New issue
Advanced search Search tips

Issue 655914 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in sfntly::ReadableFontData::ReadShort

Project Member Reported by ClusterFuzz, Oct 14 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5791655317995520

Fuzzer: libfuzzer_sfntly_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  sfntly::ReadableFontData::ReadShort
  sfntly::GlyphTable::Glyph::GlyphType
  sfntly::GlyphTable::Glyph::GetGlyph
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=423338:423416

Minimized Testcase (0.80 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94bK0pEDBtlt7Ryo6SUFWIUaJR_7M6ydlDdwphrvE6_tO0BmP1slf0qfmTYNeP3kFxONPZjWsGRyvQmBqXgk9r6fePZKMVmQ6a8QTQ0pNUlViucVeLOG1fWacTCkjDIkbae1l16ja8NOzJjnv2TSX1-3qI2bQ?testcase_id=5791655317995520

Issue manually filed by: nyerramilli

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: nyerramilli@chromium.org behdad@chromium.org
Components: Tools>Test>FindIt>WrongResult
Labels: findit-wrong M-56
Owner: arthurhsu@chromium.org
Status: Assigned (was: Untriaged)
Findit Results:
----------------

Suspected CLs	The result is a list of CLs that change the crashed files.

Author: Lei Zhang
Project: chromium-sfntly
Changelist: https://chromium.googlesource.com/external/github.com/googlei18n/sfntly.git/+/1ef790afdd7818c1a3c76b18daacff14fdb983aa
Time: Thu Sep 08 04:32:59 2016
File readable_font_data.cc is changed in this cl (and is part of stack frame #0, "sfntly::ReadableFontData::ReadShort")
Minimum distance from crash line to modified line: 89. (file: readable_font_data.cc, crashed on: 111, modified: 22).

Suspected Project: chromium-sfntly

assigning to arthurhsu@/ behdad@ from https://cs.chromium.org/chromium/src/third_party/sfntly/OWNERS 
Could you please check and help..
Owner: thestig@chromium.org
Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Components: Internals>Skia>PDF
Status: Started (was: Assigned)
bug_655914_readshort.patch
590 bytes Download
Project Member

Comment 6 by bugdroid1@chromium.org, Oct 25 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0c0e20baae5cfc32465e84d0e56a82ab874788e9

commit 0c0e20baae5cfc32465e84d0e56a82ab874788e9
Author: thestig <thestig@chromium.org>
Date: Tue Oct 25 01:05:52 2016

Roll DEPS for sfntly 1ef790a..e33ba7a

https://chromium.googlesource.com/external/github.com/googlei18n/sfntly/+log/1ef790a..e33ba7a

e33ba7a Merge pull request #60 from leizleiz/leizleiz-crbug
1bc53e1 Fix undefined shifts in ReadableFontData::ReadShort.
d651349 Check for negative size in NameTable::NameAsBytes.
8475d2f Avoid NULL derefs inside FontHeaderTable::Builder.
1fba3b3 Fix undefined shifts in ReadableFontData::ReadLong.
083b02b Fix NULL pointer derefs in sfntly::Font::Builder.
6d1efaa Fix out of bound access in subtly sample program.
cafc4c8 Merge pull request #59 from HalCanary/pronounciation
7d5169e README: pronounciation guide

BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 
TBR=behdad@chromium.org

Review-Url: https://codereview.chromium.org/2444123002
Cr-Commit-Position: refs/heads/master@{#427203}

[modify] https://crrev.com/0c0e20baae5cfc32465e84d0e56a82ab874788e9/DEPS

Status: Fixed (was: Started)
Project Member

Comment 8 by bugdroid1@chromium.org, Oct 25 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/00b023067c9a330d2041c81871b2804591522416

commit 00b023067c9a330d2041c81871b2804591522416
Author: thestig <thestig@chromium.org>
Date: Tue Oct 25 07:26:30 2016

Revert of Roll DEPS for sfntly 1ef790a..e33ba7a (patchset #1 id:1 of https://codereview.chromium.org/2444123002/ )

Reason for revert:
Broke some font rendering.

e.g.  https://crbug.com/659006 

Original issue's description:
> Roll DEPS for sfntly 1ef790a..e33ba7a
>
> https://chromium.googlesource.com/external/github.com/googlei18n/sfntly/+log/1ef790a..e33ba7a
>
> e33ba7a Merge pull request #60 from leizleiz/leizleiz-crbug
> 1bc53e1 Fix undefined shifts in ReadableFontData::ReadShort.
> d651349 Check for negative size in NameTable::NameAsBytes.
> 8475d2f Avoid NULL derefs inside FontHeaderTable::Builder.
> 1fba3b3 Fix undefined shifts in ReadableFontData::ReadLong.
> 083b02b Fix NULL pointer derefs in sfntly::Font::Builder.
> 6d1efaa Fix out of bound access in subtly sample program.
> cafc4c8 Merge pull request #59 from HalCanary/pronounciation
> 7d5169e README: pronounciation guide
>
> BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 
> TBR=behdad@chromium.org
>
> Committed: https://crrev.com/0c0e20baae5cfc32465e84d0e56a82ab874788e9
> Cr-Commit-Position: refs/heads/master@{#427203}

TBR=behdad@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 

Review-Url: https://codereview.chromium.org/2445303002
Cr-Commit-Position: refs/heads/master@{#427296}

[modify] https://crrev.com/00b023067c9a330d2041c81871b2804591522416/DEPS

Status: Started (was: Fixed)
Project Member

Comment 10 by ClusterFuzz, Oct 25 2016

ClusterFuzz has detected this issue as fixed in range 427165:427235.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5791655317995520

Fuzzer: libfuzzer_sfntly_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  sfntly::ReadableFontData::ReadShort
  sfntly::GlyphTable::Glyph::GlyphType
  sfntly::GlyphTable::Glyph::GetGlyph
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=423338:423416
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=427165:427235

Minimized Testcase (0.80 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94bK0pEDBtlt7Ryo6SUFWIUaJR_7M6ydlDdwphrvE6_tO0BmP1slf0qfmTYNeP3kFxONPZjWsGRyvQmBqXgk9r6fePZKMVmQ6a8QTQ0pNUlViucVeLOG1fWacTCkjDIkbae1l16ja8NOzJjnv2TSX1-3qI2bQ?testcase_id=5791655317995520

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Oct 25 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Status: Started (was: Verified)
Project Member

Comment 13 by bugdroid1@chromium.org, Oct 26 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7ac63a352e7556a68224284af29db855b400a679

commit 7ac63a352e7556a68224284af29db855b400a679
Author: thestig <thestig@chromium.org>
Date: Wed Oct 26 21:42:15 2016

Roll DEPS for sfntly 1ef790a..6e98497

6e98497 Merge pull request #61 from leizleiz/leizleiz-tablefix
ebaa364 Fix breakage from commit 083b02b1.
e33ba7a Merge pull request #60 from leizleiz/leizleiz-crbug
1bc53e1 Fix undefined shifts in ReadableFontData::ReadShort.
d651349 Check for negative size in NameTable::NameAsBytes.
8475d2f Avoid NULL derefs inside FontHeaderTable::Builder.
1fba3b3 Fix undefined shifts in ReadableFontData::ReadLong.
083b02b Fix NULL pointer derefs in sfntly::Font::Builder.
6d1efaa Fix out of bound access in subtly sample program.
cafc4c8 Merge pull request #59 from HalCanary/pronounciation
7d5169e README: pronounciation guide

BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 , 659006 
TBR=behdad@chromium.org

Review-Url: https://codereview.chromium.org/2452873003
Cr-Commit-Position: refs/heads/master@{#427819}

[modify] https://crrev.com/7ac63a352e7556a68224284af29db855b400a679/DEPS

Status: Fixed (was: Started)
Project Member

Comment 15 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment