Floating-point-exception in CJBig2_Image::CJBig2_Image |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6354926659960832 Fuzzer: attekett_surku_fuzzer Job Type: linux_asan_chrome_media Platform Id: linux Crash Type: Floating-point-exception Crash Address: Crash State: CJBig2_Image::CJBig2_Image CJBig2_GRRDProc::decode CJBig2_Context::parseGenericRefinementRegion Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=409589:409828 Minimized Testcase (26.30 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Ek03jei7Q0VSN3Ge6PnWWSIIUHTjroRMrfmgnJb8plwG6Nb3Bd2ZKU3hJlzDyJXiDiQ37Ayh-3fuQU3teuVuR7RnYVi2uyY75IDtNYyqXHUKSoiUlpdpxDvF33PAFGbdcm49kBgZ_X7g71F7zLwywx-g4a4ITx-mHf88ONpls7Zzd6Bg?testcase_id=6354926659960832 Issue manually filed by: mummareddy See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 8 2016
Dan, for routing this issue. I'm not going to be looking at it. Thanks.
,
Aug 8 2016
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium.git/+/b1b8668ef12ae4e7fcb5fbf3f01fa623a319a092 commit b1b8668ef12ae4e7fcb5fbf3f01fa623a319a092 Author: dsinclair <dsinclair@chromium.org> Date: Mon Aug 08 18:10:48 2016 Check if image width or height are zero before proceeding. If the width of the CJBig2_Image is set to 0 then the stride_pixels will be zero and when we divide we'll get a floating point exception. If the width or height are zero then we can exit early without proceeding with the rest of the constructor. BUG= chromium:635008 Review-Url: https://codereview.chromium.org/2222843004 [modify] https://crrev.com/b1b8668ef12ae4e7fcb5fbf3f01fa623a319a092/core/fxcodec/jbig2/JBig2_Image.cpp
,
Aug 8 2016
Should get picked up on the next PDFium roll.
,
Aug 9 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/66235aa45c0b0dcc0b875e4ade2747cf6b195ee4 commit 66235aa45c0b0dcc0b875e4ade2747cf6b195ee4 Author: ochang <ochang@chromium.org> Date: Tue Aug 09 02:38:43 2016 Roll PDFium 135b998..b6befb2 https://pdfium.googlesource.com/pdfium.git/+log/135b998..b6befb2 BUG= 635008 ,634716,632622 TBR=thestig@chromium.org Review-Url: https://codereview.chromium.org/2226163003 Cr-Commit-Position: refs/heads/master@{#410544} [modify] https://crrev.com/66235aa45c0b0dcc0b875e4ade2747cf6b195ee4/DEPS
,
Aug 10 2016
ClusterFuzz has detected this issue as fixed in range 410518:410604. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6354926659960832 Fuzzer: attekett_surku_fuzzer Job Type: linux_asan_chrome_media Platform Id: linux Crash Type: Floating-point-exception Crash Address: Crash State: CJBig2_Image::CJBig2_Image CJBig2_GRRDProc::decode CJBig2_Context::parseGenericRefinementRegion Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=409589:409828 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=410518:410604 Minimized Testcase (26.30 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Ek03jei7Q0VSN3Ge6PnWWSIIUHTjroRMrfmgnJb8plwG6Nb3Bd2ZKU3hJlzDyJXiDiQ37Ayh-3fuQU3teuVuR7RnYVi2uyY75IDtNYyqXHUKSoiUlpdpxDvF33PAFGbdcm49kBgZ_X7g71F7zLwywx-g4a4ITx-mHf88ONpls7Zzd6Bg?testcase_id=6354926659960832 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 25 2016
i am still able to reproduce this on Windows 7 Chrome Version 54.0.2840.99 m Testcase https://cluster-fuzz.appspot.com/v2/testcase-detail/4897365150662656
,
May 15 2017
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mummare...@chromium.org
, Aug 5 2016Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)