New issue
Advanced search Search tips

Issue 645954 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in FPDF_GenerateAP

Project Member Reported by ClusterFuzz, Sep 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4872845320781824

Fuzzer: ifratric_pdf_generic
Job Type: linux_asan_pdfium
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  FPDF_GenerateAP
  CPDF_AnnotList::CPDF_AnnotList
  FPDF_RenderPage_Retail
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=417755:417794

Minimized Testcase (101.69 Kb): https://cluster-fuzz.appspot.com/download/AMIfv952yDZxc8WGtwr1N5FAihR8doqJN6UG4__IfhaskrVJTsUStu4U2DvDLYkWNaZKOqo51EktxBhTvQgdggvlI1zDtWg3Yu1AE8QgcvtT1rywgZSTVODIxMLO_SaTtep_HJ2C4XYvpLbvv9JJMjjjEzcw84uOjtjlSFgNqgiJDzD5Gp9oPKg?testcase_id=4872845320781824

Issue manually filed by: tkonchada

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Labels: Findit-for-crash M-55 Te-Logged
Owner: jaepark@google.com
Status: Assigned (was: Untriaged)
Suspected CLs	The result is a list of CLs that change the crashed files.

Author: jaepark
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/75f84a56fed36111ece82d0ac96e87289622b093
Time: Fri Sep 09 15:39:09 2016 -0700
Lines 576-578 of file pdfium_test.cc which potentially caused crash are changed in this cl (frame #4, "RenderPage").

Lines 899 of file fpdfview.cpp which potentially caused crash are changed in this cl (frame #2, "FPDF_RenderPage_Retail").
Minimum distance from crash line to modified line: 0. (file: fpdfview.cpp, crashed on: 899, modified: 899).

Suspected Project: chromium-pdfium

Please reassign if this is not related to your change.
Project Member

Comment 2 by ClusterFuzz, Sep 13 2016

Labels: Hotlist-SyzyASAN
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5876176642113536

Fuzzer: attekett_surku_fuzzer
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  FPDF_GenerateAP
  CPDF_AnnotList::CPDF_AnnotList
  FPDF_RenderPage_Retail
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=418041:418129

Minimized Testcase (8.85 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95KznXYx1ycePmmuMvmxTimN3Y21j6bmVFeSlAPp3umg6vr6kaj5LzOF9q2T-l9mM_kYrwpAbDBtr1GRIH3ncf3ZQb4-JppxIbqlAuYlPeKAh_oFjmOUkE1jQ7KzIGSIv0uD4X746ugzb3anoDeOb4-zRWJmA?testcase_id=5876176642113536

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Owner: thestig@chromium.org
Components: Internals>Plugins>PDF
Status: Started (was: Assigned)
https://codereview.chromium.org/2355733002
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3947746c5c35687c2b340cdd5fe9e9daf7153803

commit 3947746c5c35687c2b340cdd5fe9e9daf7153803
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Tue Sep 20 13:55:56 2016

Roll src/third_party/pdfium/ 81e1e3fd2..717d1330b (2 commits).

https://pdfium.googlesource.com/pdfium.git/+log/81e1e3fd2d33..717d1330bafb

$ git log 81e1e3fd2..717d1330b --date=short --no-merges --format='%ad %ae %s'
2016-09-20 thestig Fix nullptr dereference in FPDF_GenerateAP().
2016-09-20 tsepez Fix stack exhaustion in CPDF_PSProc::Parse()

BUG= 645954 , 648059 

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2346163006
Cr-Commit-Position: refs/heads/master@{#419747}

[modify] https://crrev.com/3947746c5c35687c2b340cdd5fe9e9daf7153803/DEPS

Status: Fixed (was: Started)
Project Member

Comment 8 by ClusterFuzz, Sep 21 2016

ClusterFuzz has detected this issue as fixed in range 419731:419755.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4872845320781824

Fuzzer: ifratric_pdf_generic
Job Type: linux_asan_pdfium
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  FPDF_GenerateAP
  CPDF_AnnotList::CPDF_AnnotList
  FPDF_RenderPage_Retail
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=417755:417794
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=419731:419755

Minimized Testcase (101.69 Kb): https://cluster-fuzz.appspot.com/download/AMIfv952yDZxc8WGtwr1N5FAihR8doqJN6UG4__IfhaskrVJTsUStu4U2DvDLYkWNaZKOqo51EktxBhTvQgdggvlI1zDtWg3Yu1AE8QgcvtT1rywgZSTVODIxMLO_SaTtep_HJ2C4XYvpLbvv9JJMjjjEzcw84uOjtjlSFgNqgiJDzD5Gp9oPKg?testcase_id=4872845320781824

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment