Integer-overflow in net::ExtractPortFromEPSVResponse |
|||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6249982303928320 Fuzzer: libfuzzer_net_url_request_ftp_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: net::ExtractPortFromEPSVResponse net::FtpNetworkTransaction::ProcessResponseEPSV net::FtpNetworkTransaction::ProcessCtrlResponse Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=433614:433692 Minimized Testcase (0.26 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97zJ8gPyy4k2uRaKqHRKCk62sfai4Ykmj7sLH8VGVIu-9HneJPccdU8hsl4l_RyZZn01X8V-t0fnJ7QxYYPpjbWm8mKOKJnYc-mZ_VsRLXypQ8px1qZ9Abt72INm9aj49EYyHCdNU6LXve0jfm5-zQ72AgpVQ?testcase_id=6249982303928320 spam.txt\ 230 Hello \ 215 UNIX \ 230 Welcome \ 257 "/" is your current location \ 200 TYPE set successfully \ 213 5 \ 550 Not a directory \ 227 227 Entering Extended Passive Mode (|||45575374463219|) \ I lied about the content size.\ \ 1 11111111111111111 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Nov 28 2016
,
Nov 29 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/794079041f3fb283eb888f48c0d806b5427a634a commit 794079041f3fb283eb888f48c0d806b5427a634a Author: mmenke <mmenke@chromium.org> Date: Tue Nov 29 01:56:02 2016 Use overflow-safe string-to-int parsing methods for FTP ports. BUG= 667779 , 667797 Review-Url: https://codereview.chromium.org/2539583002 Cr-Commit-Position: refs/heads/master@{#434826} [modify] https://crrev.com/794079041f3fb283eb888f48c0d806b5427a634a/net/ftp/ftp_network_transaction.cc [modify] https://crrev.com/794079041f3fb283eb888f48c0d806b5427a634a/net/ftp/ftp_network_transaction_unittest.cc
,
Nov 29 2016
,
Nov 29 2016
ClusterFuzz has detected this issue as fixed in range 434798:434881. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6249982303928320 Fuzzer: libfuzzer_net_url_request_ftp_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: net::ExtractPortFromEPSVResponse net::FtpNetworkTransaction::ProcessResponseEPSV net::FtpNetworkTransaction::ProcessCtrlResponse Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=433614:433692 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=434798:434881 Minimized Testcase (0.26 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97zJ8gPyy4k2uRaKqHRKCk62sfai4Ykmj7sLH8VGVIu-9HneJPccdU8hsl4l_RyZZn01X8V-t0fnJ7QxYYPpjbWm8mKOKJnYc-mZ_VsRLXypQ8px1qZ9Abt72INm9aj49EYyHCdNU6LXve0jfm5-zQ72AgpVQ?testcase_id=6249982303928320 spam.txt\ 230 Hello \ 215 UNIX \ 230 Welcome \ 257 "/" is your current location \ 200 TYPE set successfully \ 213 5 \ 550 Not a directory \ 227 227 Entering Extended Passive Mode (|||45575374463219|) \ I lied about the content size.\ \ 1 11111111111111111 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ajha@chromium.org
, Nov 23 2016Labels: M-57