New issue
Advanced search Search tips

Issue 643924 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Sep 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-buffer-overflow in llvm::sys::PrintStackTrace

Project Member Reported by ClusterFuzz, Sep 3 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5740838179307520

Fuzzer: libfuzzer_safe_browsing_dmg_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Heap-buffer-overflow READ {*}
Crash Address: 0x619000001d80
Crash State:
  llvm::sys::PrintStackTrace
  SignalHandler
  _sigtramp
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=410288:412598

Minimized Testcase (8.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96EaSxSpF2uHUJOaY3JjQj5BcROe7QTWPXF8EKD2xos9fv3DXLAUUiPzcwEcAZHj2s_oGF3I3ac16RBs1P_O3aa8tAx6xNzIxF9J6y20l2M31hmXyHrWS0VmeUPENZ0TurJYNbCxrTz4kw5CuXxvfpaHj2-yA?testcase_id=5740838179307520

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Sep 3 2016

Labels: M-54
Project Member

Comment 2 by sheriffbot@chromium.org, Sep 3 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 3 2016

Labels: Pri-1

Comment 4 by aarya@google.com, Sep 3 2016

Status: WontFix (was: Untriaged)
Bad stack due to old llvm-symbolizer. Updating to latest version.
Project Member

Comment 5 by ClusterFuzz, Sep 7 2016

ClusterFuzz has detected this issue as fixed in range 416731:416738.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5740838179307520

Fuzzer: libfuzzer_safe_browsing_dmg_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Heap-buffer-overflow READ {*}
Crash Address: 0x619000001d80
Crash State:
  safe_browsing::dmg::UDIFBlock::ParseBlockData
  safe_browsing::dmg::UDIFParser::ParseBlkx
  start
  
Recommended Security Severity: Medium

Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_libfuzzer_chrome_asan&range=416731:416738

Minimized Testcase (8.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95ffPSWIAUG5VsuJxm9-WguWhkP79h83apcDWHnsGiYzZ3g-S3TmxFDAXNqz-6hKplDf2VEQtY3GCvrCvFxvXsFEVMsxemdsIrjT7h4WVNGnopSl9OSd4G7A5UeUT5f9Cic7NI4I7a8dFrHfH-1xWi9JgkyvQ?testcase_id=5740838179307520

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by sheriffbot@chromium.org, Dec 10 2016

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment