New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 643677 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Undefined-shift in CFX_BitStream::GetBits

Project Member Reported by ClusterFuzz, Sep 2 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5533298917113856

Fuzzer: libfuzzer_pdf_hint_table_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CFX_BitStream::GetBits
  CPDF_HintTables::ReadSharedObjHintTable
  HintTableForFuzzing::Fuzz
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=413192:413325

Minimized Testcase (0.14 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94gcElPZxwD7Bhc8yTYwlyA0hX9zc1Ow13r3QKjAG3DsI4SgLTlBHKv1Ne9ysOqVnVN3Ntti6Wuug8R3PQ2C6m0NGWlWNXu4it_qogyP6RvwRhkzz75YgcOPCUMTQ6NEk3aGxhAf62lHeNSNHB4-MYeZb_YCA?testcase_id=5533298917113856

Issue manually filed by: msrchandra

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: pdfium-deps-roller@chromium.org
Components: Tools>Test>FindIt>NoResult Internals>Plugins>PDF
Labels: -Type-Bug findit-wrong Te-Logged Type-Bug-Regression
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any possible suspect. Providing find it results for internal purpose,
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: Nico Weber
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/9d8ec5a6e37e8d1d4d4edca9040de234e2d4728f
Time: Tue Aug 04 13:00:21 2015 -0700
The CL last changed line 221 of file fx_basic_buffer.cpp, which is stack frame 0.

Author: dsinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/4e20094dbb2ea942734b8986fa9a60d2f3ccbb1b
Time: Wed Apr 06 12:06:35 2016 -0700
The CL last changed line 311 of file cpdf_hint_tables.cpp, which is stack frame 1.

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5b13e1dc5770b73295f0c4a61c699a10eb7922e6
Time: Fri Aug 19 12:04:05 2016 -0700
The CL last changed line 46 of file pdf_hint_table_fuzzer.cc, which is stack frame 2.

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5b13e1dc5770b73295f0c4a61c699a10eb7922e6
Time: Fri Aug 19 12:04:05 2016 -0700
The CL last changed line 89 of file pdf_hint_table_fuzzer.cc, which is stack frame 3.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/d6b2224ee4102bbe91c0a59dcb563de2d0ea75f2
Time: Thu Aug 25 01:25:03 2016
The CL last changed line 481 of file FuzzerLoop.cpp, which is stack frame 4.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/d33f707d488e6ac62cb5110f90115d9fe863c99e
Time: Sat Feb 13 17:56:51 2016
The CL last changed line 437 of file FuzzerLoop.cpp, which is stack frame 5.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/c2611b151470cb4d29e587a1ace9beb64d9f5dba
Time: Tue Aug 30 14:52:05 2016
The CL last changed line 268 of file FuzzerDriver.cpp, which is stack frame 6.

Suspected Project: chromium-pdfium

From the regressed CL, assigning to the concern owner. Below are the CL details
https://chromium.googlesource.com/chromium/src/+log/784971913adcc32bdb22a92da6ac237a7de88a2b..ff280f67ab2bca6f1935e6d0061d9145a24a9526?pretty=fuller

Suspected Commit# b9dc835015e914ded4f4f3db0bd9e95aaf7d7c03
Suspected Review URL# https://codereview.chromium.org/2264733002

@dsinclair -- Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to concern owner.
Thank You.
Cc: -pdfium-deps-roller@chromium.org msrchandra@chromium.org
Labels: -Type-Bug-Regression Type-Bug
Owner: thestig@chromium.org
msrchandra: pdfium-deps-roller is a machine.
Components: -Tools>Test>FindIt>NoResult
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by ClusterFuzz, Mar 27 2017

ClusterFuzz has detected this issue as fixed in range 459701:459705.

Detailed report: https://clusterfuzz.com/testcase?key=5533298917113856

Fuzzer: libfuzzer_pdf_hint_table_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CFX_BitStream::GetBits
  CPDF_HintTables::ReadSharedObjHintTable
  HintTableForFuzzing::Fuzz
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=413192:413325
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=459701:459705

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94AmRUm8-EalBMsWSnEQCHKQJQ0OitZb92koyRqJYAfs2eaxP9Jx06mNnz73fdVXCGkWifQ4XFmGIwcQN8C7kp_-w7IGdak5awzGNbCEeyoaferA5Qs05AKqLNTAstkQEZzoq9gEDZ7ZJmIo0KtUQMlvI2Q7FYplHmJ3ahW3bAa8jKf0ZuYIcMv9o8g4ydxJlOuOH0gxRXTw29JpgKBRD-JiZd0tze0ciG-f3hfxfXbbCBeCvx1HYpEdJRD_3JCLPZOUC464a1vmvpFi79g2JDrZmCU9wK5Gt05fLcuezqTp4Cx_9mQZDch2NmPoWsEfd5SWY1x9IZTdc-Dt2BoLAKJ1JCvxQgbS0kG6__OyJ2qMxtbpxM?testcase_id=5533298917113856


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Mar 27 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5533298917113856 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 7 by npm@chromium.org, Mar 27 2017

Labels: ClusterFuzz-Wrong
Status: Assigned (was: Verified)
I don't think this is fixed. Seems to be crashing now.
Status: WontFix (was: Assigned)
Bulk-WontFixing these bugs. This was a bug on ClusterFuzz side, see bug 717534. We will start seeing new testcases auto-filed in a day or two. We can't leave these open as ClusterFuzz won't autoverify them after ClusterFuzz-Wrong label.
Labels: -ClusterFuzz-Wrong
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.

Sign in to add a comment