Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5284958671470592

Fuzzer: libfuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CFDE_XMLSyntaxParser::ParseTextChar
  CFDE_XMLSyntaxParser::DoSyntaxParse
  CXFA_XMLParser::DoParser
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746

Minimized Testcase (0.02 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95N4Vm8PPpmdXghc3vUefZ_6AqUCF_LIUSLVo5-XVs1fnWAq_3j3BHNSUdOzgMfb3iCRiydgpKnswKCbLt_rhKegctIUZBvLH-7-oiBX7e42XJc6Y59qbiTBXNN3LYyxz1fWoD4zIA0KQSDCkrBdqG_KBp-aw?testcase_id=5284958671470592
&#x�DBDFFFDF40b�l;&x2;EI


Filer: brajkumar

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5135280059449344

Fuzzer: libfuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CFDE_XMLSyntaxParser::ParseTextChar
  CFDE_XMLSyntaxParser::DoSyntaxParse
  CXFA_XMLParser::DoParser
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96dCW-EVHUqMDWg9mkajjfpxRRCSjoM574WTqnUeCtAt4et5HI6-xKS8Mow9eR8krhmwCJcAG7qB5ux27IcyuMo1FHcWVSm2U0ouqfcq_zx9yKSTXLwNzXCrPhrbn5tPPyZ03wbhxVYcBgbWkXn7CnBjuE9xA?testcase_id=5135280059449344
&#xaDD0FFFBFD[]��EB]C�ATA="&a;2"IU(ED&#xeFF�04U;�1&#�a]AFT�CDA:=


Filer: rnimmagadda

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Also, suspecting:

Author: delcypher
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/c84c7383e7b76dd6e3258ca5e5df4584b57d2297
Time: Thu May 19 22:00:33 2016
Lines 441-447 of file FuzzerLoop.cpp which potentially caused crash are changed in this cl (frame #6, "fuzzer::Fuzzer::RunOne").
Minimum distance from crash line to modified line: 0. (file: FuzzerLoop.cpp, crashed on: 441, modified: 441).

Gentle Ping.

@hong_zhang: Could you please provide some update on this issue.

Thank you.

https://codereview.chromium.org/2223823003/

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium.git/+/22eeccb34f91f9932f7cec295bcaf641ba249e3a

commit 22eeccb34f91f9932f7cec295bcaf641ba249e3a
Author: dsinclair <dsinclair@chromium.org>
Date: Thu Aug 11 14:50:08 2016

Guard against undefined shift.

This Cl fixes the CFDE_XMLSyntaxParser::ParseTextChar() to handle entities
where the value goes negative. Currently this could cause an undefined-shift
as due to the (ch << 4) calls. Instead, detect if the value has gone negative
and return a space character.

BUG= chromium:603489 

Review-Url: https://codereview.chromium.org/2223823003

[modify] https://crrev.com/22eeccb34f91f9932f7cec295bcaf641ba249e3a/xfa/fde/xml/fde_xml_imp.cpp
[modify] https://crrev.com/22eeccb34f91f9932f7cec295bcaf641ba249e3a/xfa/fde/xml/fde_xml_imp_unittest.cpp

Should be picked up by the next PDFium roll.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e5d65196d13bbea473bd8c8b0cc481e12155543f

commit e5d65196d13bbea473bd8c8b0cc481e12155543f
Author: thestig <thestig@chromium.org>
Date: Fri Aug 12 04:09:23 2016

Roll PDFium 85af2a3..d0b6ed1

https://pdfium.googlesource.com/pdfium.git/+log/85af2a3..d0b6ed1

BUG= 603489 , 635565 , 635663 
TBR=ochang@chromium.org

Review-Url: https://codereview.chromium.org/2237223003
Cr-Commit-Position: refs/heads/master@{#411548}

[modify] https://crrev.com/e5d65196d13bbea473bd8c8b0cc481e12155543f/DEPS

ClusterFuzz has detected this issue as fixed in range 411369:411551.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5135280059449344

Fuzzer: libfuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CFDE_XMLSyntaxParser::ParseTextChar
  CFDE_XMLSyntaxParser::DoSyntaxParse
  CXFA_XMLParser::DoParser
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=411369:411551

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96dCW-EVHUqMDWg9mkajjfpxRRCSjoM574WTqnUeCtAt4et5HI6-xKS8Mow9eR8krhmwCJcAG7qB5ux27IcyuMo1FHcWVSm2U0ouqfcq_zx9yKSTXLwNzXCrPhrbn5tPPyZ03wbhxVYcBgbWkXn7CnBjuE9xA?testcase_id=5135280059449344
&#xaDD0FFFBFD[]��EB]C�ATA="&a;2"IU(ED&#xeFF�04U;�1&#�a]AFT�CDA:=


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 411369:411551.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5284958671470592

Fuzzer: libfuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CFDE_XMLSyntaxParser::ParseTextChar
  CFDE_XMLSyntaxParser::DoSyntaxParse
  CXFA_XMLParser::DoParser
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=411369:411551

Minimized Testcase (0.02 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95N4Vm8PPpmdXghc3vUefZ_6AqUCF_LIUSLVo5-XVs1fnWAq_3j3BHNSUdOzgMfb3iCRiydgpKnswKCbLt_rhKegctIUZBvLH-7-oiBX7e42XJc6Y59qbiTBXNN3LYyxz1fWoD4zIA0KQSDCkrBdqG_KBp-aw?testcase_id=5284958671470592
&#x�DBDFFFDF40b�l;&x2;EI


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot