Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4506447450210304 Fuzzer: libfuzzer_convert_woff2ttf_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: ReconstructTransformedHmtx ReconstructFont woff2::ConvertWOFF2ToTTF Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=390845:390847 Minimized Testcase (1.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97pndwGFVuDww0EhKCnreytlLg9o59UkDppwdCwaYNAlN2pjLqP_PJzKDk6x5RDx1d-zFWrZ1o3Nh77uC8i0KlJMBU5m4FZ-uylK73q1O8YSIRSmjPBknAv1ycO1qNdx9OD6Q6VSg-Gw5LL6-WsbflCX2Px2w Filer: mmoroz See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
internal ref: b/27562618 #10
Testcase from the report.
I believe this should be fixed upstream in https://github.com/google/woff2/commit/a15a8ab
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d6fdbb084660f06781c6932cc44b09aca20dfa29 commit d6fdbb084660f06781c6932cc44b09aca20dfa29 Author: toyoshim <toyoshim@chromium.org> Date: Tue May 10 06:22:56 2016 Update woff2 to a15a8ab BUG= 609042 , 609524 Review-Url: https://codereview.chromium.org/1959303002 Cr-Commit-Position: refs/heads/master@{#392555} [modify] https://crrev.com/d6fdbb084660f06781c6932cc44b09aca20dfa29/third_party/woff2/README.chromium [modify] https://crrev.com/d6fdbb084660f06781c6932cc44b09aca20dfa29/third_party/woff2/src/woff2_dec.cc [modify] https://crrev.com/d6fdbb084660f06781c6932cc44b09aca20dfa29/third_party/woff2/src/woff2_enc.cc
kicked 'Redo' with 'Fixed'
ClusterFuzz has detected this issue as fixed in range 392544:392562. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4506447450210304 Fuzzer: libfuzzer_convert_woff2ttf_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: ReconstructTransformedHmtx ReconstructFont woff2::ConvertWOFF2ToTTF Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=390845:390847 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=392544:392562 Minimized Testcase (1.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97pndwGFVuDww0EhKCnreytlLg9o59UkDppwdCwaYNAlN2pjLqP_PJzKDk6x5RDx1d-zFWrZ1o3Nh77uC8i0KlJMBU5m4FZ-uylK73q1O8YSIRSmjPBknAv1ycO1qNdx9OD6Q6VSg-Gw5LL6-WsbflCX2Px2w See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Removing view restrictions.
Comment 1 by mmoroz@chromium.org
, May 5 2016Owner: toyoshim@chromium.org