Issue metadata
Sign in to add a comment
|
Heap-buffer-overflow in safe_browsing::dmg::UDIFBlock::ParseBlockData |
||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6166426824212480 Fuzzer: libfuzzer_safe_browsing_dmg_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Heap-buffer-overflow READ {*} Crash Address: 0x619000001d80 Crash State: safe_browsing::dmg::UDIFBlock::ParseBlockData safe_browsing::dmg::UDIFParser::ParseBlkx start Recommended Security Severity: Medium Minimized Testcase (8.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96Ixo5IzyVZvPzBo7R8HkIoalK8kKrak8yJhO3BGh3k9vNvoJ0h-XUHfLako3WwRCch9LouZmotE1w1Vp9hpbC2WxWlln9afq8nm4tpy_Rl6uvwtzsGS7TG7ifljMQ2XGHSJPBqAfh-0-cFr6Nce9EYT3uKTg?testcase_id=6166426824212480 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 2 2016
,
Sep 3 2016
,
Sep 3 2016
,
Sep 6 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5a29d68e849e2beb122b1ade3a53527a3db04186 commit 5a29d68e849e2beb122b1ade3a53527a3db04186 Author: rsesek <rsesek@chromium.org> Date: Tue Sep 06 21:21:22 2016 Validate that UDIFBlock data length matches the size and reported number of chunks. BUG= 643726 R=nparker@chromium.org Review-Url: https://codereview.chromium.org/2314883002 Cr-Commit-Position: refs/heads/master@{#416732} [modify] https://crrev.com/5a29d68e849e2beb122b1ade3a53527a3db04186/chrome/utility/BUILD.gn [modify] https://crrev.com/5a29d68e849e2beb122b1ade3a53527a3db04186/chrome/utility/safe_browsing/mac/udif.cc
,
Sep 7 2016
,
Sep 8 2016
,
Dec 15 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by vakh@chromium.org
, Sep 2 2016Labels: SafeBrowsing-Triaged
Owner: rsesek@chromium.org
Status: Assigned (was: Untriaged)