jshin -- Can you look into this security bug and reassign if appropriate?  Thanks.

Any update on this bug as it is marked as M52 stable blocker?

jshin: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

** IMPORTANT change in M52 merge date due to first 2 weeks of July no release weeks **
M52 Stable is launching very soon! Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and get it merged ASAP. All changes MUST be merged into the release branch by 5pm on July 1 to make into the desktop Stable final build cut. Thank you!

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4851259505115136

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=400227:400335

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95cpbyLVoe3ODpT86It9CYw_XXeKrsOnH1kZb1OGlwP5OAPlqu75urLsBEy6qpHt-K7GTBp59VbEqZkc4gN78o1UOyX67irAY02iXev06khHJTI7H_Y4E8UI69jfDhtKikRRBrW74RQFobUUw5d-EuD4k2fyQ?testcase_id=4851259505115136

Filer: tanin

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

M52 Stable is launching very soon! Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and get it merged ASAP. All changes MUST be merged into the release branch by 5pm on July 8th (in case if you missed today's 5:00 PM PST deadline) to make into the desktop Stable final build cut. Thank you!

jshin: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

A friendly reminder that M52 Stable is launching VERY soon! Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and get it merged into the release branch by July 15, 5:00 PM PST in order to make into the desktop Stable final build cut. Thank you!

jshin@'s going to take a look

Any update on this? Please note that We're cutting M52 stable RC on Monday @ 5:00 PM PST (07/18) and this bug is reported as M52 Stable blocker.

An invalid UTF-8 sequence (by fuzzer) is thrown at a function that I believe expects a valid UTF-8.  In this case, it's a single byte (0x86). 

With sqlite fixed to handle invalid UTF-8 input properly (a few months ago), I don't think we have a path through which a random byte sequence (invalid UTF-8) is passed to ICU. 

So, this might as well be downgraded to P2. And, I don't think it's critical for M52. 


Besides, (as I did in code reviews elsewhere), I'd argue that icu_ucasemap_fuzzer (and other ICU fuzzing routines) had better be revised to use valid UTF-8 byte sequences (if functions to test expect valid UTF-8 bytes) or valid UTF-16 strings (for functions expecting UTF-16 input). 
 

Thanks for the info jshin@.  Bugs-- folk, what are your thoughts in #21 ?

Agreed that fixing this particular issue isn't urgent, but I think that the best case scenario would be to harden some of these ICU functions to avoid having to worry about cases like the sqlite bugs we saw a while back.

I don't know much about ICU so I don't know if something like that would be reasonable, but I agree that in the long term we'll have to either do this or update the fuzzers accordingly.

If someone can boil this down to a code snippet calling ucasemap_utf8ToTitle() with the parameters that reproduce the Use-of-uninitialized-value, then I can investigate. Feel free to turn that directly into an ICU ticket: http://bugs.icu-project.org/trac/newticket (or I can pick it up from here).

I was about to file a bug against ICU along with a simple input triggering an uninitialized memory access. 

As for hardening ICU against invalid input, the simplest would be to check the input validity at the beginning, but it appears that it's not an ICU convention (moreover, it'll slow down things) judging from a response to my bug report in the past that proposed the input validation (in another ICU API). 

In this particular case, in an ICU bug I'm gonna file, we'll look for another way. 

Just initializing |s| at the beginning of ucasemap_internalUTF8ToTitle makes msan happy, but I need to look a bit more to see if it's a good fix. 

The upstream ToT is slightly different (but not in functions that matter to this bug,) so that I'm holding off filing a bug there for now. 


For Markus, a way to trigger an uninitialized memory access is:

When ucasemap_utf8ToTitle() is called with src="\x86" (an invalid UTF-8 sequence) and size=1,  |appendResult| in ucasemap.cpp accesses |s| that is not yet initialized. 

{{{
        } else {
            /* string */
            errorCode=U_ZERO_ERROR;
            u_strToUTF8(
                (char *)(dest+destIndex), destCapacity-destIndex, &destLength,
                s, length,
                &errorCode);
            destIndex+=destLength;
            /* we might have an overflow, but we know the actual length */
        }
}}}


See https://cs.chromium.org/chromium/src/third_party/icu/fuzzers/icu_ucasemap_fuzzer.cc?rcl=0&l=19

BTW, ucasemap_open is called with a random openflag (32-bit integer instead of 0 or 1). That could be a problem, too. 

Ok, I just tried it. If I call it with a valid value (0 or 1), I can't reproduce it, either (even when |s| is uninitialized at the beginning of ucasemap_internalUTF8ToTitle()). 

Filed http://bugs.icu-project.org/trac/ticket/12639 upstream (not viewable because I made it a sensitive bug). I included the following program (slightly changed from icu_ucasecamp fuzzer to remove randomness) in the bug report. 

-------
#include "unicode/locid.h"
#include "unicode/uchar.h"
#include "unicode/ucasemap.h"

int main() {
  UErrorCode status = U_ZERO_ERROR;
  const icu::Locale& locale = icu::Locale::getEnglish();
  uint32_t open_flags = 0x200;

  UCaseMap* csm = ucasemap_open(locale.getName(), open_flags, &status);

  if (U_FAILURE(status)) {
    ucasemap_close(csm);
    return -1;
  }

  size_t src_len = 1;
  const char* src = "\x85";
  char dst[3];
  ucasemap_utf8ToTitle(csm, dst, 3, src, src_len, &status);

  ucasemap_close(csm);
  return 0;
}
----------

Simply initializing |s| in ucasemap_internalUTF8ToTitle() appears sufficient. 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6060730252263424

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397736:398256

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96MkoyvOIJKNeLc54dqeV-hD2AEUHNwtcoKSHDUBd5ZAPkfVZ_4vagFpgUJJ0bccZHuehbgF5sgzqSTm-vwvbXGyYKa9f0NM4ID7Vyp5Vcw9qn-Q76NLoL_0nmZLfQMPxdNvr1W9moLKNpPsotOKzwGP1-jMA?testcase_id=6060730252263424

Filer: tanin

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

ClusterFuzz has detected this issue as fixed in range 413827:414117.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6060730252263424

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397736:398256
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=413827:414117

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96MkoyvOIJKNeLc54dqeV-hD2AEUHNwtcoKSHDUBd5ZAPkfVZ_4vagFpgUJJ0bccZHuehbgF5sgzqSTm-vwvbXGyYKa9f0NM4ID7Vyp5Vcw9qn-Q76NLoL_0nmZLfQMPxdNvr1W9moLKNpPsotOKzwGP1-jMA?testcase_id=6060730252263424

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 413827:414117.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4864816116400128

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397736:398256
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=413827:414117

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95z3aCBPpUUUGN64sJU9DYts9AJnPlSm_SMV9RosHNuKvV62wzWEdc7IrxTHIgGO3N5rp3B1tZldyqYyay862loKh5b-TAOAp_MF2weQQ2nRJ9iLmCefWcpYpiowtRG_Mb0kcXGHVzDtGfvn9qts3cJbRs5EQ?testcase_id=4864816116400128

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 413827:414117.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4851259505115136

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=397736:398256
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=413827:414117

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95cpbyLVoe3ODpT86It9CYw_XXeKrsOnH1kZb1OGlwP5OAPlqu75urLsBEy6qpHt-K7GTBp59VbEqZkc4gN78o1UOyX67irAY02iXev06khHJTI7H_Y4E8UI69jfDhtKikRRBrW74RQFobUUw5d-EuD4k2fyQ?testcase_id=4851259505115136

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6204867507126272

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=414797:414856

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97W3m4k4L9WC3L1sFX8FxRE998v3UNW7EH9h2B_Dx2mz0Rm-0CtTDEng37f3GLAYzt_3CVrox64IneFzcp5lqOycdCx91NRtNFpMFRCfQQvJoVthtrzv6pJnEYKNmfLPL3Z2MYjKGaM72z09aYI6Zs_ybv7qg?testcase_id=6204867507126272

Issue manually filed by: inferno

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

ClusterFuzz has detected this issue as fixed in range 429309:429390.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6204867507126272

Fuzzer: libfuzzer_icu_ucasemap_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  u_strToUTF8WithSub_56
  u_strToUTF8_56
  appendResult
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=414797:414856
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=429309:429390

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97W3m4k4L9WC3L1sFX8FxRE998v3UNW7EH9h2B_Dx2mz0Rm-0CtTDEng37f3GLAYzt_3CVrox64IneFzcp5lqOycdCx91NRtNFpMFRCfQQvJoVthtrzv6pJnEYKNmfLPL3Z2MYjKGaM72z09aYI6Zs_ybv7qg?testcase_id=6204867507126272

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

http://bugs.icu-project.org/trac/changeset/39295 fixed this bug in ICU 58.1. 

 bug 722124  is 'new' and only present in ICU 59.1 (not present in ICU 58). 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot