New issue
Advanced search Search tips

Issue 647329 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-after-poison in fuzz_wasm_section

Project Member Reported by ClusterFuzz, Sep 15 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5456208398123008

Fuzzer: afl_v8_wasm_names_section_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Use-after-poison WRITE {*}
Crash Address: 0x62d000018410
Crash State:
  fuzz_wasm_section
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=418794:418831

Minimized Testcase (16.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94r03xsWD3ZIZ6UOdx90A5qDpQA-cFKNlier-CgFp-D6YAHu-KzgFrz4nxHotqSDm--5Fs-2PG67CHsgGoa1Ox_3u5m-8h76VXAqQQpTShF2TlqmVj0N60muIofpoty3HLCOyDqXnafp4-j1S7i5WbJVg1bG_w37iHen_RrKMCxa_717m4?testcase_id=5456208398123008

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Components: Blink>JavaScript>WebAssembly
Labels: Pri-2
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)
WASM fuzzer.

Comment 2 by ahaas@chromium.org, Sep 16 2016

Thanks Penny, I will take a look.
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 16 2016

Labels: M-55
Project Member

Comment 4 by sheriffbot@chromium.org, Sep 16 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Sep 16 2016

Labels: -Pri-2 Pri-1

Comment 6 by ahaas@chromium.org, Sep 19 2016

Status: Started (was: Assigned)
Project Member

Comment 7 by bugdroid1@chromium.org, Sep 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/57d81937647e85596f04dd1c2c02e2044f6f5e63

commit 57d81937647e85596f04dd1c2c02e2044f6f5e63
Author: ahaas <ahaas@chromium.org>
Date: Tue Sep 20 14:03:08 2016

[wasm] Fix EnsureSpace in the ZoneBuffer of the wasm encoder.

BUG= chromium:647329 
R=titzer@chromium.org
TEST=unittest EncoderTest.Regression_647329

Review-Url: https://codereview.chromium.org/2355803002
Cr-Commit-Position: refs/heads/master@{#39556}

[modify] https://crrev.com/57d81937647e85596f04dd1c2c02e2044f6f5e63/src/wasm/encoder.h
[modify] https://crrev.com/57d81937647e85596f04dd1c2c02e2044f6f5e63/test/unittests/wasm/encoder-unittest.cc

Comment 8 by ahaas@chromium.org, Sep 21 2016

Status: Fixed (was: Started)
Project Member

Comment 9 by sheriffbot@chromium.org, Sep 21 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 10 by ClusterFuzz, Sep 22 2016

ClusterFuzz has detected this issue as fixed in range 419991:420032.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5456208398123008

Fuzzer: afl_v8_wasm_names_section_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Use-after-poison WRITE {*}
Crash Address: 0x62d000018410
Crash State:
  fuzz_wasm_section
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=418794:418831
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=419991:420032

Minimized Testcase (16.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94r03xsWD3ZIZ6UOdx90A5qDpQA-cFKNlier-CgFp-D6YAHu-KzgFrz4nxHotqSDm--5Fs-2PG67CHsgGoa1Ox_3u5m-8h76VXAqQQpTShF2TlqmVj0N60muIofpoty3HLCOyDqXnafp4-j1S7i5WbJVg1bG_w37iHen_RrKMCxa_717m4?testcase_id=5456208398123008

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Sep 22 2016

ClusterFuzz has detected this issue as fixed in range 419991:420032.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5456208398123008

Fuzzer: afl_v8_wasm_names_section_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Use-after-poison WRITE {*}
Crash Address: 0x62d000018410
Crash State:
  fuzz_wasm_section
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=418794:418831
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=419991:420032

Minimized Testcase (16.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94r03xsWD3ZIZ6UOdx90A5qDpQA-cFKNlier-CgFp-D6YAHu-KzgFrz4nxHotqSDm--5Fs-2PG67CHsgGoa1Ox_3u5m-8h76VXAqQQpTShF2TlqmVj0N60muIofpoty3HLCOyDqXnafp4-j1S7i5WbJVg1bG_w37iHen_RrKMCxa_717m4?testcase_id=5456208398123008

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Labels: -ReleaseBlock-Beta
Project Member

Comment 13 by sheriffbot@chromium.org, Dec 28 2016

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment