Integer-overflow in FX_atonum |
||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5793286855065600 Fuzzer: libfuzzer_pdf_streamparser_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: FX_atonum CPDF_Number::CPDF_Number CPDF_StreamParser::ReadNextObject Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=416303:416379 Minimized Testcase (0.67 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94M83B323IgwRebZgau3Ea4wITYPCg2U6VRw2P6qTe38Y03gqYux4T_iMRxKhW9GX6aLXmcS_TkxsRt7thMBodvPLKIFwsjhYhVQNRsJmhjGcO3LxmnYMgWF1SJulUmb2a7IrIwIQf86fKl6hCjCW8mZGOrRw?testcase_id=5793286855065600 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 17 2017
I'm not looking at this right now. To Dan.
,
Oct 1 2017
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 24 2017
For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md. The link referenced in the description is no longer valid. (bulk edit)
,
Nov 7 2017
,
Jun 8 2018
,
Jun 8 2018
The fxstring.FX_atonum unit test actually hits this too.
,
Jun 8 2018
,
Jun 8 2018
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/821ae927144152a5122d602753907bd423aa06d0 commit 821ae927144152a5122d602753907bd423aa06d0 Author: Lei Zhang <thestig@chromium.org> Date: Fri Jun 08 23:47:01 2018 Avoid undefined behavior in FX_atonum(). BUG= chromium:664730 Change-Id: Ie46221382ffed7a16366c484c249d2571c7be5c4 Reviewed-on: https://pdfium-review.googlesource.com/34696 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org> [modify] https://crrev.com/821ae927144152a5122d602753907bd423aa06d0/core/fxcrt/fx_string.cpp
,
Jun 9 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a0b61aa0af843b589a9df0bab20f864d95371ee5 commit a0b61aa0af843b589a9df0bab20f864d95371ee5 Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Sat Jun 09 03:26:54 2018 Roll src/third_party/pdfium 7a01ce9..9bc7a21 (15 commits) https://pdfium.googlesource.com/pdfium.git/+log/7a01ce9..9bc7a21 git log 7a01ce9..9bc7a21 --date=short --no-merges --format='%ad %ae %s' 2018-06-09 thestig@chromium.org Consolidate bounding box logic. 2018-06-08 thestig@chromium.org Avoid undefined behavior in FX_atonum(). 2018-06-08 tsepez@chromium.org Remove CJS_Object::InitInstance(). 2018-06-08 thestig@chromium.org Add constants for PDF 1.7 spec, table 3.27. 2018-06-08 hnakashima@chromium.org Move getting the CPDF_CryptoHandler into CPDF_Creator::WriteStream() 2018-06-08 hnakashima@chromium.org Move member initializations to cpdf_creator.h 2018-06-08 hnakashima@chromium.org Instead of CPDF_Creator::m_dwFlags, store its two supported bits. 2018-06-08 hnakashima@chromium.org Remove unused methods in CPDF_Creator, mark others as private. 2018-06-08 hnakashima@chromium.org Remove CPDF_Creator::InitOldObjNumOffsets(). It does nothing. 2018-06-08 rharrison@chromium.org Allow setting current page on Foreground XFA docs 2018-06-08 tsepez@chromium.org Ensure CJS_Return() with error always includes a message. 2018-06-08 tsepez@chromium.org Fix issue with resolveNodes() not found off global proxy object. 2018-06-08 thestig@chromium.org Do not crash if FPDFPage_Get{Media,Crop}Box() gets a NULL out parameter. 2018-06-08 thestig@chromium.org Write some FPDFTransformEmbedderTests. 2018-06-08 thestig@chromium.org Fix the comments in fpdf_transformpage.h. Created with: gclient setdep -r src/third_party/pdfium@9bc7a21 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG= chromium:664730 TBR=dsinclair@chromium.org Change-Id: I4fdcb22364978fb2d4282b2ba0e7a2f37ebebecf Reviewed-on: https://chromium-review.googlesource.com/1094155 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#565834} [modify] https://crrev.com/a0b61aa0af843b589a9df0bab20f864d95371ee5/DEPS
,
Jun 11 2018
ClusterFuzz has detected this issue as fixed in range 565827:565838. Detailed report: https://clusterfuzz.com/testcase?key=5793286855065600 Fuzzer: libFuzzer_pdf_streamparser_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: FX_atonum CPDF_Number::CPDF_Number pdfium::internal::MakeUniqueResult<CPDF_Number>::Scalar pdfium::MakeUnique<CPDF_ Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=416303:416379 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=565827:565838 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5793286855065600 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 11 2018
ClusterFuzz testcase 5350851892477952 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by msrchandra@chromium.org
, Nov 14 2016Components: Infra>Git Internals>Plugins>PDF
Labels: Test-Predator-Wrong-CLs
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)