New issue
Advanced search Search tips

Issue 655008 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Regression

Blocking:
issue 62400



Sign in to add a comment

Undefined-shift in putagreytile

Project Member Reported by ClusterFuzz, Oct 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4601684431208448

Fuzzer: libfuzzer_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  putagreytile
  gtStripContig
  TIFFReadRGBAImageOriented
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=422937:423055

Minimized Testcase (0.38 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97hObLmXGLfT79OuGMV1sYCyAzoV1QGaR2FTHn0ZFCK-ViQM46dHAnyLNPdG1krjOF1wUQXflwANy01jNHJM56NVsgH9vCyBUeGLv7f_KKnO7r0EZb24KnJHdwV5TCxtoVwz7z5qnZ0tL3ott4-vZXgM8RWYg?testcase_id=4601684431208448

Issue manually filed by: nyerramilli

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: jam@chromium.org nyerramilli@chromium.org
Components: Tools>Test>FindIt>WrongResult Internals>Plugins>PDF
Labels: -Type-Bug findit-wrong Te-Logged Type-Bug-Regression
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Providing Findit results for internal purpose:
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 1287 of file tif_getimage.c, which is stack frame 0.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 946 of file tif_getimage.c, which is stack frame 1.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 519 of file tif_getimage.c, which is stack frame 2.

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fcf61b39ee597c73e80ba789833fb7fe49878422
Time: Thu Jun 09 18:29:35 2016 -0700
The CL last changed line 414 of file fx_codec_tiff.cpp, which is stack frame 3.

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 2235 of file fx_codec_progress.cpp, which is stack frame 4.

Author: dsinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5a5f251ce8646ec421aa9e35d8bbca71a984770a
Time: Mon Jun 06 11:52:30 2016 -0700
The CL last changed line 38 of file xfa_codec_fuzzer.h, which is stack frame 5.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/d6b2224ee4102bbe91c0a59dcb563de2d0ea75f2
Time: Thu Aug 25 01:25:03 2016
The CL last changed line 491 of file FuzzerLoop.cpp, which is stack frame 6.

Suspected Project: chromium-pdfium

requesting pdfium team to check the issue.

Blocking: 62400
Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by npm@chromium.org, Jan 9 2017

Cc: dsinclair@chromium.org
Owner: npm@chromium.org
I've filed a libtiff bug with suggested fix.
Project Member

Comment 6 by ClusterFuzz, Jan 12 2017

ClusterFuzz has detected this issue as fixed in range 442993:443106.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4601684431208448

Fuzzer: libfuzzer_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  putagreytile
  gtStripContig
  TIFFReadRGBAImageOriented
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=422937:423055
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=442993:443106

Minimized Testcase (0.38 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97hObLmXGLfT79OuGMV1sYCyAzoV1QGaR2FTHn0ZFCK-ViQM46dHAnyLNPdG1krjOF1wUQXflwANy01jNHJM56NVsgH9vCyBUeGLv7f_KKnO7r0EZb24KnJHdwV5TCxtoVwz7z5qnZ0tL3ott4-vZXgM8RWYg?testcase_id=4601684431208448

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jan 12 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4601684431208448 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 8 by bugdroid1@chromium.org, Jan 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b65ab0c7ef82e115a49e79ab0d413d2de7df2f11

commit b65ab0c7ef82e115a49e79ab0d413d2de7df2f11
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Thu Jan 12 16:36:15 2017

Roll src/third_party/pdfium/ ffdfbb9ec..e7fb8eb3e (1 commit).

https://pdfium.googlesource.com/pdfium.git/+log/ffdfbb9ec274..e7fb8eb3e9f2

$ git log ffdfbb9ec..e7fb8eb3e --date=short --no-merges --format='%ad %ae %s'
2017-01-11 npm Prevent undefined shift in putagreytile

BUG= 655008 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2624133005
Cr-Commit-Position: refs/heads/master@{#443258}

[modify] https://crrev.com/b65ab0c7ef82e115a49e79ab0d413d2de7df2f11/DEPS

Sign in to add a comment