Container-overflow in Err::Err |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5507269037129728 Fuzzer: afl_gn_parser_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Container-overflow READ {*} Crash Address: 0x61700000fb28 Crash State: Err::Err Parser::ParseCondition Parser::ParseStatement Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=414068:414117 Minimized Testcase (0.04 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv94HtfJmcO9wxsPA_88f-2Hmfz_0c-qBJEmKPtPgWc2mT5_U5fbA1h8sBBjelyXQegg5gEGt9t6A-IxDIaM0hYUzaBZbs1cMO8DuaE47uXJJYxR7uIitbIRJpGF5cne5scF91V3Say44x8QxzIrWK1PiD9REgw?testcase_id=5507269037129728 if(((((!QQQQQQQQQQQQQQQQQQQQQQQ!QQQ else Issue manually filed by: inferno See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 25 2016
Removing security restrictions.
,
Aug 25 2016
,
Aug 25 2016
,
Aug 25 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5aba5ce9d5f3184b1e659c319e962c57274cbe03 commit 5aba5ce9d5f3184b1e659c319e962c57274cbe03 Author: thakis <thakis@chromium.org> Date: Thu Aug 25 17:15:04 2016 gn: Don't do an out-of-bound access if a file ends after 'else' BUG= 640857 Review-Url: https://codereview.chromium.org/2282493002 Cr-Commit-Position: refs/heads/master@{#414461} [modify] https://crrev.com/5aba5ce9d5f3184b1e659c319e962c57274cbe03/tools/gn/parser.cc [modify] https://crrev.com/5aba5ce9d5f3184b1e659c319e962c57274cbe03/tools/gn/parser.h
,
Aug 25 2016
,
Aug 26 2016
ClusterFuzz has detected this issue as fixed in range 414421:414515. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5507269037129728 Fuzzer: afl_gn_parser_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Container-overflow READ {*} Crash Address: 0x61700000fb28 Crash State: Err::Err Parser::ParseCondition Parser::ParseStatement Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=414068:414117 Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=414421:414515 Minimized Testcase (0.04 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv94HtfJmcO9wxsPA_88f-2Hmfz_0c-qBJEmKPtPgWc2mT5_U5fbA1h8sBBjelyXQegg5gEGt9t6A-IxDIaM0hYUzaBZbs1cMO8DuaE47uXJJYxR7uIitbIRJpGF5cne5scF91V3Say44x8QxzIrWK1PiD9REgw?testcase_id=5507269037129728 if(((((!QQQQQQQQQQQQQQQQQQQQQQQ!QQQ else See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
||||
►
Sign in to add a comment |
||||
Comment 1 by infe...@chromium.org
, Aug 25 2016Labels: -Security_Severity-Low -Security_Impact-Head Security_Impact-None
Owner: thakis@chromium.org
Status: Assigned (was: Untriaged)