New issue
Advanced search Search tips

Issue 616062 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Direct-leak in dmg_fp::Balloc

Project Member Reported by ClusterFuzz, May 31 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4826941760995328

Fuzzer: libfuzzer_base_json_reader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::mult
  dmg_fp::strtod
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94AIfOVbiDwHCXf1MYM5YET3-JsbeGr8h0iWmVbacAn-L-hIQUbHVp0ANEIxlhe4TYrZr_GADLQfDtBmY7TnZStkjX0IcPjWr_zQG2LkWSHIVsztt2WTtYEZOhLPw3YcbezsHWJJVE2XeFAOFo9Lit4D4xe3A


Filer: ajha

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 

Comment 1 by ajha@chromium.org, May 31 2016

Labels: -Pri-2 Needs-triage Te-Logged Pri-1
Unable to find the exact suspect.

Could anyone from the respective team help in finding an appropriate owner.

Comment 2 by ajha@chromium.org, Jun 1 2016

Cc: scottmg@chromium.org hua...@chromium.org
Components: Internals
Labels: -Needs-triage
Cc'ing 	huangs@ and scottmg@ from Issue 593512, for help in investigating this further.




Project Member

Comment 3 by ClusterFuzz, Jun 3 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6680257260421120

Fuzzer: libfuzzer_base_json_reader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::diff
  dmg_fp::strtod
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96ep8srndcLFL97PPZMNtY-e2-xhnYvhNCBQAtozCCmsDIcML6j2pPLagd5-jtuAsUTiAmX3t0JI_N0kOCOcL1Fb3EtB-TWcLIJQta4vhiHYuiGDjxrPelEe5VQHNG-66moah9I0lp8x7nSF4cHAb6PHfoCFg


Filer: ajha

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 4 by ClusterFuzz, Jun 6 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5067917804961792

Fuzzer: libfuzzer_string_to_int_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::mult
  dmg_fp::pow5mult
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97R3oICwVGdYGn2gO1v85MveFdh1YzL0eBQp7Jpjjv_IAc68GU6PFUVidxyBKuDuDgJbb_8x_D0C6wnIOjaXKk8S6gUj3hNntnIHRKYRGyJ_OxDev6aTw2rwVf4eLsBELz_AULz3WQreav-55y883XQEdtCnw


Filer: ashejole

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 Issue 617921  has been merged into this issue.
Owner: scottmg@chromium.org
Status: Assigned (was: Available)
I'll try to take a look sometime and see if we can delete this code per discussion in bug 593512.
Project Member

Comment 7 by bugdroid1@chromium.org, Jun 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8d7634d843a6b981d4b9bebe8f94412b6bccc3be

commit 8d7634d843a6b981d4b9bebe8f94412b6bccc3be
Author: scottmg <scottmg@chromium.org>
Date: Wed Jun 15 17:52:45 2016

Add strtod test cases

Adds test cases from
http://www.exploringbinary.com/how-strtod-works-and-sometimes-doesnt/.

These currently fail on (see ps#1):
  - linux_chromium_gn_chromeos_rel
  - linux_chromium_asan_rel_ng
  - linux_chromium_chromeos_ozone_rel_ng
  - linux_chromium_rel_ng
  - cast_shell_linux

but despite history appear to be fine on Windows (as of VS2015). As they
were a bit of fiddling to get up and running, and we don't appear to have
any similar tests for dmg_fp, add these tests so that we can hopefully
drop dmg_fp in the future once std::strtod works more consistently
everywhere. https://crbug.com/95729 suggests another solution where it'd
be good to have these tests.

BUG=593512,615142, 616062 , 588726 ,95729

Review-Url: https://codereview.chromium.org/2044643005
Cr-Commit-Position: refs/heads/master@{#399948}

[modify] https://crrev.com/8d7634d843a6b981d4b9bebe8f94412b6bccc3be/base/strings/string_number_conversions_unittest.cc

Project Member

Comment 8 by ClusterFuzz, Jul 13 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5345819683454976

Fuzzer: libfuzzer_base_json_reader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::mult
  dmg_fp::pow5mult
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv954XmAjATwvrUNiA0jmUH1IXbbcy9ok0ZUTgtOw6p1Hoq_ctmp9zRhUEA3ltHEXXQ_PiK-Kdmaq1kGr28EJQhSvHpSzwQZndibEvj-DLA6Wb1B2PMOQ_NC8m2Y3-de3bXxNXfw8knD2TFWVR8U3LrIKLoKtnQ?testcase_id=5345819683454976


Filer: mmohammad

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 9 by ClusterFuzz, Jul 14 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6437380018143232

Fuzzer: libfuzzer_base_json_reader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::mult
  dmg_fp::pow5mult
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94N6mMJ_JgTh2Mrbkwti4MeGRFPZ3GTT_wQLHxLu2hq0s9CC-wyKhdVB41CXTuIoKgtKKRU8huIgRn8taDps78fZKrxnYLqXAZ5X_wB_dytdthr-MbRiOoTFkQ45G1oLQtbHAPQ8PwVc3oZnScM2PMqINZPNw?testcase_id=6437380018143232


Filer: mmohammad

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 10 by ClusterFuzz, Jul 15 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5414772833255424

Fuzzer: libfuzzer_base_json_reader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::mult
  dmg_fp::strtod
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95QJBXb3fzYYZSKEF_elSZ6oNyRGax1ucGhoFsU3jM0kqyS7feLkcBkM8uRbMkVlha2MBvxBYuf8xyfx8AA_A8-zEpoQYpEKDZ-_Vf0c4P9mEMXKtCAmWr2ZS5xptgR7Q_7HWKRBG46HUWnJFmLvhUQMJIMuw?testcase_id=5414772833255424


Additional requirements: Requires Gestures

Filer: mmohammad

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 11 by ClusterFuzz, Jul 19 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6725080180850688

Fuzzer: libfuzzer_base_json_reader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dmg_fp::Balloc
  dmg_fp::mult
  dmg_fp::strtod
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94h3gfPa-cIDnfDLjA-wQ7Jr5m8m9_jYzSy6EHrAB2ozlxt6yBfXQw9cuSDwasU39t9fqbuw3jC8ujFg7TF5bq0hEuiXQQkJBtgQmn3qqPQxQFATaWJClOsFLeFT7_hQvdymMUjFN20fldXhNYKUN31oCla4A?testcase_id=6725080180850688


Filer: mummareddy

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Comment 12 by kcwu@chromium.org, Sep 27 2016

Labels: -ClusterFuzz Clusterfuzz
Owner: kcwu@chromium.org
This should be fixed by http://crrev.com/2364123002

Comment 13 by kcwu@chromium.org, Sep 27 2016

Status: Fixed (was: Assigned)
Project Member

Comment 14 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment