise(double sigma)
{
int8_t char_dist[256];
int next = 0, i, j;

// set up a 256 entry lookup that matches gaussian distribution
for (i = -32; i < 32; ++i) {
const int a_i = (int)(0.5 + 256 * gaussian(sigma, 0, i));
if (a_i) {
for (j = 0; j < a_i; ++j) {
if ((next + j) > 255 || (next + j) < 0)
std::cout << (next + j) << "\n";//char_dist[next + j] = (int8_t)i;
}
next = next + j;
}
}
return 0;
}

int main()
{
vpx_setup_noise(3.25);
return 0;
}
--
You received this message because:
1. The project was configured to send all issue notifications to this
address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings
--
You received this message because you are subscribed to the Google Groups "WebM Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webm-discuss+***@webmproject.org.
To post to this group, send email to webm-***@webmproject.org.
Visit this group at https://groups.google.com/a/webmproject.org/group/webm-discuss/.
For more options, visit https://groups.google.com/a/webmproject.org/d/optout.
jz… via monorail
2018-11-06 23:35:12 UTC
Permalink
Updates:
Owner: ***@google.com
Status: Assigned

Comment #1 on issue 1572 by ***@google.com: add noise postproc crash
https://bugs.chromium.org/p/webm/issues/detail?id=1572#c1

Jerome, can you take a look?
--
You received this message because:
1. The project was configured to send all issue notifications to this
address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings
--
You received this message because you are subscribed to the Google Groups "WebM Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webm-discuss+***@webmproject.org.
To post to this group, send email to webm-***@webmproject.org.
Visit this group at https://groups.google.com/a/webmproject.org/group/webm-discuss/.
For more options, visit https://groups.google.com/a/webmproject.org/d/optout.
ji… via monorail
2018-11-07 00:18:23 UTC
Permalink
Updates:
Cc: ***@google.com

Comment #2 on issue 1572 by ***@google.com: add noise postproc crash
https://bugs.chromium.org/p/webm/issues/detail?id=1572#c2

https://chromium-review.googlesource.com/c/webm/libvpx/+/1321631

Thanks for reporting.
--
You received this message because:
1. The project was configured to send all issue notifications to this
address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings
--
You received this message because you are subscribed to the Google Groups "WebM Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webm-discuss+***@webmproject.org.
To post to this group, send email to webm-***@webmproject.org.
Visit this group at https://groups.google.com/a/webmproject.org/group/webm-discuss/.
For more options, visit https://groups.google.com/a/webmproject.org/d/optout.
bugdro… via monorail
2018-11-20 00:11:37 UTC
Permalink
Comment #3 on issue 1572 by ***@chromium.org: add noise postproc crash
https://bugs.chromium.org/p/webm/issues/detail?id=1572#c3

The following revision refers to this bug:

https://chromium.googlesource.com/webm/libvpx/+/a421e21e0315aea89663bf0cd350551d92111e30

commit a421e21e0315aea89663bf0cd350551d92111e30
Author: Jerome Jiang <***@google.com>
Date: Fri Nov 16 23:40:25 2018

Fix oob in vpx_setup_noise

Array index wasn't checked on boundary.

BUG=webm:1572

Change-Id: I55a93c024af77a4fd904b0e992d5587a142d66a4

[modify]
https://crrev.com/a421e21e0315aea89663bf0cd350551d92111e30/test/add_noise_test.cc
[modify]
https://crrev.com/a421e21e0315aea89663bf0cd350551d92111e30/vpx_dsp/add_noise.c
--
You received this message because:
1. The project was configured to send all issue notifications to this
address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings
--
You received this message because you are subscribed to the Google Groups "WebM Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webm-discuss+***@webmproject.org.
To post to this group, send email to webm-***@webmproject.org.
Visit this group at https://groups.google.com/a/webmproject.org/group/webm-discuss/.
For more options, visit https://groups.google.com/a/webmproject.org/d/optout.
ji… via monorail
2018-11-20 00:12:06 UTC
Permalink
Updates:
Status: Fixed

Comment #4 on issue 1572 by ***@google.com: add noise postproc crash
https://bugs.chromium.org/p/webm/issues/detail?id=1572#c4

(No comment was entered for this change.)
--
You received this message because:
1. The project was configured to send all issue notifications to this
address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings
--
You received this message because you are subscribed to the Google Groups "WebM Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webm-discuss+***@webmproject.org.
To post to this group, send email to webm-***@webmproject.org.
Visit this group at https://groups.google.com/a/webmproject.org/group/webm-discuss/.
For more options, visit https://groups.google.com/a/webmproject.org/d/optout.
Loading...