New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 617645 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner:
Last visit > 30 days ago
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-buffer-overflow in CXFA_Node::TryUserData

Project Member Reported by ClusterFuzz, Jun 6 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5632985647022080

Uploader: inferno@chromium.org
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x229d9134
Crash State:
  CXFA_Node::TryUserData
  CXFA_LayoutProcessor::GetLayoutItem
  CScript_LayoutPseudoModel::Script_LayoutPseudoModel_PageImp
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=397938:397951

Minimized Testcase (2237.61 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94mGS7gv_70E85-T97RBykfSEv7UKeaQac3Gs4bUMsyQ_c11V3uISiYU93KKOrZj2pc4otDn5MI8wimJDUDyeoeifgtddygy7NaOHLjDrIr3inTDmpSFBzeUmsGImD8L5iNdZT3nmcS3jkR7Zy2Zu2-uR8dowcm260Xovf2FiRJk4XBk4g

Filer: ochang

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by f...@chromium.org, Jun 6 2016

Cc: och...@chromium.org
Components: Internals>Plugins>PDF
Labels: M-53 Pri-1
Owner: hong_zh...@foxitsoftware.com
Status: Assigned (was: Available)
hong_zhang, could you please route this security bug to the appropriate person? thanks.
Mergedinto: 616339
Status: Duplicate (was: Assigned)
Yes I will
Project Member

Comment 4 by ClusterFuzz, Jun 8 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5632985647022080

Uploader: inferno@chromium.org
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x237d8fb4
Crash State:
  CXFA_Node::TryUserData
  CXFA_LayoutProcessor::GetLayoutItem
  CScript_LayoutPseudoModel::Script_LayoutPseudoModel_PageImp
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=397938:397951

Minimized Testcase (2237.61 Kb): https://cluster-fuzz.appspot.com/download/AMIfv958m8tGdaFcTnZv0wqgffSgI_4rSH6Di3lrXhcxZHQkzaAO3SEJfZWR0mCMX-184BIAZISrtx0TSKnlPehkAx7LlMyr8FDDBCd4hXlfucfL8qANkgV0VtgUt-9I1xFCZWQJz3mBIxxswQzV5FzWEQBIufaK5Q1aTvCmJszCQ2NjD3aw_p4

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 Issue 617841  has been merged into this issue.
Project Member

Comment 6 by ClusterFuzz, Jun 10 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5632985647022080

Uploader: inferno@chromium.org
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x237d8fb4
Crash State:
  CXFA_Node::TryUserData
  CXFA_LayoutProcessor::GetLayoutItem
  CScript_LayoutPseudoModel::Script_LayoutPseudoModel_PageImp
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=397938:397951

Minimized Testcase (2237.61 Kb): https://cluster-fuzz.appspot.com/download/AMIfv958m8tGdaFcTnZv0wqgffSgI_4rSH6Di3lrXhcxZHQkzaAO3SEJfZWR0mCMX-184BIAZISrtx0TSKnlPehkAx7LlMyr8FDDBCd4hXlfucfL8qANkgV0VtgUt-9I1xFCZWQJz3mBIxxswQzV5FzWEQBIufaK5Q1aTvCmJszCQ2NjD3aw_p4

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by sheriffbot@chromium.org, Sep 22 2016

Labels: -Restrict-View-SecurityTeam
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment