@rouslan, do you mind to help to triage this? Should we report it to the upstream or have another owner?

phajdan.jr@: As a maintainer of hunspell upstream, what is the appropriate action that you recommend?

Not sure. Please debug this chrome-side first please. Feel free to submit a hunspell pull request if you'd like to get any changes upstreamed.

hunspell-side issue. The fuzzer complains about this line, flagging undefined behavior for shift:

    u2->l = (*u8 << 6) + (*(u8+1) & 0x3f);

And sure enough, the definition for u8 makes it a signed char. (I don't even)

   const signed char * u8 = (const signed char *)src;

And yes, left-shifting signed types _is_ undefined behavior. I can't currently figure out why u8 would need to be declared signed, so it might be changing that to unsigned fixes the problem. (I currently don't have time for a full evaluation of this, though)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e87c5a27a35c73cc8b099742d914d79d7543deea

commit e87c5a27a35c73cc8b099742d914d79d7543deea
Author: krb <krb@chromium.org>
Date: Wed Aug 24 16:57:21 2016

Changed signed char* to unsigned char*, fuzzer fix

Fuzzer reports undefined behavior precisely at the locations where
it performs a left shift on a signed char. Changing it to a regular
char makes the errors go away.

Since the function is doing lots of bit manipulation, a signed char
seems inappropriate anyways. All spellcheck tests pass with regular
char.

The upstream github history (that I could find) shows that it has
always been signed, so I couldn't find a reason why it changed, if
it ever did.

BUG= 620659 , 624348 

Review-Url: https://codereview.chromium.org/2263263003
Cr-Commit-Position: refs/heads/master@{#414095}

[modify] https://crrev.com/e87c5a27a35c73cc8b099742d914d79d7543deea/third_party/hunspell/google.patch
[modify] https://crrev.com/e87c5a27a35c73cc8b099742d914d79d7543deea/third_party/hunspell/src/hunspell/csutil.cxx

ClusterFuzz has detected this issue as fixed in range 414068:414117.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5578544990388224

Fuzzer: libfuzzer_hunspell_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  u8_u16
  Hunspell::cleanword2
  Hunspell::spell
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=398272:398351
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414068:414117

Minimized Testcase (0.09 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96ame9VkVoSITq7d1GKJocIvUDWR1OHTVVZZZlFkjqJmww39gTIhRLKJGAwL-kwrFD3s2AYAdDB8zmiwIRSNCXlXuyixwqGQUwsiuUE3OA7jy5XodMbkPVnYRfDwUcLxItYiTbIiJwYRdZDLbCqDzWCRJy5eQ?testcase_id=5578544990388224

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot