New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 641454 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Stack-overflow in Token::Token

Project Member Reported by ClusterFuzz, Aug 26 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6422056185102336

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffc3cabef28
Crash State:
  Token::Token
  Parser::List
  Parser::ParseExpression
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=414068:414164

Minimized Testcase (4.54 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96tHmJKxajv-uX-FG9E0GTuRQjtWK4X572xmMuWgTrVkHxKjcT4tcxVR8dTUT1QJh1idE27mrSB67r_DSmpzmr2JeqUpSSg3QpmG8L7syQgTz6BrfD5i8C2m7RjZL5VSEANz_WgazV2VoSIvSR7DMSbxCLwkA?testcase_id=6422056185102336

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 

Comment 1 by mmoroz@chromium.org, Aug 26 2016

Cc: mmoroz@chromium.org kcc@chromium.org aizatsky@chromium.org
Labels: Build-Tools-GN
Owner: thakis@chromium.org
Project Member

Comment 2 by ClusterFuzz, Aug 27 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6541853862395904

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff551e7a88
Crash State:
  Token::Token
  Parser::ParseExpression
  Parser::Group
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=414099:414114

Minimized Testcase (3.80 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94Fz_kQHD7GQs4dq9lrJOrv1oorqR5vNLLsqA9oM3ExmKRwKMWNVm8KIraLd7Ii_YFIyKduwcM3mg0BLsNWVk08kO-zNpoldpjN0yw_Gdqey3lPa4tWvOzVtT4kVbDC23lc7Hsp7ab7MTurcIsN1DL33SoqoA?testcase_id=6541853862395904

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 3 by ClusterFuzz, Aug 27 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5089743539011584

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff5a78fac8
Crash State:
  Token::Token
  Parser::ParseExpression
  Parser::Not
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=414099:414114

Minimized Testcase (4.24 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95JjEHUO_e6TkoHuMVnEQZNgfqctGHPR1F-eWVcsqlk9wVk8hfvCtDCmqTFqSTmcbrdiEE6Ayn-fcjsz85BU3HrYvQN8LyLotKnA8TwosZFgaBRyG2UolBEFMI0_qXaslmVIGZnHfd4fFioiU3R_NoAIV46bQ?testcase_id=5089743539011584

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 4 by ClusterFuzz, Aug 27 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4979400192032768

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff5a717be8
Crash State:
  Parser::ParseList
  Parser::List
  Parser::ParseExpression
  

Minimized Testcase (4.77 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95dgxKbqH5t1MgU5t5o-tCdBYQF7f1XFFt6VfqCRJUwzZJEn0Y039AKtl85zqASbgBu-wxLXl-HU2M4UoMd8FE4cZXYL_VyzKrkSsWGfZmVmuSyA4WWU2u8_qgskwcZkBOmlJyaLbG-vu0GZ0Z5kQ-IXfx0Kw?testcase_id=4979400192032768

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 5 by bugdroid1@chromium.org, Aug 30 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9e92b9d9ef75b26947a46ed3bc2735fddc888b3f

commit 9e92b9d9ef75b26947a46ed3bc2735fddc888b3f
Author: thakis <thakis@chromium.org>
Date: Tue Aug 30 05:49:52 2016

gn: Reduce stack memory use while parsing.

BUG= 641454 

Review-Url: https://codereview.chromium.org/2290713002
Cr-Commit-Position: refs/heads/master@{#415181}

[modify] https://crrev.com/9e92b9d9ef75b26947a46ed3bc2735fddc888b3f/tools/gn/parser.cc
[modify] https://crrev.com/9e92b9d9ef75b26947a46ed3bc2735fddc888b3f/tools/gn/parser.h

Project Member

Comment 6 by ClusterFuzz, Aug 31 2016

ClusterFuzz has detected this issue as fixed in range 415152:415222.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4979400192032768

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff5a717be8
Crash State:
  Parser::ParseList
  Parser::List
  Parser::ParseExpression
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=414099:414114
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=415152:415222

Minimized Testcase (4.77 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95dgxKbqH5t1MgU5t5o-tCdBYQF7f1XFFt6VfqCRJUwzZJEn0Y039AKtl85zqASbgBu-wxLXl-HU2M4UoMd8FE4cZXYL_VyzKrkSsWGfZmVmuSyA4WWU2u8_qgskwcZkBOmlJyaLbG-vu0GZ0Z5kQ-IXfx0Kw?testcase_id=4979400192032768

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Aug 31 2016

ClusterFuzz has detected this issue as fixed in range 415152:415222.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5089743539011584

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff5a78fac8
Crash State:
  Token::Token
  Parser::ParseExpression
  Parser::Not
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=414099:414114
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=415152:415222

Minimized Testcase (4.24 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95JjEHUO_e6TkoHuMVnEQZNgfqctGHPR1F-eWVcsqlk9wVk8hfvCtDCmqTFqSTmcbrdiEE6Ayn-fcjsz85BU3HrYvQN8LyLotKnA8TwosZFgaBRyG2UolBEFMI0_qXaslmVIGZnHfd4fFioiU3R_NoAIV46bQ?testcase_id=5089743539011584

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Aug 31 2016

ClusterFuzz has detected this issue as fixed in range 415152:415222.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6541853862395904

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff551e7a88
Crash State:
  Token::Token
  Parser::ParseExpression
  Parser::Group
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=414099:414114
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=415152:415222

Minimized Testcase (3.80 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94Fz_kQHD7GQs4dq9lrJOrv1oorqR5vNLLsqA9oM3ExmKRwKMWNVm8KIraLd7Ii_YFIyKduwcM3mg0BLsNWVk08kO-zNpoldpjN0yw_Gdqey3lPa4tWvOzVtT4kVbDC23lc7Hsp7ab7MTurcIsN1DL33SoqoA?testcase_id=6541853862395904

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 9 by thakis@chromium.org, Aug 31 2016

Status: Fixed (was: Untriaged)
Not really fixed, but it'll take the fuzzer longer to find it.
Status: Available (was: Fixed)
Temporarily re-opening to attach another crash.
Project Member

Comment 11 by ClusterFuzz, Aug 31 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5922089611821056

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7fff3301bc18
Crash State:
  Parser::ParseExpression
  Parser::ParseList
  Parser::List
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv948WXL1z_Cq1jK3Njf27nh-T27OCFd7XlOP_TC2AOi01d0aTuaTTUnmE1HfjKAERFnrfetxZRpIsey8WNbYnQr8SDzhzWZ-PmcgVY-KkGF3SBWjr4M2nEAynxV9LvhAmUAM7K7IqU51zuwZzE0k5YHN6fDRwQ?testcase_id=5922089611821056


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Status: Fixed (was: Available)
Project Member

Comment 13 by ClusterFuzz, Sep 3 2016

ClusterFuzz has detected this issue as fixed in range 416298:416360.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5922089611821056

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7fff3301bc18
Crash State:
  Parser::ParseExpression
  Parser::ParseList
  Parser::List
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=416298:416360

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv948WXL1z_Cq1jK3Njf27nh-T27OCFd7XlOP_TC2AOi01d0aTuaTTUnmE1HfjKAERFnrfetxZRpIsey8WNbYnQr8SDzhzWZ-PmcgVY-KkGF3SBWjr4M2nEAynxV9LvhAmUAM7K7IqU51zuwZzE0k5YHN6fDRwQ?testcase_id=5922089611821056


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by ClusterFuzz, Sep 9 2016

ClusterFuzz has detected this issue as fixed in range 417381:417503.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6422056185102336

Fuzzer: libfuzzer_gn_parser_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffc3cabef28
Crash State:
  Token::Token
  Parser::List
  Parser::ParseExpression
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=414068:414164
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=417381:417503

Minimized Testcase (4.54 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96tHmJKxajv-uX-FG9E0GTuRQjtWK4X572xmMuWgTrVkHxKjcT4tcxVR8dTUT1QJh1idE27mrSB67r_DSmpzmr2JeqUpSSg3QpmG8L7syQgTz6BrfD5i8C2m7RjZL5VSEANz_WgazV2VoSIvSR7DMSbxCLwkA?testcase_id=6422056185102336

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 15 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment