New issue
Advanced search Search tips

Issue 646295 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 646258
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in WriteUnalignedValue<short>

Project Member Reported by ClusterFuzz, Sep 13 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5194241699741696

Fuzzer: v8_wasm_code_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x00000000007f
Crash State:
  WriteUnalignedValue<short>
  WriteLittleEndianValue<short>
  v8::internal::wasm::ThreadImpl::Execute
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=417985:418093

Minimized Testcase (0.12 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97G61wBZLf65gEseOMsCDnqTJkvJWbenlpPvijOJQ-sgprUZvv_RE6osGTaU7RLbD-Hhyzn4JGV57qJshb-oANhqRwqxIVedlTm-FSbGNvcebWWYia7WnQz08fNgXarJlDVg2rPCWobzSrzcsOAPd9OkImlJA?testcase_id=5194241699741696

Issue manually filed by: tkonchada

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Labels: Te-Logged
Suspected CLs	The result is a list of CLs that change the crashed files.

Author: ahaas
Project: chromium-v8
Changelist: https://chromium.googlesource.com/v8/v8.git/+/1521fe9c3c88128cea5188b28068736a87838f1c
Time: Mon Sep 12 12:26:37 2016
Lines 69-95 of file wasm-code.cc which potentially caused crash are changed in this cl (frame #5, "LLVMFuzzerTestOneInput").

File wasm-module-runner.cc is changed in this cl (and is part of stack frame #4, "v8::internal::wasm::testing::InterpretWasmModule")
Minimum distance from crash line to modified line: 0. (file: wasm-code.cc, crashed on: 66, modified: 66).

Suspected Project: chromium-v8
Components: Blink>JavaScript>WebAssembly
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)
Hello Andreas,

Assigning 2 bugs to you, Read/WriteUnalignedValue() crashes in v8 wasm.  One marked security by clusterfuzz.

Similar bug: https://bugs.chromium.org/p/chromium/issues/detail?id=646258

Comment 3 by ahaas@chromium.org, Sep 14 2016

Mergedinto: 646258
Status: Duplicate (was: Assigned)
Hello Penny,
Both bugs are related and fixed with the same CL.
Project Member

Comment 4 by ClusterFuzz, Sep 15 2016

ClusterFuzz has detected this issue as fixed in range 418535:418598.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5194241699741696

Fuzzer: v8_wasm_code_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x00000000007f
Crash State:
  WriteUnalignedValue<short>
  WriteLittleEndianValue<short>
  v8::internal::wasm::ThreadImpl::Execute
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=417985:418093
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=418535:418598

Minimized Testcase (0.12 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97G61wBZLf65gEseOMsCDnqTJkvJWbenlpPvijOJQ-sgprUZvv_RE6osGTaU7RLbD-Hhyzn4JGV57qJshb-oANhqRwqxIVedlTm-FSbGNvcebWWYia7WnQz08fNgXarJlDVg2rPCWobzSrzcsOAPd9OkImlJA?testcase_id=5194241699741696

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment