Crash in base::debug::DebugBreak |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6132695739662336 Fuzzer: libfuzzer_net_url_request_ftp_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x03e90000557c Crash State: base::debug::DebugBreak net::FtpNetworkTransaction::ProcessResponseUSER net::FtpNetworkTransaction::ProcessCtrlResponse Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747 Minimized Testcase (0.08 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv967HNimUaQ-6ZiDkc9lpZbk1UNWDVXCHCQCSvGpu0fN0IwlmOFcMsWagogv6eKTgLly6FSzZcSDotRByyuy2UfDkjax71bnSdU_twqMVQ2_XfQC-5L9qDFTls0ESfoFE7KLvdbyMY0jFutrxGwnUq610XyF9Q?testcase_id=6132695739662336 foo/\ 127 Hello \ 127 UNIX \ 100 Welcome \ \ 44444444444444444444444444444111 0 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Nov 22 2016
I was TBR'd for on that CL for a small extensions change. eroman@ did the full review.
,
Nov 22 2016
The glory goes to Matt for writing this fuzzer :)
,
Nov 22 2016
Ok, I'll take this on.
,
Nov 23 2016
Looks like this is just a case of two classes that can't agree on an API (You handle weird status codes, no, you handle them, or I'll DCHECK but still handle them anyways!) and no testing of this case. May not get to this until next week, but it's not a security issue, and shouldn't result in crashes or other bad user-visible behavior, either.
,
Nov 24 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/bc5e865358135a53401254798a54e0e8786a75ef commit bc5e865358135a53401254798a54e0e8786a75ef Author: mmenke <mmenke@chromium.org> Date: Thu Nov 24 00:15:19 2016 Fix some FTP DCHECKs on 1xx responses. A bunch of FTP response handlers did not have explicit handling for these responses, so fell through to the non-FTP response DCHECK. This code makes those responses now result in ERR_INVALID_RESPONSE. BUG= 667798 Review-Url: https://codereview.chromium.org/2528713002 Cr-Commit-Position: refs/heads/master@{#434294} [modify] https://crrev.com/bc5e865358135a53401254798a54e0e8786a75ef/net/ftp/ftp_network_transaction.cc [modify] https://crrev.com/bc5e865358135a53401254798a54e0e8786a75ef/net/ftp/ftp_network_transaction_unittest.cc
,
Nov 24 2016
,
Nov 25 2016
ClusterFuzz has detected this issue as fixed in range 434158:434362. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6132695739662336 Fuzzer: libfuzzer_net_url_request_ftp_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x03e90000557c Crash State: base::debug::DebugBreak net::FtpNetworkTransaction::ProcessResponseUSER net::FtpNetworkTransaction::ProcessCtrlResponse Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=434158:434362 Minimized Testcase (0.08 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv967HNimUaQ-6ZiDkc9lpZbk1UNWDVXCHCQCSvGpu0fN0IwlmOFcMsWagogv6eKTgLly6FSzZcSDotRByyuy2UfDkjax71bnSdU_twqMVQ2_XfQC-5L9qDFTls0ESfoFE7KLvdbyMY0jFutrxGwnUq610XyF9Q?testcase_id=6132695739662336 foo/\ 127 Hello \ 127 UNIX \ 100 Welcome \ \ 44444444444444444444444444444111 0 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mummare...@chromium.org
, Nov 22 2016Labels: Test-Predator-Wrong M-57
Owner: rdevlin....@chromium.org
Status: Assigned (was: Untriaged)