New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 657441 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 670928
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Direct-leak in OJPEGReadHeaderInfoSecTablesAcTable

Project Member Reported by ClusterFuzz, Oct 19 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4835653714182144

Fuzzer: libfuzzer_radamsa_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  OJPEGReadHeaderInfoSecTablesAcTable
  OJPEGReadHeaderInfoSec
  OJPEGReadHeaderInfo
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=422880:422991

Minimized Testcase (0.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv955kgAbjhlWgtxK_qwJqLmn5_RlA_J1S8XUOTgxbxdTiEpt4esowvHjiDaKCz6LRGpypoq1XLUgFHwFqbCKXhcfkbMTIPVbY98S80luqlXV9fI-6G8hYvSbSd-_cDHr_HQZc8unokGFpyHQWSREjoaU0UEAXQ?testcase_id=4835653714182144

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: thestig@chromium.org msrchandra@chromium.org
Components: Internals>Plugins>PDF
Labels: findit-wrong
Providing the findit results,
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: Lei Zhang
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/9c2c87d1c7443b4eeb3e439af7dc34f695bbd2c8
Time: Thu Jan 07 15:52:44 2016 -0800
The CL last changed line 1905 of file tif_ojpeg.c, which is stack frame 1.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 1382 of file tif_ojpeg.c, which is stack frame 2.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 1095 of file tif_ojpeg.c, which is stack frame 3.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 683 of file tif_ojpeg.c, which is stack frame 4.

Author: Lei Zhang
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/9c2c87d1c7443b4eeb3e439af7dc34f695bbd2c8
Time: Thu Jan 07 15:52:44 2016 -0800
The CL last changed line 355 of file tif_read.c, which is stack frame 5.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 934 of file tif_getimage.c, which is stack frame 6.

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/fdc00a7042d912aafaabddae4d9c84199921ef23
Time: Tue Oct 28 23:03:33 2014 -0700
The CL last changed line 519 of file tif_getimage.c, which is stack frame 7.

Suspected Project: chromium-pdfium

Unable to find the exact suspect from findit, CL and Code Search.
Could some one please look into the issue.
Thank You.
Labels: -Pri-2 Pri-3
Status: Available (was: Untriaged)
This one should be easy. We need to free |rb| in the if(p!=q) block.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by ClusterFuzz, Jan 12 2017

ClusterFuzz has detected this issue as fixed in range 442985:443138.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4835653714182144

Fuzzer: libfuzzer_radamsa_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  OJPEGReadHeaderInfoSecTablesAcTable
  OJPEGReadHeaderInfoSec
  OJPEGReadHeaderInfo
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=422880:422991
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=442985:443138

Minimized Testcase (0.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv955kgAbjhlWgtxK_qwJqLmn5_RlA_J1S8XUOTgxbxdTiEpt4esowvHjiDaKCz6LRGpypoq1XLUgFHwFqbCKXhcfkbMTIPVbY98S80luqlXV9fI-6G8hYvSbSd-_cDHr_HQZc8unokGFpyHQWSREjoaU0UEAXQ?testcase_id=4835653714182144

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jan 12 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 4835653714182144 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 7 by npm@chromium.org, Jan 12 2017

Owner: npm@chromium.org
Status: Assigned (was: Verified)
Although clusterfuzz sample has been fixed (dup of 670928), still need to see if the suggestion of thestig@ in #3 should be implemented.

Comment 8 by npm@chromium.org, Jan 12 2017

Mergedinto: 670928
Status: Duplicate (was: Assigned)
Never mind, now we got  bug 680520 , which is exactly this.

Sign in to add a comment