New issue
Advanced search Search tips

Issue 592361 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security
Nag



Sign in to add a comment

Use-of-uninitialized-value in v8::InstantiateModuleFromAsm

Project Member Reported by ClusterFuzz, Mar 7 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5502680159485952

Fuzzer: mbarbella_js_mutation
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=369073:369111

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96yz6kGxEdiFCjBIXPDZuW7OMx9M_x1GCXNfdH68DkGB_H1pgwHIKMVnNYYGOGZN7Y1wsZbpVKdr7AA0sZW4Yl-rxMSzwGuMk0goemof7WMos6cHSaB-x-vSeiqsBOr0_JZEkH0Z-L1oVAJeOwB1C0kEUzoyw
var __v_3 = "";
    var module = _WASMEXP_.instantiateModuleFromAsm(__v_3);
( {
});


Filer: machenbach

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: titzer@chromium.org
Status: Assigned (was: Available)
PTAL
Components: Blink>JavaScript
Project Member

Comment 3 by ClusterFuzz, Mar 7 2016

Labels: M-49
Project Member

Comment 4 by ClusterFuzz, Mar 9 2016

ClusterFuzz has detected this issue as fixed in range 379854:379903.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5502680159485952

Fuzzer: mbarbella_js_mutation
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=369073:369111
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=379854:379903

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96yz6kGxEdiFCjBIXPDZuW7OMx9M_x1GCXNfdH68DkGB_H1pgwHIKMVnNYYGOGZN7Y1wsZbpVKdr7AA0sZW4Yl-rxMSzwGuMk0goemof7WMos6cHSaB-x-vSeiqsBOr0_JZEkH0Z-L1oVAJeOwB1C0kEUzoyw
var __v_3 = "";
    var module = _WASMEXP_.instantiateModuleFromAsm(__v_3);
( {
});


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Mar 10 2016

Labels: Pri-1
Labels: -cr-blink-javascript
Remove legacy label cr-blink-javascript.
Project Member

Comment 7 by ClusterFuzz, Mar 22 2016

Labels: Nag
titzer@: Uh oh! This issue is still open and hasn't been updated in the last 14 days. Since this is a serious security vulnerability, we want to make sure progress is happening. Can you update the bug with current status, and what, if anything, is blocking?

If you are not the right Owner for this bug, please find someone else to own it as soon as possible and remove yourself as Owner.

If the issue is already fixed or you are to unable to reproduce it, please close the bug. (And thanks for fixing the bug!).

These nags can be disabled by adding a 'WIP' label and an optional codereview link.

- Your friendly ClusterFuzz
Project Member

Comment 8 by ClusterFuzz, Apr 5 2016

titzer@: Uh oh! This issue is still open and hasn't been updated in the last 28 days. Since this is a serious security vulnerability, we want to make sure progress is happening. Can you update the bug with current status, and what, if anything, is blocking?

If you are not the right Owner for this bug, please find someone else to own it as soon as possible and remove yourself as Owner.

If the issue is already fixed or you are to unable to reproduce it, please close the bug. (And thanks for fixing the bug!).

These nags can be disabled by adding a 'WIP' label and an optional codereview link.

- Your friendly ClusterFuzz
Project Member

Comment 9 by sheriffbot@chromium.org, Apr 14 2016

Labels: -M-49 M-50
Project Member

Comment 10 by ClusterFuzz, Apr 19 2016

titzer@: Uh oh! This issue is still open and hasn't been updated in the last 43 days. Since this is a serious security vulnerability, we want to make sure progress is happening. Can you update the bug with current status, and what, if anything, is blocking?

If you are not the right Owner for this bug, please find someone else to own it as soon as possible and remove yourself as Owner.

If the issue is already fixed or you are to unable to reproduce it, please close the bug. (And thanks for fixing the bug!).

These nags can be disabled by adding a 'WIP' label and an optional codereview link.

- Your friendly ClusterFuzz
Cc: mmoroz@google.com bmeu...@chromium.org
 Issue 605486  has been merged into this issue.
Project Member

Comment 12 by sheriffbot@chromium.org, Apr 21 2016

titzer: Uh oh! This issue still open and hasn't been updated in the last 45 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 13 by sheriffbot@chromium.org, May 6 2016

titzer: Uh oh! This issue still open and hasn't been updated in the last 60 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 14 by sheriffbot@chromium.org, May 6 2016

Labels: Deadline-Exceeded
We commit ourselves to a 60 day deadline for fixing for high severity vulnerabilities, and have exceeded it here. If you're unable to look into this soon, could you please find another owner or remove yourself so that this gets back into the security triage queue?

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 15 by aarya@google.com, May 24 2016

Status: Fixed (was: Assigned)
Fixed as per https://bugs.chromium.org/p/chromium/issues/detail?id=592361#c4 and did not come back again.
Project Member

Comment 16 by ClusterFuzz, May 24 2016

Labels: Merge-Triage M-51 M-52
Adding Merge-Triage label for tracking purposes.

Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Request-XX label, where XX is the Chrome milestone.

When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com.

- Your friendly ClusterFuzz
Project Member

Comment 17 by sheriffbot@chromium.org, May 25 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 18 by sheriffbot@chromium.org, May 26 2016

Labels: -M-50
Labels: -Merge-Triage Release-1-M51
Project Member

Comment 20 by sheriffbot@chromium.org, Aug 31 2016

Labels: -Restrict-View-SecurityNotify
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 21 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 22 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment