New issue
Advanced search Search tips

Issue 667798 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in base::debug::DebugBreak

Project Member Reported by ClusterFuzz, Nov 22 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6132695739662336

Fuzzer: libfuzzer_net_url_request_ftp_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e90000557c
Crash State:
  base::debug::DebugBreak
  net::FtpNetworkTransaction::ProcessResponseUSER
  net::FtpNetworkTransaction::ProcessCtrlResponse
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv967HNimUaQ-6ZiDkc9lpZbk1UNWDVXCHCQCSvGpu0fN0IwlmOFcMsWagogv6eKTgLly6FSzZcSDotRByyuy2UfDkjax71bnSdU_twqMVQ2_XfQC-5L9qDFTls0ESfoFE7KLvdbyMY0jFutrxGwnUq610XyF9Q?testcase_id=6132695739662336
foo/\
127 Hello
\ 127 UNIX
\ 100 Welcome
\ \ 
444444444444444444444444444441110


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Components: Internals>Network>FTP
Labels: Test-Predator-Wrong M-57
Owner: rdevlin....@chromium.org
Status: Assigned (was: Untriaged)
Through code search on file ftp_network_transaction.cc, latest changes done by mikecirone@gmail.com
https://chromium.googlesource.com/chromium/src/+/f22f981b847bc8cf67e3165b47a3891c6066e70f
Assigning to the reviewer of the CL rdevlin.cronin@. could you please take a look and help us to find correct owner if it is not related your changes.

Owner: eroman@chromium.org
I was TBR'd for on that CL for a small extensions change.  eroman@ did the full review.

Comment 3 by eroman@chromium.org, Nov 22 2016

Cc: mmenke@chromium.org
The glory goes to Matt for writing this fuzzer :)

Comment 4 by mmenke@chromium.org, Nov 22 2016

Cc: -mmenke@chromium.org eroman@chromium.org
Owner: mmenke@chromium.org
Ok, I'll take this on.

Comment 5 by mmenke@chromium.org, Nov 23 2016

Looks like this is just a case of two classes that can't agree on an API (You handle weird status codes, no, you handle them, or I'll DCHECK but still handle them anyways!) and no testing of this case.  May not get to this until next week, but it's not a security issue, and shouldn't result in crashes or other bad user-visible behavior, either.
Project Member

Comment 6 by bugdroid1@chromium.org, Nov 24 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bc5e865358135a53401254798a54e0e8786a75ef

commit bc5e865358135a53401254798a54e0e8786a75ef
Author: mmenke <mmenke@chromium.org>
Date: Thu Nov 24 00:15:19 2016

Fix some FTP DCHECKs on 1xx responses.

A bunch of FTP response handlers did not have explicit handling for
these responses, so fell through to the non-FTP response DCHECK.
This code makes those responses now result in ERR_INVALID_RESPONSE.

BUG= 667798 

Review-Url: https://codereview.chromium.org/2528713002
Cr-Commit-Position: refs/heads/master@{#434294}

[modify] https://crrev.com/bc5e865358135a53401254798a54e0e8786a75ef/net/ftp/ftp_network_transaction.cc
[modify] https://crrev.com/bc5e865358135a53401254798a54e0e8786a75ef/net/ftp/ftp_network_transaction_unittest.cc

Comment 7 by mmenke@chromium.org, Nov 24 2016

Status: Fixed (was: Assigned)
Project Member

Comment 8 by ClusterFuzz, Nov 25 2016

ClusterFuzz has detected this issue as fixed in range 434158:434362.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6132695739662336

Fuzzer: libfuzzer_net_url_request_ftp_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e90000557c
Crash State:
  base::debug::DebugBreak
  net::FtpNetworkTransaction::ProcessResponseUSER
  net::FtpNetworkTransaction::ProcessCtrlResponse
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=434158:434362

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv967HNimUaQ-6ZiDkc9lpZbk1UNWDVXCHCQCSvGpu0fN0IwlmOFcMsWagogv6eKTgLly6FSzZcSDotRByyuy2UfDkjax71bnSdU_twqMVQ2_XfQC-5L9qDFTls0ESfoFE7KLvdbyMY0jFutrxGwnUq610XyF9Q?testcase_id=6132695739662336
foo/\
127 Hello
\ 127 UNIX
\ 100 Welcome
\ \ 
444444444444444444444444444441110


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment