New issue
Advanced search Search tips

Issue 655465 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Dec 2016
Cc:
tkent@chromium.org
nyerramilli@chromium.org
yutak@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug-Regression



Sign in to add a comment

Integer-overflow in daysFrom1970ToYear

Project Member Reported by ClusterFuzz, Oct 13 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5401042235949056

Fuzzer: inferno_webbot
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  daysFrom1970ToYear
  blink::Document::lastModified
  lastModifiedAttributeGetter
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027

Minimized Testcase (0.09 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96fncDX-IyC4j5S9hqSgyvpVdUB75XD-oE8qhCeQHi27glFN4x2d4VfYm6-v0uAniDpsJp7fIbqZ6xzbBkW2xlZm3qEe1VyqzavmP0KSFDfzzT9kFnf_RRnJqyF4kEHEq_a5kuzmodrCrQEwY1d__14eUc1fg?testcase_id=5401042235949056
<script>
window.open("http://softwares7.com");
window.location = "http://wetrecht.nl";</script>


Issue manually filed by: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by nyerramilli@chromium.org, Oct 13 2016

Cc: nyerramilli@chromium.org
Components: Tools>Test>FindIt>WrongResult
Labels: -Type-Bug findit-wrong M-54 Te-Logged Type-Bug-Regression
Owner: tkent@chromium.org
Status: Assigned (was: Untriaged)
Providing Findit Results for internal purpose:
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 145 of file DateMath.cpp, which is stack frame 0.

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 173 of file DateMath.cpp, which is stack frame 1.

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 378 of file DateMath.cpp, which is stack frame 2.

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 837 of file DateMath.cpp, which is stack frame 3.

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 4447 of file Document.cpp, which is stack frame 4.

Suspected Project: chromium

seeing some changes to 'DateMath.cpp' in https://chromium.googlesource.com/chromium/src/+/338614224cc310e73e59496869000ef87b46e6c1
tkent@, could you please check and help.

Comment 2 by tkent@chromium.org, Oct 13 2016

Cc: tkent@chromium.org
Components: Blink>HTML Blink>Internals>WTF
Labels: -Pri-2 -M-54 Pri-3
Owner: ----
Status: Available (was: Assigned)

Comment 3 by kateso...@chromium.org, Oct 18 2016

Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by manoranj...@chromium.org, Dec 5 2016

Status: WontFix (was: Available)
Not a reproducible CF failure, hence closing this out.
►

Sign in to add a comment