Integer-overflow in computeJD |
|||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5631329305886720 Fuzzer: libfuzzer_sqlite3_prepare_v2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: computeJD parseModifier isDate Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746 Minimized Testcase (0.12 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96NSQHw8RlUf5Q2_Q2qXc3JpWY9pxaj3AwSz8OH3yckUtBYTA-D35S1ZTp-kPwjamGFpGbE588VKYdFmeg5-Lx4HaAa2g0wgzvtuBqgpZtVCLdhknxAqXpnqhzf9MtQzdMOL2CSzmeCY1MaMUdvOPeEB5OK9w?testcase_id=5631329305886720 Issue manually filed by: brajkumar See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 29 2016
First, a cleaner minimization might be something like:
SELECT TIME('now','+2666567 month');
which gives '-10952--391134--17' (compare to '2016-09-29')
The overflow is in computeJD (Julian Day) looks like:
X1 = 36525*(Y+4716)/100;
I believe 36525 is 365.25*100 (the code is based on an astronomical reference). There are other constants in here which would also be expected to have 32-bit overflow.
AFAICT, this code doesn't intend to handle overflow at all. I believe the results would only be used as user data, not affecting SQLite's actual control flow, and since the code takes user data as input I also think it's unlikely to be inlined by a compiler in a way that could lead to brokenness.
Is there any way to get a sense of whether this is importantly-broken or something that should be suppressed? The earlier CL involved a change which fixed a problem where overflow semantics were supposed to be well-defined. In this case, I'm not sure there's any intention to guard against such invalid values.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 27 2017
ClusterFuzz testcase 5631329305886720 is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by brajkumar@chromium.org
, Sep 29 2016Owner: sh...@chromium.org
Status: Assigned (was: Untriaged)