New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 622863 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 600709
Owner: ----
Closed: Jun 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in CPDF_Array::GetDirectObjectAt

Project Member Reported by ClusterFuzz, Jun 23 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6693782288596992

Fuzzer: ochang_neurofuzz_borgfuzz
Job Type: linux_asan_pdfium
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000018
Crash State:
  CPDF_Array::GetDirectObjectAt
  CPDF_DataAvail::CheckHintTables
  CPDF_DataAvail::CheckDocStatus
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=357360:357514

Minimized Testcase (520.08 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94T7IxEAOVEVUbTeP-8ZZtSMhcP2nHkP_3_Wq3hV6e583IJWgotjE9Bqtd3PPtQytfAZTzEbitrr3BkPbDzoFbIuH8sowrBqHqGEhYE5bA6HQv5ULKbsRvWecjMonWsCZZbRJxtyTBCkJGgMlUDnEfMIOZtyD9mI_dAN71QQioPNZmwuDs?testcase_id=6693782288596992

Filer: mummareddy

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: tsepez@chromium.org thestig@chromium.org
Labels: Te-Logged M-52 M-51
From findit tool:

Author: Jun Fang
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/d946f3011984755b14d7dcfb05d572e870f93f3f
Time: Mon Nov 02 13:45:35 2015 +0800
Lines 127-128, 136-137, 142-144 of file fpdf_dataavail.cpp which potentially caused crash are changed in this cl (frame #5, "FPDFAvail_IsDocAvail").

File pdfium_test.cc is changed in this cl (and is part of stack frame #6, "RenderPdf")
Minimum distance from crash line to modified line: 0. (file: fpdf_dataavail.cpp, crashed on: 128, modified: 128).

Cc ing to the CL reviewers.
Mergedinto: 600709
Status: Duplicate (was: Available)
Project Member

Comment 3 by ClusterFuzz, Jun 24 2016

ClusterFuzz has detected this issue as fixed in range 398351:398496.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6693782288596992

Fuzzer: ochang_neurofuzz_borgfuzz
Job Type: linux_asan_pdfium
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000018
Crash State:
  CPDF_Array::GetDirectObjectAt
  CPDF_DataAvail::CheckHintTables
  CPDF_DataAvail::CheckDocStatus
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=357360:357514
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=398351:398496

Minimized Testcase (520.08 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94T7IxEAOVEVUbTeP-8ZZtSMhcP2nHkP_3_Wq3hV6e583IJWgotjE9Bqtd3PPtQytfAZTzEbitrr3BkPbDzoFbIuH8sowrBqHqGEhYE5bA6HQv5ULKbsRvWecjMonWsCZZbRJxtyTBCkJGgMlUDnEfMIOZtyD9mI_dAN71QQioPNZmwuDs?testcase_id=6693782288596992

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment