New issue
Advanced search Search tips

Issue 660756 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in CPDF_PageContentGenerator::ProcessImage

Project Member Reported by ClusterFuzz, Oct 31 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5825910571008000

Fuzzer: ifratric_pdf_generic
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000007
Crash State:
  CPDF_PageContentGenerator::ProcessImage
  CPDF_PageContentGenerator::GenerateContent
  FPDFPage_GenerateContent
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=428625:428627

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv965MNJC4APxI7cOXt9EX0TSFiX-5wQp1s7WU0Wu-Y51cfMB-MY81HRDJeXV0KYG4kMzPIwcZLNxsp9r5Ku68Vi8Ef2orDWUUSVWFLykk-N5BpGjtE7pCveBrG9tD8qlkvXT-gZeZG8t4tu91XgV0OZyHm4g4cdiADP0DekQgtJFOwi_hsQ?testcase_id=5825910571008000


Additional requirements: Requires Gestures

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org
Components: Internals>Skia>PDF
Labels: findit-wrong M-56
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
providing Findit results for internal purpose:


ClusterFuzz
Redo
(switch to v2)
Timestamp	2016-10-30 16:06:25
Fuzzer	ifratric_pdf_generic
Job Type	windows_syzyasan_chrome
Platform	windows
Crash type	UNKNOWN
Crash address	0x00000007
Crash state	CPDF_PageContentGenerator::ProcessImage
CPDF_PageContentGenerator::GenerateContent
FPDFPage_GenerateContent
Bug Information	 Bug 660756 
Reproducible	Yes
Security	No
Crash revision	Chromium: 428627
Angle: 705a9194438dd19a2f456235dda5a175cfce94d5
FFmpeg: 3c7a09882102bfd6fecdb9d7296f43a8501db95e
ICU: b0bd3ee50bc2e768d7a17cbc60d87f517f024dbe
NaCl: bba323f75e3d20d2d496a1986f91fc81b624affa
Pdfium: 747dcf775c5cb661e96a639f73322cc489d8590f
Skia: 09b007f0ef8532e65933cdeb30334b745c1251bd
V8: 4441429961e17f36fcd158a11ae0b9fb804b3811
WebRTC: 215a597efed43e3e5117f6c3b63dbbcd955dedd9
Regressed	Chromium: 428625:428627
Angle: 705a9194438dd19a2f456235dda5a175cfce94d5
FFmpeg: 3c7a09882102bfd6fecdb9d7296f43a8501db95e
ICU: b0bd3ee50bc2e768d7a17cbc60d87f517f024dbe
NaCl: bba323f75e3d20d2d496a1986f91fc81b624affa
Pdfium: 747dcf775c5cb661e96a639f73322cc489d8590f
Skia: 09b007f0ef8532e65933cdeb30334b745c1251bd
V8: 4441429961e17f36fcd158a11ae0b9fb804b3811
WebRTC: 215a597efed43e3e5117f6c3b63dbbcd955dedd9
Fixed	No
Impacts	Head
Interaction Gestures?	[u'key,{BACKSPACE}{TAB}^=^-{TAB}^={TAB}{TAB}^=', u'key,^-^-^={ENTER}{TAB}^-^-{q}{i}', u'key,^-^=', u'mouse,middle;(205,928);True', u'key,{PGDN}{+}{)}{W}^={u}^-{TAB}{TAB}^-', u'key,^-{(}{1}{t}{TAB}', u'mouse,right;(9,451);True', u'key,^-{TAB}', u'key,{r}^=^={TAB}{J}{F6}{e}^-', u'mousedrag,right;(887,115);(727,557)', u'mousedrag,left;(527,960);(538,442)', u'mousedrag,right;(877,630);(406,782)', u'mousemove,right;(324,837)', u'mouse,middle;(925,137);True', u'mouse,right;(835,276);False', u'key,^=^-^-^=^={?}{INSERT}{W}{END}{=}', u'key,{a}^={.}{F8}^={TAB}{TAB}^-{TAB}', u'key,{TAB}^={TAB}{BACKSPACE}', u'key,{P}{0}^={PGUP}^={6}^-{m}{TAB}', u'mousedrag,middle;(797,710);(678,5)', u'key,^=', u'key,{)}{TAB}{TAB}{TAB}{TAB}^-{w}', u"key,{)}^={*}^=^-^={(}^-{y}{'}", u'key,^-{TAB}{:}^-^=^={UP}{TAB}{ENTER}', u'key,{TAB}{ENTER}{/}{TAB}^={i}{S}', u'mousemove,right;(866,255)', u'Trigger:23']
Minimized testcase	NA
Unminimized testcase (4870.52 Kb)	Download      (Note: Do not include testcase files in public bug repository)
Local reproduction config	Download       Instructions for local reproduction
Build	Download
Minidump	Download
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/b5e8f14e3eefc5da995b332788d3203cee204883
Time: Fri Mar 25 15:18:35 2016 -0700
The CL last changed line 42 of file cpdf_object.h, which is stack frame 0.

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/b5e8f14e3eefc5da995b332788d3203cee204883
Time: Fri Mar 25 15:18:35 2016 -0700
The CL last changed line 100 of file cpdf_pagecontentgenerator.cpp, which is stack frame 1.

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/74b8c6ed314cfcc83aea13f028b4231db26e6ff8
Time: Wed Oct 12 09:38:41 2016 -0700
The CL last changed line 47 of file cpdf_pagecontentgenerator.cpp, which is stack frame 2.

Author: Nico Weber
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/9d8ec5a6e37e8d1d4d4edca9040de234e2d4728f
Time: Tue Aug 04 13:00:21 2015 -0700
The CL last changed line 259 of file fpdfeditpage.cpp, which is stack frame 3.

Author: vitalybuka@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/f2ad0afe62855ff31493cc787b377b326bc99df2
Time: Wed Aug 20 06:51:30 2014
The CL last changed line 1294 of file pdfium_engine.cc, which is stack frame 4.

Author: vitalybuka@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/f2ad0afe62855ff31493cc787b377b326bc99df2
Time: Wed Aug 20 06:51:30 2014
The CL last changed line 1354 of file pdfium_engine.cc, which is stack frame 5.

Author: jam@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1b1e9effe9fa3b66dd1bcfff4b78455460f66c61
Time: Tue May 20 01:56:40 2014
The CL last changed line 1238 of file pdfium_engine.cc, which is stack frame 6.

Suspected Project: chromium-pdfium

requesting pdfium team/tsepez@ to check the issue and update.

Comment 2 by tsepez@chromium.org, Oct 31 2016

Clicked redo on regression range; nothing in that range makes any sense.

Comment 3 by tsepez@chromium.org, Oct 31 2016

Cc: tsepez@chromium.org
Owner: msten...@opera.com
Hmm.  CF is adamant about the range. mstensho is it possible that your CL somehow changed the flow such that a call is eventually made to the plugin with an invalid object? 

Comment 5 by tsepez@chromium.org, Oct 31 2016

Cc: thestig@chromium.org
@thestig - would you have a windows box to poke at the minidump?  Thanks.
I do have a Windows box. My windbg skills are pretty rusty though.

I don't trust the regression range.
Owner: tsepez@chromium.org
yeah, another possibility is that without the fix in the range, trying to print the document just timed out ... given that the change claims to make things much faster.  
Project Member

Comment 8 by ClusterFuzz, Nov 1 2016

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5103569884938240
Components: -Internals>Skia>PDF Internals>Plugins>PDF
Project Member

Comment 10 by ClusterFuzz, Nov 1 2016

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6355713644560384
Ok.

The possibility of a null-ptr segv was introduced in (M56) at https://codereview.chromium.org/2420743002/ and should have hit every
time PDFiumEngine::PrintPagesAsRasterPDF() was called.

The path may not have been taken given the logic in https://cs.chromium.org/chromium/src/pdf/pdfium/pdfium_engine.cc?rcl=1478866657&l=1394

I expect that some logic changed subsequently to unmask the underlying problem.
Project Member

Comment 12 by bugdroid1@chromium.org, Nov 11 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2ec3b4f35d623d53e26923d3d19d0cb29f20cd26

commit 2ec3b4f35d623d53e26923d3d19d0cb29f20cd26
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Fri Nov 11 21:12:01 2016

Roll src/third_party/pdfium/ a0d323103..dc40c40f4 (2 commits).

https://pdfium.googlesource.com/pdfium.git/+log/a0d323103781..dc40c40f40ed

$ git log a0d323103..dc40c40f4 --date=short --no-merges --format='%ad %ae %s'
2016-11-11 thestig Relax colorspace checks in CPDF_DIBSource::CreateDecoder().
2016-11-11 tsepez Fix sevg above CPDF_PageContentGenerator::ProcessImage()

BUG= 650230 , 660756 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2495043002
Cr-Commit-Position: refs/heads/master@{#431644}

[modify] https://crrev.com/2ec3b4f35d623d53e26923d3d19d0cb29f20cd26/DEPS

Status: Fixed (was: Assigned)
Project Member

Comment 14 by bugdroid1@chromium.org, Nov 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/536cf7b135468bc3848faadae2b35089d22d46aa

commit 536cf7b135468bc3848faadae2b35089d22d46aa
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Tue Nov 15 03:49:39 2016

Roll src/third_party/pdfium/ e3c731526..343980241 (6 commits).

https://pdfium.googlesource.com/pdfium.git/+log/e3c731526c04..3439802410dc

$ git log e3c731526..343980241 --date=short --no-merges --format='%ad %ae %s'
2016-11-14 dsinclair Cleanup fwl_* classes and cfx_* classes in fwl.
2016-11-14 tsepez Make CPDF_PageContentGenerator methods take object numbers
2016-11-14 thestig Fix nits in CPDF_PageOrganizer.
2016-11-14 npm Fix some nits in pdfium_test
2016-11-14 thestig Invalidate a slightly larger rect when updating popup annotations.
2016-11-14 npm Properly release caches in CPDF_DocRenderData

BUG= 660756 , 662804 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2499223002
Cr-Commit-Position: refs/heads/master@{#432083}

[modify] https://crrev.com/536cf7b135468bc3848faadae2b35089d22d46aa/DEPS

Project Member

Comment 15 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment