New issue
Advanced search Search tips

Issue 654326 link

Starred by 1 user
Status: Duplicate
Merged: issue 629034
Owner:
f...@opera.com
Closed: Oct 2016
Cc:
nyerramilli@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Undefined-shift in blink::parseHTMLListOfFloatingPointNumbers

Project Member Reported by ClusterFuzz, Oct 10 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4520842073735168

Fuzzer: ochang_search_index_mutator
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  blink::parseHTMLListOfFloatingPointNumbers
  blink::HTMLAreaElement::parseAttribute
  blink::Element::attributeChanged
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=371873:371952

Minimized Testcase (0.05 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv965NmkLUacNQIvgSZNZtkVjhrratQAghA0Gw4460mBuLB3oOkooR6kLHBixZMil8NzehwbJVhKScWBP5YDNzWCdb8h8d3_THToW4Ljyko9hWGvmZXheO4G3K_koac9ewS9Hhjj1BMEBWIkJy7VVA14KtZEh1Q?testcase_id=4520842073735168
<area coords="97,251,11,253,8,197E63,198,72,229,97,229">


Issue manually filed by: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by nyerramilli@chromium.org, Oct 10 2016

Cc: nyerramilli@chromium.org
Labels: M-54 Findit-for-crash ToolsTestsFindItCorrectResult
Owner: f...@opera.com
Status: Assigned (was: Untriaged)
Suspected CLs	The result is a list of CLs that change the crashed files.

Author: fs
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1d6711a6b110f354e90ee7a481323b54c7655b2d
Time: Thu Jan 28 00:39:20 2016
File HTMLParserIdioms.cpp is changed in this cl (and is part of stack frame #6, "parseHTMLListOfFloatingPointNumbersInternal")
Minimum distance from crash line to modified line: 11. (file: HTMLParserIdioms.cpp, crashed on: 327, modified: 316).

Suspected Project: chromium
Suspected Component: Blink>HTML


based on Findit reuslts, assigning to fs@, could you please check the issue.

Comment 2 by nyerramilli@chromium.org, Oct 10 2016

Components: Blink>HTML Tools>Test>FindIt>CorrectResult
Labels: -ToolsTestsFindItCorrectResult

Comment 3 by f...@opera.com, Oct 10 2016

Mergedinto: 629034
Status: Duplicate (was: Assigned)
../../third_party/WebKit/Source/wtf/dtoa/strtod.cc:271:15: runtime error: shift exponent 56 is too large for 32-bit type int
    #0 0x7fa2615e0a13 in DiyFpStrtod third_party/WebKit/Source/wtf/dtoa/strtod.cc:271:15

Same as  issue 629034 .
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment