New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 661856 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Jan 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

parsed_output == double_parsed_output. Parser/Writer mismatch.

Project Member Reported by ClusterFuzz, Nov 3 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5241221036638208

Fuzzer: libfuzzer_base_json_correctness_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  parsed_output == double_parsed_output. Parser/Writer mismatch.
  base::debug::DebugBreak
  _start
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=428776:428837

Minimized Testcase (0.06 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95tVCBPbo2-SDlWk52TA9GRBpI597dQTnhJbTfYiAegiJ-cP8KoJBoi5qgAiL9FrIPqGesOmmFBWXJUuHwFWiuMxAhqxE20d1IgwvLsnfd9iDqQkPiffTTwBvlPeyYdOzLmpffvDSntRftWCiaiv1h8BDxrrw?testcase_id=5241221036638208

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Labels: M-56 Test-Predator-Correct
Owner: aizatsky@chromium.org
Status: Assigned (was: Untriaged)
SUSPECTED CHANGELISTS IN CHROMIUM:
===================================
Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.) 

Author: mostynb@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/901a5e3835718e8872f38af32d65fce7ea3fcbeb
Time: Mon Apr 08 23:26:25 2013
The CL last changed line 221 of file debugger_posix.cc, which is stack frame 2. 

Author: brettw@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/58580359a452cb7c3b9580edc0843c3ab3d158df
Time: Tue Oct 26 04:07:50 2010
The CL last changed line 251 of file debugger_posix.cc, which is stack frame 3. 

Author: rch@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/82d89abc03ea6fd6b9258f0e57be0290b33d7eb1
Time: Fri Feb 28 18:25:34 2014
The CL last changed line 748 of file logging.cc, which is stack frame 4. 

Author: aizatsky
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/022c9c2dd56926d03f2dd21036ebde0da869ee7b
Time: Mon Oct 31 21:42:21 2016
The CL last changed line 51 of file correctness_fuzzer.cc, which is stack frame 5.

From the above CL list suspecting the below based on the recent changes made to file "correctness_fuzzer.cc".
Suspect : https://codereview.chromium.org/2449323004
aizatsky@ : Could you please take a look into this if it is related to your change.

Currently its impacting to head.
Cc: mmoroz@chromium.org durga.behera@chromium.org aizatsky@chromium.org
Owner: danakj@chromium.org
durga.behera@, FYI, aizatsky@ is an author of the fuzzer.

danakj@, since you've reviewed the fuzzer, I hope that you can help to find an owner. Could you please help?
The problem seems to be in handling of \u0000 value in the input string.
 Issue 661919  has been merged into this issue.

Comment 5 by danakj@chromium.org, Nov 10 2016

Cc: danakj@chromium.org
Owner: aizatsky@chromium.org
aizatsky something you can look at?
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 7 by ClusterFuzz, Jan 27 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5368468754137088 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 8 by ClusterFuzz, Mar 8 2017

ClusterFuzz has detected this issue as fixed in range 455091:455226.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5241221036638208

Fuzzer: libfuzzer_base_json_correctness_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  parsed_output == double_parsed_output. Parser/Writer mismatch.
  base::debug::DebugBreak
  _start
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=428776:428837
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=455091:455226

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95tTCqO15VH4f4k-zfSD6_aRELsR0dnlCKEeUyEATE8osUN28Y82r5hBr6VqSrsjyJ8rhuFarU9ZcAo6SRTFT-9C3qOoHXuaiXt6dbUmMezAkiWGZwIU5tavn5JyjZ9RmVA6XLXaCktK1LUtRnlI9pPuSd5wii14IQX3jE6frcXPG9iHIK4e-y0AMSdsKHKRkU1cM-Rw14bWnma8l8sVsMff-BUURsVnIyTAQ_LOletvwjLqf7lGbu9mfyuIIxZQ6XmU6tP2M31L-2Ms5_YZUq9rPJ0zMS9QX-TWfnAJS2VnCwn7boD8f7du0-wDEb8JlEciX03of_z8e4Rht3r8969sLFLisXyx6NrzjVPMmG69dzPhjQ?testcase_id=5241221036638208


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment