Issue metadata
Sign in to add a comment
|
Heap-use-after-free in PDF_CreatorAppendObject |
||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5066431299584000 Fuzzer: ifratric_acrojs Job Type: windows_asan_chrome_no_sandbox Platform Id: windows Crash Type: Heap-use-after-free READ 4 Crash Address: 0x04b4c634 Crash State: PDF_CreatorAppendObject CPDF_Creator::WriteDirectObj CPDF_Creator::WriteIndirectObj Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=425143:425240 Minimized Testcase (898.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96uC-OTw5ev5-DddfT_lJGW9JEYGPlLXUATxeI3Nm9jF6bqeTmWGBiH_2xuklpBej23Id-z_63gctzob_D80x81zbuoo0J780msOBXy95PIYUXycn3Fqt6UlYiPnxlFTh7FENrpqMOc62LBne0w5RSeZf8yy1f6llgLtHFv7GPA51qA4iI?testcase_id=5066431299584000 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Oct 14 2016
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 14 2016
,
Oct 14 2016
Tom, your CL is the culprit: The result is a list of CLs that change the crashed files. Author: tsepez Project: chromium-pdfium Changelist: https://pdfium.googlesource.com/pdfium.git/+/1d023881cd53485303c0fcc0b5878e700dc470fd Time: Thu Oct 13 16:36:20 2016 -0700 Lines 1195 of file fpdf_edit_create.cpp which potentially caused crash are changed in this cl (frame #1, "CPDF_Creator::WriteDirectObj"). Minimum distance from crash line to modified line: 0. (file: fpdf_edit_create.cpp, crashed on: 1195, modified: 1195).
,
Oct 15 2016
,
Oct 16 2016
,
Oct 17 2016
Reverted in d5bd8a1.
,
Oct 18 2016
,
Oct 25 2016
Confirmed that the commit that d5bd8a1 reverted (https://pdfium.googlesource.com/pdfium.git/+/1d023881) isn't in M55, so no need to merge this.
,
Jan 24 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by sheriffbot@chromium.org
, Oct 14 2016