Humm.  It's really hard to make the code do this.  And I cannot reproduce using the minimized-testcase and hb-fuzzer on the commandline, when I put an assert on the line it claims the bad shift happens.

kcc@, can you reproduce?

Hm, there is some flakiness with reproduction. I cannot reproduce it with a single run, but passing '-runs=65535' makes sense:


$ UBSAN_OPTIONS=print_stacktrace=1:symbolize=1:print_summary=1:halt_on_error=1 ./harfbuzz_fuzzer ./fuzz-1-harfbuzz_fuzzer 
WARNING: Failed to find function "__sanitizer_print_stack_trace".
INFO: Seed: 1720945826
<...>/harfbuzz_fuzzer: Running 1 inputs 1 time(s) each.
Running: ./fuzz-1-harfbuzz_fuzzer
Executed ./fuzz-1-harfbuzz_fuzzer in 3 ms




$ UBSAN_OPTIONS=print_stacktrace=1:symbolize=1:print_summary=1:halt_on_error=1 <...>/harfbuzz_fuzzer ./fuzz-1-harfbuzz_fuzzer -runs=65535
WARNING: Failed to find function "__sanitizer_print_stack_trace".
INFO: Seed: 2963359902
<...>/harfbuzz_fuzzer: Running 1 inputs 65535 time(s) each.
Running: ./fuzz-1-harfbuzz_fuzzer
../../third_party/harfbuzz-ng/src/hb-ot-shape-complex-indic.cc:145:13: runtime error: shift exponent 94 is too large for 32-bit type 'unsigned int'
    #0 0x4b900d in is_one_of out/Release/../../third_party/harfbuzz-ng/src/hb-ot-shape-complex-indic.cc:145:13
    #1 0x4b900d in final_reordering_syllable out/Release/../../third_party/harfbuzz-ng/src/hb-ot-shape-complex-indic.cc:1360

Humm.  I need debugging this as I cannot reproduce with hb-fuzzer in harfbuzz itself no matter how many times I run.

Strange.. Do you use correct build flags (https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md#Reproducing-LibFuzzer-UBSan-bugs) ?

I'm not building in Chrome, just built hb-fuzzer separately.

ClusterFuzz has detected this issue as fixed in range 406767:406862.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4591483693039616

Fuzzer: libfuzzer_harfbuzz_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  is_one_of
  final_reordering_syllable
  final_reordering
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=406767:406862

Minimized Testcase (15.77 Kb): https://cluster-fuzz.appspot.com/download/AMIfv967w1Lx2IRk73Phq3pHHk-y_zgmKSo8JcPDYqpTxYs0xvx569A-ycX2CJFPIb2uZitThYyILUSqlC7apS5NKmkwz2rQLr4uLvLcx6icUQ-tOhBXmZprcGBUUEdsL3l00Ie-tCnqRz2JJS8_NHSde1xwW9G_-A?testcase_id=4591483693039616

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 406767:406862.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4591483693039616

Fuzzer: libfuzzer_harfbuzz_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  is_one_of
  final_reordering_syllable
  final_reordering
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=406767:406862

Minimized Testcase (15.77 Kb): https://cluster-fuzz.appspot.com/download/AMIfv967w1Lx2IRk73Phq3pHHk-y_zgmKSo8JcPDYqpTxYs0xvx569A-ycX2CJFPIb2uZitThYyILUSqlC7apS5NKmkwz2rQLr4uLvLcx6icUQ-tOhBXmZprcGBUUEdsL3l00Ie-tCnqRz2JJS8_NHSde1xwW9G_-A?testcase_id=4591483693039616

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot