New issue
Advanced search Search tips

Issue 656132 link

Starred by 2 users
Status: Fixed
Owner:
tsepez@chromium.org
Closed: Oct 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in CPDF_Dictionary::~CPDF_Dictionary

Project Member Reported by ClusterFuzz, Oct 14 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5719710287265792

Fuzzer: ifratric_pdf_generic
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: Heap-use-after-free READ 4
Crash Address: 0x35b79a9f
Crash State:
  CPDF_Dictionary::~CPDF_Dictionary
  CPDF_Object::Release
  CPDF_Annot::~CPDF_Annot
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=425278:425286

Minimized Testcase (1784.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96Q7fGFMRMnwelTxMBIOT9UiuKnX0priQM71X-KHOnqKfnIdM74yD7AVcJKPkxI1vdV-JakUin6kiIOsTmNUjDHau6rM9Hf1Uo2pkRjsqc6UPELS-zCU0W6aU3GeOND8dlMLWOnYXVJSJHmHMIdFGn3MIskeUcvV1y3tggfnmJPck97NkQ?testcase_id=5719710287265792

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mmoroz@chromium.org, Oct 15 2016

Owner: tsepez@chromium.org
Status: Available (was: Untriaged)
The result is a list of CLs that change the crashed files. 

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/1d023881cd53485303c0fcc0b5878e700dc470fd
Time: Thu Oct 13 16:36:20 2016 -0700
Lines 33 of file cpdf_dictionary.cpp which potentially caused crash are changed in this cl (frame #0, "chrome_child!CPDF_Dictionary::~CPDF_Dictionary+0x24").
Minimum distance from crash line to modified line: 0. (file: cpdf_dictionary.cpp, crashed on: 32, modified: 32).

Comment 2 by mmoroz@chromium.org, Oct 15 2016

Components: Internals>Plugins>PDF
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 15 2016

Labels: M-55
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 15 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Oct 15 2016

Labels: Pri-1
Project Member

Comment 6 by sheriffbot@chromium.org, Oct 15 2016

Status: Assigned (was: Available)
Project Member

Comment 7 by sheriffbot@chromium.org, Oct 16 2016

Labels: -Security_Impact-Head Security_Impact-Beta

Comment 8 by tsepez@chromium.org, Oct 17 2016 

Reverted in d5bd8a1.

Comment 9 by tsepez@chromium.org, Oct 17 2016

Status: Fixed (was: Assigned)
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 18 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by sheriffbot@chromium.org, Oct 21 2016

Labels: Merge-Request-55

Comment 12 by dimu@google.com, Oct 24 2016

Labels: -Merge-Request-55 Merge-Review-55 Hotlist-Merge-Review
[Automated comment] There appears to be on-going work (i.e. bugroid changes), needs manual review.

Comment 13 by dimu@google.com, Oct 24 2016

Labels: -Hotlist-Merge-review -Merge-Review-55 Merge-Request-55

Comment 14 by dimu@chromium.org, Oct 24 2016

Labels: -Merge-Request-55 Hotlist-Merge-review Merge-Review-55
we still need to manual review this bug, because the revert commit wasn't linked directly to this bug.

Comment 15 by awhalley@chromium.org, Oct 25 2016

Labels: -ReleaseBlock-Beta -M-55 -Merge-Review-55 M-56
Confirmed that the commit that d5bd8a1 reverted (https://pdfium.googlesource.com/pdfium.git/+/1d023881) isn't in M55, so no need to merge this.

Comment 16 by awhalley@chromium.org, Oct 27 2016

Labels: -Hotlist-Merge-Review
Project Member

Comment 17 by sheriffbot@chromium.org, Jan 24 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment