Issue metadata
Sign in to add a comment
|
Use-of-uninitialized-value in v8::InstantiateModuleFromAsm |
||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5502680159485952 Fuzzer: mbarbella_js_mutation Job Type: linux_msan_d8 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: v8::InstantiateModuleFromAsm v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=369073:369111 Minimized Testcase (0.08 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96yz6kGxEdiFCjBIXPDZuW7OMx9M_x1GCXNfdH68DkGB_H1pgwHIKMVnNYYGOGZN7Y1wsZbpVKdr7AA0sZW4Yl-rxMSzwGuMk0goemof7WMos6cHSaB-x-vSeiqsBOr0_JZEkH0Z-L1oVAJeOwB1C0kEUzoyw var __v_3 = ""; var module = _WASMEXP_.instantiateModuleFromAsm(__v_3); ( { }); Filer: machenbach See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Mar 7 2016
,
Mar 7 2016
,
Mar 9 2016
ClusterFuzz has detected this issue as fixed in range 379854:379903. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5502680159485952 Fuzzer: mbarbella_js_mutation Job Type: linux_msan_d8 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: v8::InstantiateModuleFromAsm v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=369073:369111 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=379854:379903 Minimized Testcase (0.08 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96yz6kGxEdiFCjBIXPDZuW7OMx9M_x1GCXNfdH68DkGB_H1pgwHIKMVnNYYGOGZN7Y1wsZbpVKdr7AA0sZW4Yl-rxMSzwGuMk0goemof7WMos6cHSaB-x-vSeiqsBOr0_JZEkH0Z-L1oVAJeOwB1C0kEUzoyw var __v_3 = ""; var module = _WASMEXP_.instantiateModuleFromAsm(__v_3); ( { }); See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 10 2016
,
Mar 18 2016
Remove legacy label cr-blink-javascript.
,
Mar 22 2016
titzer@: Uh oh! This issue is still open and hasn't been updated in the last 14 days. Since this is a serious security vulnerability, we want to make sure progress is happening. Can you update the bug with current status, and what, if anything, is blocking? If you are not the right Owner for this bug, please find someone else to own it as soon as possible and remove yourself as Owner. If the issue is already fixed or you are to unable to reproduce it, please close the bug. (And thanks for fixing the bug!). These nags can be disabled by adding a 'WIP' label and an optional codereview link. - Your friendly ClusterFuzz
,
Apr 5 2016
titzer@: Uh oh! This issue is still open and hasn't been updated in the last 28 days. Since this is a serious security vulnerability, we want to make sure progress is happening. Can you update the bug with current status, and what, if anything, is blocking? If you are not the right Owner for this bug, please find someone else to own it as soon as possible and remove yourself as Owner. If the issue is already fixed or you are to unable to reproduce it, please close the bug. (And thanks for fixing the bug!). These nags can be disabled by adding a 'WIP' label and an optional codereview link. - Your friendly ClusterFuzz
,
Apr 14 2016
,
Apr 19 2016
titzer@: Uh oh! This issue is still open and hasn't been updated in the last 43 days. Since this is a serious security vulnerability, we want to make sure progress is happening. Can you update the bug with current status, and what, if anything, is blocking? If you are not the right Owner for this bug, please find someone else to own it as soon as possible and remove yourself as Owner. If the issue is already fixed or you are to unable to reproduce it, please close the bug. (And thanks for fixing the bug!). These nags can be disabled by adding a 'WIP' label and an optional codereview link. - Your friendly ClusterFuzz
,
Apr 21 2016
,
Apr 21 2016
titzer: Uh oh! This issue still open and hasn't been updated in the last 45 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers? If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one? If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 6 2016
titzer: Uh oh! This issue still open and hasn't been updated in the last 60 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers? If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one? If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 6 2016
We commit ourselves to a 60 day deadline for fixing for high severity vulnerabilities, and have exceeded it here. If you're unable to look into this soon, could you please find another owner or remove yourself so that this gets back into the security triage queue? For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 24 2016
Fixed as per https://bugs.chromium.org/p/chromium/issues/detail?id=592361#c4 and did not come back again.
,
May 24 2016
Adding Merge-Triage label for tracking purposes. Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Request-XX label, where XX is the Chrome milestone. When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com. - Your friendly ClusterFuzz
,
May 25 2016
,
May 26 2016
,
May 31 2016
,
Aug 31 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 1 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by machenb...@chromium.org
, Mar 7 2016Status: Assigned (was: Available)