New issue
Advanced search Search tips

Issue 664730 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in FX_atonum

Project Member Reported by ClusterFuzz, Nov 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5793286855065600

Fuzzer: libfuzzer_pdf_streamparser_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  FX_atonum
  CPDF_Number::CPDF_Number
  CPDF_StreamParser::ReadNextObject
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=416303:416379

Minimized Testcase (0.67 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94M83B323IgwRebZgau3Ea4wITYPCg2U6VRw2P6qTe38Y03gqYux4T_iMRxKhW9GX6aLXmcS_TkxsRt7thMBodvPLKIFwsjhYhVQNRsJmhjGcO3LxmnYMgWF1SJulUmb2a7IrIwIQf86fKl6hCjCW8mZGOrRw?testcase_id=5793286855065600

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: thestig@chromium.org dsinclair@chromium.org msrchandra@chromium.org
Components: Infra>Git Internals>Plugins>PDF
Labels: Test-Predator-Wrong-CLs
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any suspected CLs, below are the results,
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: dsinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/6f1025492801aaa93fca2c0ed7c40a3389ad8cd1
Time: Wed Jul 27 21:44:23 2016 -0700
The CL last changed line 70 of file fx_basic_util.cpp, which is stack frame 0.

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/29d447ae35101675a2a2d8bc1dcfca65de7f3929
Time: Thu Jun 23 19:57:45 2016 -0700
The CL last changed line 17 of file cpdf_number.cpp, which is stack frame 1.

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 332 of file cpdf_streamparser.cpp, which is stack frame 2.

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/236e47afa53d3f065024cc6490a49b431c108078
Time: Mon Aug 22 13:11:21 2016 -0700
The CL last changed line 12 of file pdf_streamparser_fuzzer.cc, which is stack frame 3.

Suspected Project: chromium-pdfium

From the regressed CL assigning to the possible suspect,
https://chromium.googlesource.com/chromium/src/+log/0ab7c947dc8b4b4896160148e5af88b6d9577b1f..19acddfd338e498463e7f8da085d3251780ea64e?pretty=fuller

Suspect Commit# 10f51929139137a20fc5b1cd21b2ae6e1d3fab1b
Suspect Review URL# https://codereview.chromium.org/2306113002

@tsepez -- Could you please look into the issue, kindly re-assign if not related to your changes.
Thank You.
Project Member

Comment 2 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 3 by tsepez@chromium.org, Jul 17 2017

Owner: dsinclair@chromium.org
I'm not looking at this right now. To Dan.
Project Member

Comment 4 by ClusterFuzz, Oct 1 2017

Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 5 by mmoroz@chromium.org, Oct 24 2017

For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.

(bulk edit)
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Cc: pnangunoori@chromium.org
 Issue 850474  has been merged into this issue.
Owner: thestig@chromium.org
The fxstring.FX_atonum unit test actually hits this too.
Cc: -thestig@chromium.org -msrchandra@chromium.org
Components: -Infra>Git
Status: Fixed (was: Assigned)
Project Member

Comment 10 by bugdroid1@chromium.org, Jun 8 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/821ae927144152a5122d602753907bd423aa06d0

commit 821ae927144152a5122d602753907bd423aa06d0
Author: Lei Zhang <thestig@chromium.org>
Date: Fri Jun 08 23:47:01 2018

Avoid undefined behavior in FX_atonum().

BUG= chromium:664730 

Change-Id: Ie46221382ffed7a16366c484c249d2571c7be5c4
Reviewed-on: https://pdfium-review.googlesource.com/34696
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

[modify] https://crrev.com/821ae927144152a5122d602753907bd423aa06d0/core/fxcrt/fx_string.cpp

Project Member

Comment 11 by bugdroid1@chromium.org, Jun 9 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a0b61aa0af843b589a9df0bab20f864d95371ee5

commit a0b61aa0af843b589a9df0bab20f864d95371ee5
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Sat Jun 09 03:26:54 2018

Roll src/third_party/pdfium 7a01ce9..9bc7a21 (15 commits)

https://pdfium.googlesource.com/pdfium.git/+log/7a01ce9..9bc7a21


git log 7a01ce9..9bc7a21 --date=short --no-merges --format='%ad %ae %s'
2018-06-09 thestig@chromium.org Consolidate bounding box logic.
2018-06-08 thestig@chromium.org Avoid undefined behavior in FX_atonum().
2018-06-08 tsepez@chromium.org Remove CJS_Object::InitInstance().
2018-06-08 thestig@chromium.org Add constants for PDF 1.7 spec, table 3.27.
2018-06-08 hnakashima@chromium.org Move getting the CPDF_CryptoHandler into CPDF_Creator::WriteStream()
2018-06-08 hnakashima@chromium.org Move member initializations to cpdf_creator.h
2018-06-08 hnakashima@chromium.org Instead of CPDF_Creator::m_dwFlags, store its two supported bits.
2018-06-08 hnakashima@chromium.org Remove unused methods in CPDF_Creator, mark others as private.
2018-06-08 hnakashima@chromium.org Remove CPDF_Creator::InitOldObjNumOffsets(). It does nothing.
2018-06-08 rharrison@chromium.org Allow setting current page on Foreground XFA docs
2018-06-08 tsepez@chromium.org Ensure CJS_Return() with error always includes a message.
2018-06-08 tsepez@chromium.org Fix issue with resolveNodes() not found off global proxy object.
2018-06-08 thestig@chromium.org Do not crash if FPDFPage_Get{Media,Crop}Box() gets a NULL out parameter.
2018-06-08 thestig@chromium.org Write some FPDFTransformEmbedderTests.
2018-06-08 thestig@chromium.org Fix the comments in fpdf_transformpage.h.


Created with:
  gclient setdep -r src/third_party/pdfium@9bc7a21

The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:664730 
TBR=dsinclair@chromium.org

Change-Id: I4fdcb22364978fb2d4282b2ba0e7a2f37ebebecf
Reviewed-on: https://chromium-review.googlesource.com/1094155
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#565834}
[modify] https://crrev.com/a0b61aa0af843b589a9df0bab20f864d95371ee5/DEPS

Project Member

Comment 12 by ClusterFuzz, Jun 11 2018

ClusterFuzz has detected this issue as fixed in range 565827:565838.

Detailed report: https://clusterfuzz.com/testcase?key=5793286855065600

Fuzzer: libFuzzer_pdf_streamparser_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  FX_atonum
  CPDF_Number::CPDF_Number
  pdfium::internal::MakeUniqueResult<CPDF_Number>::Scalar pdfium::MakeUnique<CPDF_
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=416303:416379
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=565827:565838

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5793286855065600

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by ClusterFuzz, Jun 11 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5350851892477952 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment