New issue
Advanced search Search tips

Issue 635447 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Undefined-shift in hb_ot_map_builder_t::compile

Project Member Reported by ClusterFuzz, Aug 8 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4576747016421376

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  hb_ot_map_builder_t::compile
  hb_ot_shape_planner_t::compile
  _hb_ot_shaper_shape_plan_data_create
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=407167:409223

Minimized Testcase (0.62 Kb): https://cluster-fuzz.appspot.com/download/AMIfv958dySu2ShoezI6t4igNYQrgizsEiRTJcSwM9qRoG_zSpJhJ9qXYdzr-MOq6PvZZUlqjGqCo5HR6aCWhQZYAIXenIbgjejGGj8UaVF36BbPl-iiKWCQl9VAbxHVEZrL7pOzaYSxEngTOqCoJ1nIw7TnySbmmg?testcase_id=4576747016421376

Issue manually filed by: ajha

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by ajha@chromium.org, Aug 8 2016

Cc: e...@chromium.org
Components: Blink>Fonts
Labels: M-54 Te-Logged
Owner: bashi@chromium.org
Status: Assigned (was: Untriaged)
Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: evan@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/29c2daeafac577bd80c7b37891e3bbae7c542b5e
Time: Wed Jan 05 20:38:50 2011
The CL last changed line 246 of file hb-ot-map.cc, which is stack frame 0.

Author: jshin@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/307f7bdd33cf295aac89b436982d40d8ba63fc6a
Time: Fri Jan 11 20:33:21 2013
The CL last changed line 84 of file hb-ot-shape-private.hh, which is stack frame 1.

Author: bashi@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/55097d32fb9f0b18fe8fea1fcdb2a9c89f6698b9
Time: Tue Sep 11 01:34:56 2012
The CL last changed line 178 of file hb-ot-shape.cc, which is stack frame 2.

Author: bashi@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/55097d32fb9f0b18fe8fea1fcdb2a9c89f6698b9
Time: Tue Sep 11 01:34:56 2012
The CL last changed line 43 of file hb-shaper-list.hh, which is stack frame 3.

Author: bashi@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/55097d32fb9f0b18fe8fea1fcdb2a9c89f6698b9
Time: Tue Sep 11 01:34:56 2012
The CL last changed line 149 of file hb-shape-plan.cc, which is stack frame 4.

Author: bashi@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/55097d32fb9f0b18fe8fea1fcdb2a9c89f6698b9
Time: Tue Sep 11 01:34:56 2012
The CL last changed line 458 of file hb-shape-plan.cc, which is stack frame 5.

Author: bashi@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/55097d32fb9f0b18fe8fea1fcdb2a9c89f6698b9
Time: Tue Sep 11 01:34:56 2012
The CL last changed line 376 of file hb-shape.cc, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>Fonts

None of the above changes from the above Findit result look related.

Assigning to bashi@(chromium//src/third_party/harfbuzz-ng/OWNERS) for more inputs on this.



Project Member

Comment 2 by ClusterFuzz, Sep 9 2016

ClusterFuzz has detected this issue as fixed in range 417287:417309.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4576747016421376

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  hb_ot_map_builder_t::compile
  hb_ot_shape_planner_t::compile
  _hb_ot_shaper_shape_plan_data_create
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=407167:409223
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=417287:417309

Minimized Testcase (0.62 Kb): https://cluster-fuzz.appspot.com/download/AMIfv958dySu2ShoezI6t4igNYQrgizsEiRTJcSwM9qRoG_zSpJhJ9qXYdzr-MOq6PvZZUlqjGqCo5HR6aCWhQZYAIXenIbgjejGGj8UaVF36BbPl-iiKWCQl9VAbxHVEZrL7pOzaYSxEngTOqCoJ1nIw7TnySbmmg?testcase_id=4576747016421376

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 3 by ClusterFuzz, Sep 9 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment