New issue
Advanced search Search tips

Issue 655056 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Regression

Blocking:
issue 62400



Sign in to add a comment

Crash in CCodec_TiffContext::LoadFrameInfo

Project Member Reported by ClusterFuzz, Oct 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6296786438455296

Fuzzer: libfuzzer_radamsa_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900002181
Crash State:
  CCodec_TiffContext::LoadFrameInfo
  CCodec_TiffModule::LoadFrameInfo
  CCodec_ProgressiveDecoder::DetectImageType
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=423381:423433

Minimized Testcase (0.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97SOWgFHyb8Kaz1kTBRNgwOcFLkV2FIGd5NRZPaXQUtPBwoWJa5GMLBeMRPoeDwSjGRT_R6xtQT9EqWDqrfPUE8prrdQl33SlgQDc0ujdCTPh8_CIIsRhc-9-4mc0w8ogt8K2Y7wL-DDveecnqt4eiaWir0_g?testcase_id=6296786438455296

Issue manually filed by: nyerramilli

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: dsinclair@chromium.org nyerramilli@chromium.org
Components: Tools>Test>FindIt>WrongResult Internals>Plugins>PDF
Labels: -Pri-1 -Type-Bug findit-wrong Te-Logged Pri-2 Type-Bug-Regression
Owner: brucedaw...@chromium.org
Status: Assigned (was: Untriaged)
providing Findit results for internal purpose:

Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fcf61b39ee597c73e80ba789833fb7fe49878422
Time: Thu Jun 09 18:29:35 2016 -0700
The CL last changed line 245 of file fx_codec_tiff.cpp, which is stack frame 1.

Author: dsinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/d55e11eeb8ebf1e226a1166f395ba77248ce84c3
Time: Tue Apr 12 11:21:22 2016 -0700
The CL last changed line 454 of file fx_codec_tiff.cpp, which is stack frame 2.

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fcf61b39ee597c73e80ba789833fb7fe49878422
Time: Thu Jun 09 18:29:35 2016 -0700
The CL last changed line 1279 of file fx_codec_progress.cpp, which is stack frame 3.

Author: dsinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/54d027dbbff8a0270531855082e4f61cb457c173
Time: Mon Jun 20 09:09:56 2016 -0700
The CL last changed line 1326 of file fx_codec_progress.cpp, which is stack frame 4.

Author: dsinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/82e24b1c5047076b982c073671315071760b9880
Time: Mon Jun 13 13:46:49 2016 -0700
The CL last changed line 23 of file xfa_codec_fuzzer.h, which is stack frame 5.

Author: kcc
Project: chromium-libfuzzer
Changelist: https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer.git/+/d6b2224ee4102bbe91c0a59dcb563de2d0ea75f2
Time: Thu Aug 25 01:25:03 2016
The CL last changed line 491 of file FuzzerLoop.cpp, which is stack frame 6.

Suspected Project: chromium-pdfium

requesting pdfium team to check the issue.

Blocking: 62400
Owner: dsinclair@chromium.org
Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by npm@chromium.org, Jan 9 2017

Owner: npm@chromium.org
Status: Started (was: Assigned)

Comment 6 by npm@chromium.org, Jan 9 2017

Status: Fixed (was: Started)
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cf8a857a7f097818e1c6845ab96fbf768d3fc470

commit cf8a857a7f097818e1c6845ab96fbf768d3fc470
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Mon Jan 09 22:26:54 2017

Roll src/third_party/pdfium/ c589fdc5e..f04b7f1c4 (1 commit).

https://pdfium.googlesource.com/pdfium.git/+log/c589fdc5e4e9..f04b7f1c438b

$ git log c589fdc5e..f04b7f1c4 --date=short --no-merges --format='%ad %ae %s'
2017-01-09 npm Check validity of width and height in CCodec_TiffContext::LoadFrameInfo

BUG= 655056 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2623513004
Cr-Commit-Position: refs/heads/master@{#442374}

[modify] https://crrev.com/cf8a857a7f097818e1c6845ab96fbf768d3fc470/DEPS

Project Member

Comment 8 by ClusterFuzz, Jan 10 2017

ClusterFuzz has detected this issue as fixed in range 442197:442202.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6296786438455296

Fuzzer: libfuzzer_radamsa_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900002181
Crash State:
  CCodec_TiffContext::LoadFrameInfo
  CCodec_TiffModule::LoadFrameInfo
  CCodec_ProgressiveDecoder::DetectImageType
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=423381:423433
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=442197:442202

Minimized Testcase (0.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97SOWgFHyb8Kaz1kTBRNgwOcFLkV2FIGd5NRZPaXQUtPBwoWJa5GMLBeMRPoeDwSjGRT_R6xtQT9EqWDqrfPUE8prrdQl33SlgQDc0ujdCTPh8_CIIsRhc-9-4mc0w8ogt8K2Y7wL-DDveecnqt4eiaWir0_g?testcase_id=6296786438455296

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment