New issue
Advanced search Search tips

Issue 656161 link

Starred by 2 users
Status: Fixed
Owner:
tsepez@chromium.org
Closed: Oct 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in CPDF_Dictionary::~CPDF_Dictionary

Project Member Reported by ClusterFuzz, Oct 14 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5410328659886080

Fuzzer: ifratric_acrojs
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Heap-use-after-free READ 4
Crash Address: 0x0e9bcc84
Crash State:
  CPDF_Dictionary::~CPDF_Dictionary
  CPDF_Dictionary::`scalar deleting destructor'
  CPDF_Object::Release
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=425286:425310

Minimized Testcase (1032.13 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97UsIPNsewMlQZacJpAUoBawXaDGnceiqp_njR_BCOa3tXtSyCy7LsRaoPBDDUHw-Hg7QFwiLgh8XeIk6IeiJDb2gGy7I5eYau9YRt1ql2e0-sQciuKfaRZiret9-Nfqmrf2O92_Ml6WYro3OUe7jnJAf33IYw10MV6hrxlfFV_stqKkug?testcase_id=5410328659886080

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mmoroz@chromium.org, Oct 15 2016

Components: Internals>Plugins>PDF
Owner: tsepez@chromium.org
Status: Available (was: Untriaged)
Looks similar to  bug 656132 .

The result is a list of CLs that change the crashed files. 

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/1d023881cd53485303c0fcc0b5878e700dc470fd
Time: Thu Oct 13 16:36:20 2016 -0700
Lines 30-34 of file cpdf_dictionary.cpp which potentially caused crash are changed in this cl (frame #0, "CPDF_Dictionary::~CPDF_Dictionary"; frame #1, "CPDF_Dictionary::`scalar deleting destructor'").
Minimum distance from crash line to modified line: 0. (file: cpdf_dictionary.cpp, crashed on: 30, modified: 30).
Project Member

Comment 2 by sheriffbot@chromium.org, Oct 15 2016

Labels: M-55
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 15 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 15 2016

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Oct 15 2016

Status: Assigned (was: Available)
Project Member

Comment 6 by sheriffbot@chromium.org, Oct 16 2016

Labels: -Security_Impact-Head Security_Impact-Beta

Comment 7 by tsepez@chromium.org, Oct 17 2016

Status: Fixed (was: Assigned)
Reverted in d5bd8a1.
Project Member

Comment 8 by sheriffbot@chromium.org, Oct 18 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 21 2016

Labels: Merge-Request-55

Comment 10 by dimu@google.com, Oct 24 2016

Labels: -Merge-Request-55 Merge-Review-55 Hotlist-Merge-Review
[Automated comment] There appears to be on-going work (i.e. bugroid changes), needs manual review.

Comment 11 by dimu@google.com, Oct 24 2016

Labels: -Hotlist-Merge-review -Merge-Review-55 Merge-Request-55

Comment 12 by dimu@chromium.org, Oct 24 2016

Labels: -Merge-Request-55 Hotlist-Merge-review Merge-Review-55
we still need to manual review this bug, because the revert commit wasn't linked directly to this bug.

Comment 13 by awhalley@chromium.org, Oct 25 2016

Labels: -ReleaseBlock-Beta -M-55 -Hotlist-Merge-review -Merge-Review-55 M-56
Confirmed that the commit that d5bd8a1 reverted (https://pdfium.googlesource.com/pdfium.git/+/1d023881) isn't in M55, so no need to merge this.
Project Member

Comment 14 by sheriffbot@chromium.org, Jan 24 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment