New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 667253 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 667260
Owner:
Last visit > 30 days ago
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in unibrow::Utf8::CalculateValue

Project Member Reported by ClusterFuzz, Nov 21 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4991285900607488

Fuzzer: libfuzzer_v8_wasm_imports_section_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  unibrow::Utf8::CalculateValue
  unibrow::Utf8::ValueOf
  unibrow::Utf8::Validate
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=433457:433461

Minimized Testcase (0.10 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv948aYfc3qRVKC1Tj6o0h8V4AKzh7qGimjEHFOXW_-FYlGdjp2ZCC2sC4DcHmFG4D1bjIJmktEihzQxEpnhh-frZy94O8PXHFsVErIsAIvfodDXW_0AiEvW85oXcN6y4OneA4dn9yoQsUgbt6Prq3Mz0n1m1Yg?testcase_id=4991285900607488
�aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaxCCCCCCCCCaaaaaaaaa�


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Nov 21 2016

Labels: M-56
Project Member

Comment 2 by sheriffbot@chromium.org, Nov 21 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 21 2016

Labels: Pri-1
Components: Blink>JavaScript
Owner: jochen@chromium.org
Status: Assigned (was: Untriaged)
Can you take a look at this or route it someone who can? Thanks.

Comment 5 by jochen@chromium.org, Nov 21 2016

Cc: ahaas@chromium.org
Owner: rossberg@chromium.org

Comment 6 by mea...@chromium.org, Nov 22 2016

Cc: jbroman@chromium.org
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: M-56
Probably the same issue, yes. I'll have ClusterFuzz verify that it's fixed, now that the fix has landed.
Project Member

Comment 10 by ClusterFuzz, Nov 22 2016

ClusterFuzz has detected this issue as fixed in range 433838:433865.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4991285900607488

Fuzzer: libfuzzer_v8_wasm_imports_section_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  unibrow::Utf8::CalculateValue
  unibrow::Utf8::ValueOf
  unibrow::Utf8::Validate
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=433457:433461
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=433838:433865

Minimized Testcase (0.10 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv948aYfc3qRVKC1Tj6o0h8V4AKzh7qGimjEHFOXW_-FYlGdjp2ZCC2sC4DcHmFG4D1bjIJmktEihzQxEpnhh-frZy94O8PXHFsVErIsAIvfodDXW_0AiEvW85oXcN6y4OneA4dn9yoQsUgbt6Prq3Mz0n1m1Yg?testcase_id=4991285900607488
�aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaxCCCCCCCCCaaaaaaaaa�


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Status: Fixed (was: Assigned)
Yup, same issue, fixed.
Mergedinto: 667260
Status: Duplicate (was: Fixed)
Project Member

Comment 13 by sheriffbot@chromium.org, Mar 1 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment